Official default MAB when MAC is unknown?

Correct: b. ISE 3.3 default MAB options.

Cisco · ISE 3.3 · Lesson 4 of 12

Policy sets: first match, then authc, then authz

You added a perfect Authorization rule at the bottom of Default. The top Default set already ate the request. ISE policy sets are a first-match list. Inside a set: Authentication first, then Authorization. This lesson is that order.

Updated 2026-08-18·20 min read·L2 primary·Quiz at end

After this page you can

Draw policy-set → authentication → authorization.
Write a set condition (Wired / Wireless / NAD group).
Explain Continue on MAB ‘user not found’ vs Reject.
Prove which set and which rule hit in Live Logs.

The ticket

Wired rule never hits. Live Logs show Policy Set = Default. Your shiny Wired_Lab set is below Default and Default matches everything.

Quick interview answer

Policy sets are an ordered list. First set whose condition matches wins — the rest never run. Inside the set, Authentication decides who (or Continue/Reject). Authorization decides what they get (VLAN, dACL, SGT, redirect). Official default Dot1X: reject on fail / user not found. Official default MAB: if user not found, push to authorization (so profiling can still run).

Policy sets stacked, first match wins — A wide Default set above Wired_Lab makes Wired_Lab dead ink.

Lab data · dummy only

PAN ise-pan 10.10.10.20 · PSN ise-psn1 10.10.10.21 · MnT ise-mnt 10.10.10.22 · NAD sw-access-01 10.10.10.2 · AD dc01 10.20.30.10 · Priya 10.20.30.80 TECHCLICK\priya.hr · printer 10.20.30.60. Not a live customer.

Three layers of first match

Which policy set?
Which authentication rule (Dot1X vs MAB vs Guest)?
Which authorization rule (HR dACL vs quarantine)?

Request walk

If step 1 is wrong, you will tune the wrong rules forever.

One set vs many

Design	Use	Risk
Default only	Tiny lab	Wireless change breaks wired
Wired / Wireless / VPN sets	Production	Forgot to put Wired above Default
Monitor-mode set (NAD attribute)	Safe rollout	NAD not tagged, hits enforce set

https://ise-pan.techclick-lab.in/admin

Training mock · not live

ISE Admin

Context VisibilityOperationsPolicyAdministration

Policy → Policy Sets

Wired_Lab

Condition

DEVICE:Device Type EQUALS Cisco Catalyst OR Wired_802.1X

Allowed protocols

Default Network Access

Authc

Dot1X → AD ; MAB → Internal Endpoints (Continue if not found)

Authz

HR → dACL_HR ; Default → Quarantine

ISE 3.3 segmentation / policy sets. Training mock.

How you write a set

Side A — place it
Policy → Policy Sets → insert above Default.
Side B — authc
Dot1X → AD. MAB → Internal Endpoints, Continue if not found (lab/monitor). Allowed protocols include PEAP/EAP-TLS/MAB.
Side C — authz + prove
HR group → permit dACL. Default → limited. Live Logs must show set name Wired_Lab.

Four set failures

1 · Shadowed set

Default above you. Move Wired_Lab up.

2 · Authc Reject before Authz

MAB unknown MAC Reject — never reaches profiling-friendly authorization. Use Continue in monitor mode.

3 · Allowed protocols missing PEAP

Looks like AD is down. It is protocol.

4 · Tuned Authorization in the wrong set

Live Logs tell you. Believe them.

How to prove it

Close the ticket only when

1) Live Logs Policy Set = Wired_Lab. 2) Authentication rule name is the one you expect. 3) Authorization result matches. 4) A wireless test still hits the wireless set, not Wired_Lab.

Traps

Log field	Read it as
Policy Set	Step 1
Authentication Policy / Identity	Step 2
Authorization Policy / Result	Step 3

Cisco ISE class series: Personas · First day · NAD + RADIUS · Policy sets · Wired 802.1X · MAB · CWA / guest · Profiling · dACL vs VLAN · Live logs · vs Forescout · Interview

Sources

ISE 3.3 policy sets, default Dot1X/MAB options.
Lab PDF — first-match policy thinking.