# NAD + RADIUS: the switch must speak ISE’s language Source: https://ai.techclick.in/blog_cisco_ise_nad_radius_switch Markdown: https://ai.techclick.in/blog_cisco_ise_nad_radius_switch.md Publisher: Techclick Infosec Pvt Ltd Network Access Device + IOS RADIUS. Shared secret, CoA, dACL download. Dummy sw-access-01 to PSN 10.10.10.21. ## The ticket Live Logs: “Unknown NAD” or silent drop. Or Access-Accept but no dACL. The switch secret is Cisco123 . ISE NAD object has LabSecret . Quick interview answer A NAD is the switch/WLC ISE trusts. Path: Administration → Network Devices . The device IP, device type, and RADIUS shared secret must match IOS. CoA (Change of Authorization) needs the switch to allow ISE to re-auth the session. dACLs need ip device tracking / IPDT and RADIUS authorization. Hero · switch to PSN Wrong secret = ISE never sees a valid request. Policy never runs. Lab data · dummy only PAN ise-pan 10.10.10.20 · PSN ise-psn1 10.10.10.21 · MnT ise-mnt 10.10.10.22 · NAD sw-access-01 10.10.10.2 · AD dc01 10.20.30.10 · Priya 10.20.30.80 TECHCLICK\priya.hr · printer 10.20.30.60 . Not a live customer. ## What a NAD is ISE only answers NADs it knows (or a default device if you were sloppy). Location/device-type attributes later drive policy-set conditions. https://ise-pan.techclick-lab.in/admin Training mock · not live ISE Admin Context Visibility Operations Policy Administration Administration → Network Devices ### sw-access-01 Name sw-access-01 IP 10.10.10.2 Device type Cisco Catalyst RADIUS secret •••••••• (lab only) CoA Enabled Cancel Save ISE Admin Guide — Network Devices. Training mock. ## What the switch must send Need IOS idea RADIUS to PSN radius server ISE-PSN1 address 10.10.10.21 auth-port 1812 acct-port 1813 AAA aaa new-model + authentication/authorization/accounting dot1x CoA Client source ISE PSN, server key match dACL RADIUS authorization + device tracking ## Both sides - #### Side A — ISE NAD Network Devices → Add. IP 10.10.10.2. Same secret. Enable RADIUS and CoA. - #### Side B — switch Modern radius server syntax. Point only at PSN .21 (and a second PSN later). Do not point at PAN. - #### Side C — prove test aaa . Live Logs show the NAD name sw-access-01 , not Unknown. IOS · dummy lab aaa new-model radius server ISE-PSN1 address ipv4 10.10.10.21 auth-port 1812 acct-port 1813 key LabSecret aaa group server radius ISE-GRP server name ISE-PSN1 aaa authentication dot1x default group ISE-GRP aaa authorization network default group ISE-GRP aaa accounting dot1x default start-stop group ISE-GRP aaa server radius dynamic-author client 10.10.10.21 server-key LabSecret ip device tracking test aaa group ISE-GRP TECHCLICK\priya.hr LabPass new-code ## Four NAD failures ### 1 · Shared secret mismatch No useful Live Log, or dropped request. Re-type both sides. Do not debug policy. ### 2 · NAD IP is the management VRF ISE never sees Source IP of RADIUS ≠ NAD object IP. ### 3 · No CoA Profiling/posture changes never bounce the port. Session stays stale. ### 4 · RADIUS pointed at PAN PAN may not be a PSN. Timeouts. ## How to prove it Close the ticket only when 1) test aaa returns a clear Accept or Reject (not timeout). 2) Live Logs NAD = sw-access-01. 3) CoA client listed. 4) Secret never written in a ticket body. ## Traps Symptom NAD story Wrong fix Timeout IP/secret/persona New authorization rule Unknown NAD Object missing / wrong IP Open any NAD Accept, no dACL authorization / IPDT Disable 802.1X ## Knowledge check Judgment items. One best answer. Reasons send you back to the matching section. Q1 Where is the NAD created? Policy → Policy Sets Administration → Network Devices Operations → Reports Context Visibility → Users Correct: b . Admin path. Q2 Switch should send RADIUS to… PAN always The PSN IP MnT AD directly Correct: b . Lesson 1 + this runbook. Q3 Shared secret mismatch first looks like… Timeout / no valid request A perfect dACL Guest portal pxGrid down only Correct: a . Failure 1. Q4 CoA is needed so ISE can… Change an already-authorized session (re-auth / new dACL) Join AD Issue the Admin cert Replace NTP Correct: a . Concept. Q5 test aaa is run on… The switch MnT only Priya’s laptop The printer Correct: a . PDF: simulate from switch CLI. Q6 Unknown NAD in Live Logs means… Create/fix the Network Device object / source IP Delete all policy sets Disable RADIUS Reimage the switch Correct: a . Failure 2. Check answers Reset Cisco ISE class series: Personas · First day · NAD + RADIUS · Policy sets · Wired 802.1X · MAB · CWA / guest · Profiling · dACL vs VLAN · Live logs · vs Forescout · Interview ## Sources - ISE 3.3 Admin — Network Devices. - Cisco ISE Secure Wired Access / IOS-XE AAA + dynamic-author examples. - Lab PDF — Administration → Network Devices; test aaa. Related: ISE evidence desk · session factory · Forescout series . --- Cite this Techclick lesson with the source URL. Do not invent fees, batch dates, or job guarantees. Browse all lessons: https://ai.techclick.in/blogs AI index: https://ai.techclick.in/llms.txt