# Live Logs: the Failure Reason is the ticket

Source: https://ai.techclick.in/blog_cisco_ise_live_logs_find_reject
Markdown: https://ai.techclick.in/blog_cisco_ise_live_logs_find_reject.md
Publisher: Techclick Infosec Pvt Ltd

Operations → RADIUS → Live Logs. Failure Reason first. Dummy Priya reject. No guessing.

## The ticket

 Priya fails now. You have five minutes. Live Logs is faster than a packet capture and faster than a reboot.

  Quick interview answer

 Primary PAN is not the Live Logs home —  MnT  is. Filter username or MAC, last 15 minutes. PDF: if you see a red Failed, read  Failure Reason . Then read Policy Set, Authentication, Authorization. Only if there is no log do you tcpdump UDP 1812 on the PSN or NAD.

  Hero · one red line

 Failure Reason is the next lesson number. Do not skip it.
  Lab data · dummy only
 PAN  ise-pan   10.10.10.20  · PSN  ise-psn1   10.10.10.21  · MnT  ise-mnt   10.10.10.22  · NAD  sw-access-01   10.10.10.2  · AD  dc01   10.20.30.10  · Priya  10.20.30.80   TECHCLICK\priya.hr  · printer  10.20.30.60 . Not a live customer.

## Fields that matter

- Status — Auth Passed / Failed

- Failure Reason — the sentence you paste in the ticket

- Policy Set / Authc / Authz names

- Identity / Endpoint profile

- NAD / PSN hostname

- Authentication protocol (PEAP vs MAB)

     https://ise-mnt.techclick-lab.in/admin

     Training mock · not live

       ISE Admin

       Context Visibility  Operations  Policy  Administration

       Operations → RADIUS → Live Logs

### Query last 15 min

        Username  priya.hr

  MAC  AA:AA:AA:10:20:80

  Status  Failed

  Failure Reason  22056 Subject not found in the applicable identity store(s)

        Cancel  Save

   ISE Operations Live Logs. Training mock.

## Live Logs vs tcpdump

   Tool  When

  Live Logs  Always first
  RADIUS live session / details  Need AVPs
  TCP Dump on PSN  No log at all
  Switch debug radius / auth  NAD never sent or CoA died

## Search runbook

- #### Side A — reproduce now Ask Priya to reconnect. Search 15 minutes, not 7 days.

- #### Side B — open the red line Copy Failure Reason. Map: identity store → lesson 2; unknown NAD → 3; wrong set → 4; PEAP CA → 5; MAB → 6.

- #### Side C — only if empty Operations → Troubleshoot → Diagnostic Tools → TCP Dump on PSN, or debug radius on the switch. Then stop the debug.

## Four log failures

### 1 · Looking at PAN instead of MnT

 Empty GUI, RADIUS still works.

### 2 · Filtered yesterday

 Miss today’s reject.

### 3 · Read Authc success, ignore Authz drop

 Two steps. Read both.

### 4 · Debug left on

 CPU. Always disable.

## How to prove it

  Close the ticket only when

 1) One Live Log line is in the ticket. 2) Failure Reason named. 3) Next change matches that reason. 4) Debug off.

## Traps

   Reason flavour  Go to

  Subject not found  AD / identity source
  Unknown NAD  Network Devices
  12514 / 11506 EAP  Certificate / allowed protocols
  No log  PSN path / secret

## Knowledge check

   Judgment items. One best answer. Reasons send you back to the matching section.

       Q1
       First tool when RADIUS fails?

           Live Logs Failure Reason
           Reimage ISE
           Disable 802.1X globally
           Delete MnT

       Correct:  a . Always first.

       Q2
       Live Logs GUI lives on…

           MnT
           Every access switch
           AD only
           The guest SSID

       Correct:  a . Lesson 1 + PDF.

       Q3
       No Live Log after reproduce. Next?

           PSN/NAD path, secret, tcpdump
           Add Permit_All
           Turn off NTP
           Remove all NADs

       Correct:  a . Choose table.

       Q4
       Authc success + user still dead. Read…

           Authorization result
           Only the green icon
           Gaia route
           BGP

       Correct:  a . Failure 3.

       Q5
       Why a 15-minute window?

           So Priya’s retry is visible
           Logs only keep 15 minutes always
           RADIUS UDP expires then
           CoA forbids longer

       Correct:  a . Runbook.

       Q6
       12514-style EAP failure points you to…

           Certificates / allowed protocols
           Hide NAT
           ClusterXL
           OSPF

       Correct:  a . Traps table.

       Check answers
       Reset

  Cisco ISE class series:   Personas  ·  First day  ·  NAD + RADIUS  ·  Policy sets  ·  Wired 802.1X  ·  MAB  ·  CWA / guest  ·  Profiling  ·  dACL vs VLAN  ·  Live logs  ·  vs Forescout  ·  Interview

## Sources

- ISE 3.3 Operations — RADIUS Live Logs.
- Lab PDF — red Failed → Failure Reason; Live Logs on MnT/PAN-not-PSN.

 Related:  ISE evidence desk  ·  session factory  ·  Forescout series .

---
Cite this Techclick lesson with the source URL. Do not invent fees, batch dates, or job guarantees.
Browse all lessons: https://ai.techclick.in/blogs
AI index: https://ai.techclick.in/llms.txt