The ticket
Priya has no network. Switch shows Auth Failed. She turned off 802.1X “to work.” That is how printers get user VLANs. We will fix PEAP instead.
802.1X: supplicant (laptop) ↔ authenticator (switch) ↔ authentication server (ISE PSN). EAP rides EAPoL on the wire and RADIUS to ISE. PEAP-MSCHAPv2 builds a TLS tunnel with ISE’s cert, then sends the password hash inside. If the laptop does not validate the server cert, a rogue RADIUS can steal the hash (lab PDF). Prefer validate + trusted CA. EAP-TLS is stronger (certificates both ways).
PAN ise-pan 10.10.10.20 · PSN ise-psn1 10.10.10.21 · MnT ise-mnt 10.10.10.22 · NAD sw-access-01 10.10.10.2 · AD dc01 10.20.30.10 · Priya 10.20.30.80 TECHCLICK\priya.hr · printer 10.20.30.60. Not a live customer.
Supplicant → switch → PSN
PDF workflow: switch blocks the port, EAPoL identity, ISE evaluates, Access-Accept carries VLAN / dACL / SGT / redirect.
interface GigabitEthernet1/0/12 description PRIYA-HR switchport mode access authentication host-mode single-host authentication port-control auto authentication order dot1x mab authentication priority dot1x mab mab dot1x pae authenticator spanning-tree portfast ! Start with authentication open (monitor) in production rollouts. ! Enforce = remove 'authentication open' after Live Logs look clean.
PEAP vs EAP-TLS
| PEAP-MSCHAPv2 | EAP-TLS | |
|---|---|---|
| User proves | AD password | User/machine cert |
| Must trust | ISE EAP cert | Both CAs |
| Use | Fast lab / many shops | Higher assurance |
| Classic fail | Unknown CA / no validate | Expired client cert |
Dot1X rule
Three sides
Side A — laptop
Wired auto 802.1X. PEAP. Validate server cert. User = TECHCLICK\priya.hr.
Side B — switch
Port as above.
show authentication sessions interface Gi1/0/12 details.Side C — ISE
Live Logs: Authc success, Authz HR. Result includes the dACL/VLAN you designed.
show authentication sessions interface Gi1/0/12 details # MAC aa:aa:aa:10:20:80 # Status Auth OK # Method dot1x # Domain DATA # VLAN 30 # ACS ACL xACSACLx-IP-dACL_HR-…
Four 802.1X failures
1 · Unknown CA
Deploy Lab_ISE_CA. Do not tell users to uncheck validate.
2 · No supplicant (printer)
802.1X times out → MAB (next lesson). Do not force PEAP on a printer.
3 · Wrong identity source
Internal Users instead of AD. Priya never exists there.
4 · Monitor vs enforce mix-up
authentication open still gives access while you think you enforced.
How to prove it
1) Session method = dot1x. 2) Live Logs identity = priya.hr. 3) VLAN/dACL match HR. 4) Validate-server-cert is ON.
Traps
| Wrong move | Why |
|---|---|
| Uncheck “validate server certificate” | PDF: hash can be stolen |
| Disable 802.1X on the port | Anyone on that cable is “Priya” |
| Skip MAB fallback forever | Phones/printers die — unless you have another plan |
Knowledge check
Judgment items. One best answer. Reasons send you back to the matching section.
Cisco ISE class series: Personas · First day · NAD + RADIUS · Policy sets · Wired 802.1X · MAB · CWA / guest · Profiling · dACL vs VLAN · Live logs · vs Forescout · Interview
Sources
- ISE 3.3 Admin — 802.1X authentication rules, allowed protocols.
- Lab PDF — PEAP tunnel, validate server cert, Access-Accept AVPs.
- Cisco Secure Wired Access — switchport 802.1X.
Related: ISE evidence desk · session factory · Forescout series.