# ISE first day: before the first RADIUS packet Source: https://ai.techclick.in/blog_cisco_ise_first_day_deployment Markdown: https://ai.techclick.in/blog_cisco_ise_first_day_deployment.md Publisher: Techclick Infosec Pvt Ltd First-day ISE: hostname, IP, persona, AD join, system certificate. Dummy ise-pan 10.10.10.20. ## The ticket Junior built policy sets last night. PEAP fails with “unknown CA.” AD groups are empty. NTP was never set. Policy was never the first problem. Quick interview answer First day is identity plumbing: DNS/NTP, node persona, Administration → Identity Management → Active Directory join (LDAP 389 / LDAPS 636 from the PDF), and Administration → System → Certificates for Admin and EAP. Endpoints that do not trust the EAP cert will not send PEAP passwords. Hero · first console If the laptop does not trust the ISE EAP cert, PEAP never starts a real tunnel. Lab data · dummy only PAN ise-pan 10.10.10.20 · PSN ise-psn1 10.10.10.21 · MnT ise-mnt 10.10.10.22 · NAD sw-access-01 10.10.10.2 · AD dc01 10.20.30.10 · Priya 10.20.30.80 TECHCLICK\priya.hr · printer 10.20.30.60 . Not a live customer. ## What first day is - Hostname that will never change (certs bind to it). - NTP — EAP-TLS and AD hate clock skew. - AD join so Authorization can use TECHCLICK\HR . - Certificates: Admin (browser) and EAP (supplicant). https://ise-pan.techclick-lab.in/admin Training mock · not live ISE Admin Context Visibility Operations Policy Administration Administration → Identity Management → Active Directory ### Join point TECHCLICK Join point name TECHCLICK AD domain techclick-lab.in Status Operational Groups pulled HR, IT, Guests Cancel Save ISE Admin: Identity Management → AD. PDF: nodes need TCP 389/636 to DCs. Training mock. ## Lab CA vs public CA Choice Use Risk ISE internal CA / lab CA in GPO This class lab Forgot GPO → every PEAP warn Enterprise PKI Production Wrong SAN / expired EAP cert Self-signed leftover Never for PEAP users Users click-through or fail ## First-day runbook - #### Side A — OS Setup wizard: IP 10.10.10.20, DNS 10.20.30.10, NTP. Persona: all-in-one for lab, or PAN only if distributed. - #### Side B — AD + cert Join TECHCLICK. Pull groups. Bind EAP certificate with SAN = FQDN ise-psn1.techclick-lab.in . - #### Side C — prove Operations → AD: connection test. Laptop trusts the CA. Then — and only then — NAD and policy sets. Proof · dummy # On PAN CLI (show / application style varies by train) show application status ise # All processes running # GUI: Administration → Identity Management → Active Directory → Connection Test # Result: Success dc01.techclick-lab.in # Windows: certmgr — Trusted Root has Lab_ISE_CA ## Four first-day failures ### 1 · Clock skew Kerberos / EAP-TLS fail. Fix NTP first. ### 2 · AD join with no group pull Join looks green. Authorization never sees HR. ### 3 · EAP cert SAN is the PAN name, clients hit the PSN name Certificate warning. Issue a cert that matches what the NAD/client reaches. ### 4 · Built policy before GPO Looks like “ISE PEAP is broken.” It is a trust-store problem. ## How to prove it Close first day only when 1) AD connection test green. 2) HR group visible. 3) Admin + EAP certs valid. 4) One lab PC trusts the CA. 5) Then go to the NAD lesson. ## Traps Symptom First proof Wrong fix PEAP unknown CA Laptop trusted roots Disable 802.1X Empty AD groups AD join groups tab New policy set Random EAP fails NTP on ISE and DC Reimage ISE ## Knowledge check Judgment items. One best answer. Reasons send you back to the matching section. Q1 Where do you join ISE to Active Directory? Policy → Policy Sets Administration → Identity Management → Active Directory Operations → Troubleshoot Context Visibility only Correct: b . Admin path from the PDF. Q2 Why NTP before PEAP? Pretty logs Kerberos and certificates fail with clock skew RADIUS cannot use UDP without NTP Switches require NTP for MAB Correct: b . Concept. Q3 EAP certificate SAN should match… Whatever hostname the client/NAD reaches Only 127.0.0.1 The printer MAC MnT only Correct: a . Failure 3. Q4 AD join green, HR group missing. Next? Pull/select groups on the join point Delete the PSN Turn off MAB Disable certs Correct: a . Failure 2. Q5 PDF says ISE must reach AD on… TCP 389 / 636 UDP 1812 only GRE pxGrid only Correct: a . Evidence pack. Q6 First day is done when… Policy sets exist AD + certs + NTP proved, before 802.1X Guest SSID is in production All printers have 802.1X Correct: b . Proof checklist. Check answers Reset Cisco ISE class series: Personas · First day · NAD + RADIUS · Policy sets · Wired 802.1X · MAB · CWA / guest · Profiling · dACL vs VLAN · Live logs · vs Forescout · Interview ## Sources - Cisco ISE 3.3 Admin Guide — basic setup, certificates, identity sources. - Lab PDF — AD join ports, Administration → Identity / Certificates paths. Related: ISE evidence desk · session factory · Forescout series . --- Cite this Techclick lesson with the source URL. Do not invent fees, batch dates, or job guarantees. Browse all lessons: https://ai.techclick.in/blogs AI index: https://ai.techclick.in/llms.txt