The ticket
Junior built policy sets last night. PEAP fails with “unknown CA.” AD groups are empty. NTP was never set. Policy was never the first problem.
First day is identity plumbing: DNS/NTP, node persona, Administration → Identity Management → Active Directory join (LDAP 389 / LDAPS 636 from the PDF), and Administration → System → Certificates for Admin and EAP. Endpoints that do not trust the EAP cert will not send PEAP passwords.
PAN ise-pan 10.10.10.20 · PSN ise-psn1 10.10.10.21 · MnT ise-mnt 10.10.10.22 · NAD sw-access-01 10.10.10.2 · AD dc01 10.20.30.10 · Priya 10.20.30.80 TECHCLICK\priya.hr · printer 10.20.30.60. Not a live customer.
What first day is
- Hostname that will never change (certs bind to it).
- NTP — EAP-TLS and AD hate clock skew.
- AD join so Authorization can use
TECHCLICK\HR. - Certificates: Admin (browser) and EAP (supplicant).
Join point TECHCLICK
Lab CA vs public CA
| Choice | Use | Risk |
|---|---|---|
| ISE internal CA / lab CA in GPO | This class lab | Forgot GPO → every PEAP warn |
| Enterprise PKI | Production | Wrong SAN / expired EAP cert |
| Self-signed leftover | Never for PEAP users | Users click-through or fail |
First-day runbook
Side A — OS
Setup wizard: IP 10.10.10.20, DNS 10.20.30.10, NTP. Persona: all-in-one for lab, or PAN only if distributed.
Side B — AD + cert
Join TECHCLICK. Pull groups. Bind EAP certificate with SAN = FQDN
ise-psn1.techclick-lab.in.Side C — prove
Operations → AD: connection test. Laptop trusts the CA. Then — and only then — NAD and policy sets.
# On PAN CLI (show / application style varies by train) show application status ise # All processes running # GUI: Administration → Identity Management → Active Directory → Connection Test # Result: Success dc01.techclick-lab.in # Windows: certmgr — Trusted Root has Lab_ISE_CA
Four first-day failures
1 · Clock skew
Kerberos / EAP-TLS fail. Fix NTP first.
2 · AD join with no group pull
Join looks green. Authorization never sees HR.
3 · EAP cert SAN is the PAN name, clients hit the PSN name
Certificate warning. Issue a cert that matches what the NAD/client reaches.
4 · Built policy before GPO
Looks like “ISE PEAP is broken.” It is a trust-store problem.
How to prove it
1) AD connection test green. 2) HR group visible. 3) Admin + EAP certs valid. 4) One lab PC trusts the CA. 5) Then go to the NAD lesson.
Traps
| Symptom | First proof | Wrong fix |
|---|---|---|
| PEAP unknown CA | Laptop trusted roots | Disable 802.1X |
| Empty AD groups | AD join groups tab | New policy set |
| Random EAP fails | NTP on ISE and DC | Reimage ISE |
Knowledge check
Judgment items. One best answer. Reasons send you back to the matching section.
Cisco ISE class series: Personas · First day · NAD + RADIUS · Policy sets · Wired 802.1X · MAB · CWA / guest · Profiling · dACL vs VLAN · Live logs · vs Forescout · Interview
Sources
- Cisco ISE 3.3 Admin Guide — basic setup, certificates, identity sources.
- Lab PDF — AD join ports, Administration → Identity / Certificates paths.
Related: ISE evidence desk · session factory · Forescout series.