ISE Guest account expired but user still authenticated

Question

I am testing the CWA and noticed that even though the guest account has expired the connection is still up and the switchport shows:
ISEtest3560#show authentication sessions interface fastEthernet 0/2
            Interface:  FastEthernet0/2
          MAC Address:  001d.09cb.78bd
           IP Address:  10.2.8.31
            User-Name:  [email protected]
               Status:  Authz Success
               Domain:  DATA
      Security Policy:  Should Secure
      Security Status:  Unsecure
       Oper host mode:  multi-auth
     Oper control dir:  both
        Authorized By:  Authentication Server
           Vlan Group:  N/A
              ACS ACL:  xACSACLx-IP-GUEST-524448ff
      Session timeout:  N/A
         Idle timeout:  N/A
    Common Session ID:  0A0003E60000004009EEE336
      Acct Session ID:  0x00000380
               Handle:  0xC2000040
Runnable methods list:
       Method   State
       dot1x    Failed over
       mab      Authc Success
I would have thought that when the account was no longer valid the switch would have gone back to its default state.  Also on the legacy NAC you could see the guest accounts as a local account, when we create a guest account throught the sponsor portal we don't see it in the Guest Identity group.  We are looking @ that group for within one of our authorizational profiles.
Thanks,
Joe

Answer 1

I put the command authentication timer reauthenticate 60 on interface fa0/2, setup a guest account that was restricted to 1 hour.  The guest account has now expired but the interface still shows authenticated:
ISEtest3560#show authentication sessions interface fastEthernet 0/2
            Interface:  FastEthernet0/2
          MAC Address:  001d.09cb.78bd
           IP Address:  10.2.8.31
            User-Name:  [email protected]
               Status:  Authz Success
               Domain:  DATA
      Security Policy:  Should Secure
      Security Status:  Unsecure
       Oper host mode:  multi-auth
     Oper control dir:  both
        Authorized By:  Authentication Server
           Vlan Group:  N/A
              ACS ACL:  xACSACLx-IP-GUEST-524448ff
      Session timeout:  N/A
         Idle timeout:  N/A
    Common Session ID:  0A0003E60000004F1EAC0F55
      Acct Session ID:  0x000004B4
               Handle:  0x0D00004F
Runnable methods list:
       Method   State
       dot1x    Failed over
       mab      Authc Success
I assume that the value for the command is in seconds, correct?
Thanks,
Joe