Prove ISE. Quote the reason code.

1. Why the desk exists

The session factory taught you that ISE manufactures an AuthC + AuthZ result. This page is 01:10, when Slack wants a restart and you have sixty seconds to pick a window. The four tools below live under Operations plus one Catalyst command. None of them is Policy → Policy Sets.

Official help is blunt: the Operations menu is viewed from the primary Policy Administration Node (PAN). It does not appear on the primary Monitoring node. Live Logs are last 24 hours. Older than that is Operations → Reports → Reports → Endpoints and Users → RADIUS Authentications.

Visual · pick a tool, not a theory

2. Mental model — four tools

Each tool answers one question. Use the wrong one and you will quote a field that cannot prove the ticket.

Feel · four stations

3. First-tool decision

Do not improvise. Ask two questions out loud: is there a Live Log row for this MAC, and did ISE already Accept? The flowchart is the whole first minute.

4. Five tickets · first tool + proof field

Memorise this table. It is the interview and the bridge. Dummy 5-tuple on this page: user finance.user, MAC AA:BB:CC:DD:EE:FF, NAD 192.0.2.10 (SW-FIN-01) Gi1/0/12, PSN 198.51.100.20, policy set Wired-MAB-then-Dot1X.

Source for Live Log columns: ISE 3.4 Troubleshoot — RADIUS Live Logs. Source for TCP Dump clicks: same chapter, “TCP Dump Utility to Validate Incoming Traffic.” Source for NAD command: Troubleshoot Dot1x on Catalyst 9000 and the failed-auth community guide.

5. Runbook · Side A logs, Side B dump, Side C NAD

Work the same MAC through all three sides. Do not skip to C because a switch login feels more senior. Primary source for Side A: Cisco’s high-level flow in How To Troubleshoot ISE Failed Authentications & Authorizations — Live Logs first, then NAD, then the wire.

Side A — Live Logs then Live Sessions

1. Open Live Logs on the primary PAN

   Operations → RADIUS → Live Logs. Official note: you view RADIUS live logs only on the primary PAN. Filter Endpoint ID (MAC) even for 802.1X — the username may not be known yet. Live Logs hold ~24 hours. If the row is gone, open Operations → Reports → Reports → Endpoints and Users → RADIUS Authentications.

2. Read four columns before you speak

   Status (green pass / red fail) · Event · Failure Reason · Network Device + Device Port. Then click Details. Quote Policy Set, identity store, Auth Method, Authentication Protocol, and Session ID. Identity shows as INVALID when the name is not in any ID store — enable Disclose Invalid Usernames under Administration → System → Settings → Security Settings only for a timed debug window.

3. If Status is green and the user is still dead, change tool — do not rewrite the rule

   Open Operations → RADIUS → Live Sessions and confirm ISE still holds the session and the Authorization Profile. Then go to Side C. A 5200 Auth-Accept plus Posture Status NonCompliant is posture, not 22056. A 5200 plus a dead port is NAD apply, not identity store.

Side B — TCP Dump (when the row is missing)

Primary source: TCP Dump Utility to Validate Incoming Traffic. Official path: Operations → Troubleshoot → Diagnostic Tools → General Tools → TCP Dump.

1. Pick the node and the interface, not “the deployment”

   Host Name = the PSN you think that NAD uses. Network Interface = the interface that should see RADIUS. Promiscuous Mode defaults to On — leave it. An empty dump on the wrong node is not proof the packet never left the closet.

2. Write a Boolean filter. Start. Reproduce. Stop.

   Documented form: host 192.0.2.10 and port 1812 (or 1645 if that NAD is still on the old auth port). Official examples also allow ip host 10.77.122.123 and ip host ISE123. Click Start, reproduce once, click Stop — or wait for the 500,000-packet cap. Download the file. Do not leave the capture running.

3. Read one binary fact

   No Access-Request = NAD path (radius-server host, source-interface, ACL, routing, dead-criteria). Access-Request present + empty Live Logs = ISE dropped it before MnT — classic 11007 (NAD object / IP mismatch) once a row appears, or a shared-secret drop that shows as 11036.

Side C — NAD show authentication sessions

Primary source: Cisco’s failed-auth guide and Troubleshoot Dot1x on Catalyst 9000. If SNMP is allowed, ISE can poll the same output via Operations → Troubleshoot → Diagnostic Tools → General Tools → Execute Network Device Command.

1. Quote the interface from Live Logs first

   Network Device + Device Port on the Live Log row is the closet and the jack. Do not show authentication sessions the whole stack and guess.

2. Read Status, then Method, then VLAN Policy

   show authentication sessions interface Gi1/0/12 is the short view. … details is the proof. Status: Authorized plus a wrong VLAN is profiler / AuthZ — isolate, then name an owner. Status: Authz Failed after ISE 5200 is policy mismatch (VLAN missing, dACL syntax, AVP the switch will not apply). Method list dot1x / mab = Authen Failed with empty Live Logs is Ticket 2, not Ticket 3.

SW-FIN-01# show authentication sessions interface Gi1/0/12 details
            Interface:  GigabitEthernet1/0/12
          MAC Address:  aabb.ccdd.eeff
             User-Name:  finance.user
               Status:  Authz Failed
               Domain:  DATA
      Oper host mode:  multi-auth
  Common Session ID:  13A37A0A0000011DC85C34C5
            Vlan Policy:  EMPLOYEE
       Current Policy:  POLICY_Gi1/0/12

Method status list:
       Method           State
       dot1x            Authc Success
       mab              Not run

What you say. “ISE Authenticated. The switch could not apply authorization — Status Authz Failed, VLAN Policy EMPLOYEE. I will not reset the password. Next proof is show vlan and the dACL syntax, with a change-control owner.”

6. After the click — what you re-read

Once the user retries, you do not open a new theory. You re-read the same MAC and the same Session ID.

• Still failing AuthC? Same Failure Reason? Then the store / password / cert did not change. A new code means a new desk.
• 22056 gone, 24408 now? The subject is in the store; the password is wrong. Do not rebuild the sequence.
• 5200 plus Posture NonCompliant? That is remediation by design. Do not bypass posture at 01:00 without an owner.
• 5200 plus NAD Status Authorized and VLAN Policy matching the profile? The ISE ticket is closed. Next is DHCP / ACL on the VLAN, not a new AuthZ rule.
• 5417 Dynamic Authorization failed after a posture CoA? NAD is not accepting CoA from that PSN. That is change-control on the switch, not a new posture policy.

Proof · leave the desk

7. Traps and proof checklist

Sources

• Cisco ISE Administrator Guide 3.4 — Troubleshoot — Operations menu on the primary PAN; RADIUS Live Logs fields (Failure Reason, Event, Endpoint ID, Network Device); Live Sessions; TCP Dump path and filter; Execute Network Device Command
• Cisco ISE Administrator Guide 3.3 — Maintain and Monitor — Live Logs / monitoring context
• How To Troubleshoot ISE Failed Authentications & Authorizations — Live Logs first; show authentication sessions interface; TCP Dump steps; reason codes 22056, 11007, 11036, 5411, 5417, 15039, 24408
• Troubleshoot Dot1x on Catalyst 9000 Series Switches — show authentication sessions and … details
• Troubleshoot Dot1x and Radius in IOS and IOS-XE — NAD session vs ISE Live Logs
• Debugs to Troubleshoot on ISE
• Understand ISE Services Purpose and Troubleshooting

Related: Session factory — quote the reason code · Cisco ISE interview hub · Dummy lab