The ticket
Live Logs: “Unknown NAD” or silent drop. Or Access-Accept but no dACL. The switch secret is Cisco123. ISE NAD object has LabSecret.
A NAD is the switch/WLC ISE trusts. Path: Administration → Network Devices. The device IP, device type, and RADIUS shared secret must match IOS. CoA (Change of Authorization) needs the switch to allow ISE to re-auth the session. dACLs need ip device tracking / IPDT and RADIUS authorization.
PAN ise-pan 10.10.10.20 · PSN ise-psn1 10.10.10.21 · MnT ise-mnt 10.10.10.22 · NAD sw-access-01 10.10.10.2 · AD dc01 10.20.30.10 · Priya 10.20.30.80 TECHCLICK\priya.hr · printer 10.20.30.60. Not a live customer.
What a NAD is
ISE only answers NADs it knows (or a default device if you were sloppy). Location/device-type attributes later drive policy-set conditions.
sw-access-01
What the switch must send
| Need | IOS idea |
|---|---|
| RADIUS to PSN | radius server ISE-PSN1 address 10.10.10.21 auth-port 1812 acct-port 1813 |
| AAA | aaa new-model + authentication/authorization/accounting dot1x |
| CoA | Client source ISE PSN, server key match |
| dACL | RADIUS authorization + device tracking |
Both sides
Side A — ISE NAD
Network Devices → Add. IP 10.10.10.2. Same secret. Enable RADIUS and CoA.
Side B — switch
Modern
radius serversyntax. Point only at PSN .21 (and a second PSN later). Do not point at PAN.Side C — prove
test aaa. Live Logs show the NAD namesw-access-01, not Unknown.
aaa new-model radius server ISE-PSN1 address ipv4 10.10.10.21 auth-port 1812 acct-port 1813 key LabSecret aaa group server radius ISE-GRP server name ISE-PSN1 aaa authentication dot1x default group ISE-GRP aaa authorization network default group ISE-GRP aaa accounting dot1x default start-stop group ISE-GRP aaa server radius dynamic-author client 10.10.10.21 server-key LabSecret ip device tracking test aaa group ISE-GRP TECHCLICK\priya.hr LabPass new-code
Four NAD failures
1 · Shared secret mismatch
No useful Live Log, or dropped request. Re-type both sides. Do not debug policy.
2 · NAD IP is the management VRF ISE never sees
Source IP of RADIUS ≠ NAD object IP.
3 · No CoA
Profiling/posture changes never bounce the port. Session stays stale.
4 · RADIUS pointed at PAN
PAN may not be a PSN. Timeouts.
How to prove it
1) test aaa returns a clear Accept or Reject (not timeout). 2) Live Logs NAD = sw-access-01. 3) CoA client listed. 4) Secret never written in a ticket body.
Traps
| Symptom | NAD story | Wrong fix |
|---|---|---|
| Timeout | IP/secret/persona | New authorization rule |
| Unknown NAD | Object missing / wrong IP | Open any NAD |
| Accept, no dACL | authorization / IPDT | Disable 802.1X |
Knowledge check
Judgment items. One best answer. Reasons send you back to the matching section.
Cisco ISE class series: Personas · First day · NAD + RADIUS · Policy sets · Wired 802.1X · MAB · CWA / guest · Profiling · dACL vs VLAN · Live logs · vs Forescout · Interview
Sources
- ISE 3.3 Admin — Network Devices.
- Cisco ISE Secure Wired Access / IOS-XE AAA + dynamic-author examples.
- Lab PDF — Administration → Network Devices; test aaa.
Related: ISE evidence desk · session factory · Forescout series.