# Prove ISE. Quote the reason code. Source: https://ai.techclick.in/blog_ise_evidence_desk Markdown: https://ai.techclick.in/blog_ise_evidence_desk.md Publisher: Techclick Infosec Pvt Ltd How you prove ISE: Live Logs, Operations, TCP Dump, NAD show authentication sessions. Five tickets with the first tool and the proof field (reason code). Quick answer Open Operations → RADIUS → Live Logs on the primary PAN first. Filter the MAC. Quote Failure Reason . Empty row → TCP Dump on the PSN ( host <NAD> and port 1812 ). Green Auth-Accept but a dead port → NAD show authentication sessions interface Gi1/0/12 details and read Status . You do not restart Application Server to fix 22056. Say this out loud I quote the reason code, the policy set, and the result. I do not say RADIUS failed. Live Logs is history of what ISE decided. TCP Dump is whether the packet arrived. show authentication sessions is whether the NAD applied it. A green PSN is not proof that this closet used it. ## 1. Why the desk exists The session factory taught you that ISE manufactures an AuthC + AuthZ result. This page is 01:10, when Slack wants a restart and you have sixty seconds to pick a window. The four tools below live under Operations plus one Catalyst command. None of them is Policy → Policy Sets . Official help is blunt: the Operations menu is viewed from the primary Policy Administration Node (PAN). It does not appear on the primary Monitoring node. Live Logs are last 24 hours. Older than that is Operations → Reports → Reports → Endpoints and Users → RADIUS Authentications . Visual · pick a tool, not a theory Notice: the diamond comes first. Tool 1 is not always TCP Dump. It is Live Logs unless the row is missing. Hard words, once Live Logs — last-24-hour RADIUS authentications on the primary PAN. Failure Reason — the official numbered code (22056, 11007, 11036, 5411…). Live Sessions — sessions ISE still holds. TCP Dump — ISE sniffs a node interface against a Boolean filter. NAD — Network Access Device (switch / WLC). show authentication sessions — Catalyst proof of what the port actually applied. ## 2. Mental model — four tools Each tool answers one question. Use the wrong one and you will quote a field that cannot prove the ticket. #### Live Logs History of ISE’s decision. Path: Operations → RADIUS → Live Logs . Proves Status, Event, Failure Reason, Identity, Endpoint ID, Network Device, Policy Set / Authorization Profile, Auth Method, Authentication Protocol, Session ID. #### Live Sessions What ISE still thinks is live. Path: Operations → RADIUS → Live Sessions . Proves the session still exists, Authorization Profile, Posture Status, and the NAD. Not proof the switch applied the VLAN. #### TCP Dump The wire at ISE. Path: Operations → Troubleshoot → Diagnostic Tools → General Tools → TCP Dump . Proves whether a RADIUS Access-Request arrived on that node, on that port. #### NAD show auth session Catalyst twin of “did the port take the result.” Command: show authentication sessions interface Gi1/0/12 details . Proves Status, Method, VLAN Policy, User-Name, Common Session ID. Tool When it exists It cannot prove Live Logs A RADIUS request reached a PSN and MnT stored it. Last 24 hours, primary PAN only. That the NAD applied the VLAN or dACL. A request that never left the closet. Live Sessions ISE still holds a session object for that endpoint. Yesterday’s outage. A failed AuthC that never created a session. The switchport state. TCP Dump After you pick the node interface, set a filter, click Start, and reproduce. Anything if you left the filter empty and captured the whole PSN. The identity-store miss (that is 22056). show authentication sessions While the authenticator still holds the client on that interface. Why ISE chose a store (Live Logs). Whether RADIUS left the NAD (TCP Dump on ISE or SPAN). Feel · four stations Notice: EAPoL lives on the access link. RADIUS lives NAD → PSN. Live Logs only start after the PSN accepts the packet. ## 3. First-tool decision Do not improvise. Ask two questions out loud: is there a Live Log row for this MAC, and did ISE already Accept? The flowchart is the whole first minute. Flow 1 · which window first First-tool decision for a Cisco ISE ticket - Ticket lands “RADIUS failed” Live Logs first Ops → RADIUS → Live Logs filter MAC A row? this MAC / NAS YES Quote Failure Reason 22056 · 11036 · 5411 NO TCP Dump on PSN host NAD and port 1812 ISE already Accept? Event 5200 / green Status YES · port still dead NAD show auth session Status · VLAN Policy Dump has Access-Request + empty logs → 11007 likely Dump is silent NAD path / secret / UDP 1812 Authz Failed on NAD VLAN / dACL / AVP mismatch Older than 24 h? Operations → Reports → Endpoints and