Cisco · ISE 3.3 · Lesson 10 of 12

Live Logs: the Failure Reason is the ticket

Three theories: AD, certificate, dACL. Nobody opened Operations → RADIUS → Live Logs. This lesson is the search that ends the argument: time box, 5-tuple, Failure Reason, policy set, then the matching lesson.

Updated 2026-08-18·16 min read·L2 primary·Quiz at end

After this page you can

Open Live Logs on MnT and filter client MAC / user / NAD.
Read Failure Reason before changing policy.
Know when to use TCP Dump / RADIUS live session.
Not restart ISE because the log already named the cause.

The ticket

Priya fails now. You have five minutes. Live Logs is faster than a packet capture and faster than a reboot.

Quick interview answer

Primary PAN is not the Live Logs home — MnT is. Filter username or MAC, last 15 minutes. PDF: if you see a red Failed, read Failure Reason. Then read Policy Set, Authentication, Authorization. Only if there is no log do you tcpdump UDP 1812 on the PSN or NAD.

ISE Live Logs with one failed RADIUS line — Failure Reason is the next lesson number. Do not skip it.

Lab data · dummy only

PAN ise-pan 10.10.10.20 · PSN ise-psn1 10.10.10.21 · MnT ise-mnt 10.10.10.22 · NAD sw-access-01 10.10.10.2 · AD dc01 10.20.30.10 · Priya 10.20.30.80 TECHCLICK\priya.hr · printer 10.20.30.60. Not a live customer.

Fields that matter

Status — Auth Passed / Failed
Failure Reason — the sentence you paste in the ticket
Policy Set / Authc / Authz names
Identity / Endpoint profile
NAD / PSN hostname
Authentication protocol (PEAP vs MAB)

https://ise-mnt.techclick-lab.in/admin

Training mock · not live

ISE Admin

Context VisibilityOperationsPolicyAdministration

Operations → RADIUS → Live Logs

Query last 15 min

Username

priya.hr

MAC

AA:AA:AA:10:20:80

Status

Failed

Failure Reason

22056 Subject not found in the applicable identity store(s)

ISE Operations Live Logs. Training mock.

Live Logs vs tcpdump

Tool	When
Live Logs	Always first
RADIUS live session / details	Need AVPs
TCP Dump on PSN	No log at all
Switch debug radius / auth	NAD never sent or CoA died

Search runbook

Side A — reproduce now
Ask Priya to reconnect. Search 15 minutes, not 7 days.
Side B — open the red line
Copy Failure Reason. Map: identity store → lesson 2; unknown NAD → 3; wrong set → 4; PEAP CA → 5; MAB → 6.
Side C — only if empty
Operations → Troubleshoot → Diagnostic Tools → TCP Dump on PSN, or debug radius on the switch. Then stop the debug.

Four log failures

1 · Looking at PAN instead of MnT

Empty GUI, RADIUS still works.

2 · Filtered yesterday

Miss today’s reject.

3 · Read Authc success, ignore Authz drop

Two steps. Read both.

4 · Debug left on

CPU. Always disable.

How to prove it

Close the ticket only when

1) One Live Log line is in the ticket. 2) Failure Reason named. 3) Next change matches that reason. 4) Debug off.

Traps

Reason flavour	Go to
Subject not found	AD / identity source
Unknown NAD	Network Devices
12514 / 11506 EAP	Certificate / allowed protocols
No log	PSN path / secret

Cisco ISE class series: Personas · First day · NAD + RADIUS · Policy sets · Wired 802.1X · MAB · CWA / guest · Profiling · dACL vs VLAN · Live logs · vs Forescout · Interview

Sources

ISE 3.3 Operations — RADIUS Live Logs.
Lab PDF — red Failed → Failure Reason; Live Logs on MnT/PAN-not-PSN.