Users → RADIUS Authentications Operations is on the primary PAN. It does not appear on the primary MnT node. Read left → right, then down. Diamond = is there a row. Pink is “ISE never logged it.” Amber is “ISE accepted; the NAD did not.” ## 4. Five tickets · first tool + proof field Memorise this table. It is the interview and the bridge. Dummy 5-tuple on this page: user finance.user , MAC AA:BB:CC:DD:EE:FF , NAD 192.0.2.10 ( SW-FIN-01 ) Gi1/0/12, PSN 198.51.100.20 , policy set Wired-MAB-then-Dot1X . # Ticket you hear First tool Proof field you quote 1 “RADIUS failed. Restart ISE.” User cannot get on the wire. Operations → RADIUS → Live Logs (filter MAC) Failure Reason = 22056 Subject not found in the applicable identity store(s) 2 Dashboard green. One closet fails. Live Logs empty for that NAS / MAC. Operations → Troubleshoot → Diagnostic Tools → General Tools → TCP Dump Access-Request absent on host 192.0.2.10 and port 1812 — or present + Live Logs 11007 3 Live Logs green Auth-Accept. Port still dead. NAD show authentication sessions interface Gi1/0/12 details Status = Authz Failed (VLAN Policy / dACL / AVP mismatch) 4 User hangs, then fails. Password already reset twice. Operations → RADIUS → Live Logs Failure Reason = 5411 No response received during 120 seconds on last EAP message sent to the client 5 New closet, or secret rotated last change window. Operations → RADIUS → Live Logs Failure Reason = 11036 The Message-Authenticator RADIUS attribute is invalid Source for Live Log columns: ISE 3.4 Troubleshoot — RADIUS Live Logs . Source for TCP Dump clicks: same chapter, “TCP Dump Utility to Validate Incoming Traffic.” Source for NAD command: Troubleshoot Dot1x on Catalyst 9000 and the failed-auth community guide. Do not swap Event and Failure Reason Event is the headline ( 5400 Authentication failed / 5200 Authentication succeeded ). Failure Reason is why. 22056 is a store miss. 24408 is a wrong AD password. 15039 is AuthZ reject after AuthC passed. 5411 is a silent client. Saying “RADIUS failed” collapses four different desks into one wrong restart. ## 5. Runbook · Side A logs, Side B dump, Side C NAD Work the same MAC through all three sides. Do not skip to C because a switch login feels more senior. Primary source for Side A: Cisco’s high-level flow in How To Troubleshoot ISE Failed Authentications & Authorizations — Live Logs first, then NAD, then the wire. ### Side A — Live Logs then Live Sessions #### Open Live Logs on the primary PAN Operations → RADIUS → Live Logs . Official note: you view RADIUS live logs only on the primary PAN. Filter Endpoint ID (MAC) even for 802.1X — the username may not be known yet. Live Logs hold ~24 hours. If the row is gone, open Operations → Reports → Reports → Endpoints and Users → RADIUS Authentications . - #### Read four columns before you speak Status (green pass / red fail) · Event · Failure Reason · Network Device + Device Port . Then click Details. Quote Policy Set, identity store, Auth Method, Authentication Protocol, and Session ID. Identity shows as INVALID when the name is not in any ID store — enable Disclose Invalid Usernames under Administration → System → Settings → Security Settings only for a timed debug window. - #### If Status is green and the user is still dead, change tool — do not rewrite the rule Open Operations → RADIUS → Live Sessions and confirm ISE still holds the session and the Authorization Profile. Then go to Side C. A 5200 Auth-Accept plus Posture Status NonCompliant is posture, not 22056. A 5200 plus a dead port is NAD apply, not identity store. https://ise-lab.example.com — Operations > RADIUS > Live Logs Training mock · not live Operations  ›  RADIUS  ›  Live Logs ### Live Logs RADIUS TACACS Live Sessions Endpoint ID contains AA:BB:CC:DD:EE:FF · last 24 hours · primary PAN Status Identity Endpoint ID Network Device Event Failure Reason Auth Fail finance.user AA:BB:CC:DD:EE:FF 192.0.2.10 Gi1/0/12 5400 Authentication failed 22056 Subject not found in the applicable identity store(s) PEAP / MSCHAPv2 Pass corp.laptop$ 00:11:22:33:44:66 192.0.2.10 Gi1/0/8 5200 Authentication succeeded — EAP-TLS Policy Set Name Wired-MAB-then-Dot1X Identity Store Internal Users (miss) Highlight row finance.user. Event 5400 is the headline. Failure Reason 22056 is the proof field. Click Details for Resolution Steps. Training mock · RFC 5737 only. Source: ISE 3.4 Troubleshoot — Operations → RADIUS → Live Logs, primary PAN only. Filter Endpoint ID. Failure Reason is a required read. Training mock · not live. ### Side B — TCP Dump (when the row is missing) Primary source: TCP Dump Utility to Validate Incoming Traffic . Official path: Operations → Troubleshoot → Diagnostic Tools → General Tools → TCP Dump . - #### Pick the node and the interface, not “the deployment” Host Name = the PSN you think that NAD uses. Network Interface = the interface that should see RADIUS. Promiscuous Mode defaults to On — leave it. An empty dump on the wrong node is not proof the packet never left the closet. - #### Write a Boolean filter. Start. Reproduce. Stop. Documented form: host 192.0.2.10 and port 1812 (or 1645 if that NAD is still on the old auth port). Official examples also allow ip host 10.77.122.123 and ip host ISE123 . Click Start, reproduce once, click Stop — or wait for the 500,000-packet cap. Download the file. Do not leave the capture running. - #### Read one binary fact No Access-Request = NAD path (radius-server host, source-interface, ACL, routing, dead-criteria). Access-Request present + empty Live Logs = ISE dropped it before MnT — classic 11007 (NAD object / IP mismatch) once a row appears, or a shared-secret drop that shows as 11036 . https://ise-lab.example.com — Operations > Troubleshoot > Diagnostic Tools > General Tools > TCP Dump Training mock · not live Operations  ›  Troubleshoot  ›  Diagnostic Tools  ›  General Tools  ›  TCP Dump ### TCP Dump Host Name PSN-DEL-1 (198.51.100.20) Network Interface GigabitEthernet 0 (RADIUS) Promiscuous Mode On (default) Status Stopped after one reproduce Filter host 192.0.2.10 and port 1812 # decoded summary — lab only no RADIUS Access-Request from 192.0.2.10 no Access-Accept / Access-Reject either Proof: packet never arrived on this PSN interface. Official fields: Status Start/Stop, Host Name, Network Interface, Promiscuous Mode, Filter (standard tcpdump Boolean). Max ~500,000 packets then auto-stop. Training mock · RFC 5737 only. Source: Use TCP Dump to Monitor Network Traffic — Operations → Troubleshoot → Diagnostic Tools → General Tools → TCP Dump. Filter example host 10.0.2.1 and port 1812 . Training mock · not live. ### Side C — NAD show authentication sessions Primary source: Cisco’s failed-auth guide and Troubleshoot Dot1x on Catalyst 9000 . If SNMP is allowed, ISE can poll the same output via Operations → Troubleshoot → Diagnostic Tools → General Tools → Execute Network Device Command . - #### Quote the interface from Live Logs first Network Device + Device Port on the Live Log row is the closet and the jack. Do not show authentication sessions the whole stack and guess. - #### Read Status, then Method, then VLAN Policy show authentication sessions interface Gi1/0/12 is the short view. … details is the proof. Status: Authorized plus a wrong VLAN is profiler / AuthZ — isolate, then name an owner. Status: Authz Failed after ISE 5200 is policy mismatch (VLAN missing, dACL syntax, AVP the switch will not apply). Method list dot1x / mab = Authen Failed with empty Live Logs is Ticket 2, not Ticket 3. Ticket 3 · dummy Catalyst output — isolate only SW-FIN-01# show authentication sessions interface Gi1/0/12 details Interface: GigabitEthernet1/0/12 MAC Address: aabb.ccdd.eeff User-Name: finance.user Status: Authz Failed Domain: DATA Oper host mode: multi-auth Common Session ID: 13A37A0A0000011DC85C34C5 Vlan Policy: EMPLOYEE Current Policy: POLICY_Gi1/0/12 Method status list: Method State dot1x Authc Success mab Not run What you say. “ISE Authenticated. The switch could not apply authorization — Status Authz Failed, VLAN Policy EMPLOYEE. I will not reset the password. Next proof is show vlan and the dACL syntax, with a change-control owner.” Flow 2 · where the packet can die Client to NAD to ISE — which tool proves each hop - Client EAPoL / cert / password 5411 lives here NAD show auth session Status · VLAN Policy RADIUS UDP 1812 / 1813 · secret TCP Dump · 11036 ISE PSN Live Logs / Sessions 22056 · 11007 · 15039 Empty Live Logs is not “ISE is down” Dump silent → NAD never sent. Dump + 11007 → NAD object / IP. Dump + 11036 → Message-Authenticator / shared secret. Green 5200 + Authz Failed on the port → VLAN / dACL / AVP — change-control on the NAD, not a new identity store. EAPoL is client↔NAD. RADIUS is NAD↔PSN. Quote the hop that actually died. Do not restart the last hop because Slack named it. ## 6. After the click — what you re-read Once the user retries, you do not open a new theory. You re-read the same MAC and the same Session ID. Still failing AuthC? Same Failure Reason? Then the store / password / cert did not change. A new code means a new desk. - 22056 gone, 24408 now? The subject is in the store; the password is wrong. Do not rebuild the sequence. - 5200 plus Posture NonCompliant? That is remediation by design. Do not bypass posture at 01:00 without an owner. - 5200 plus NAD Status Authorized and VLAN Policy matching the profile? The ISE ticket is closed. Next is DHCP / ACL on the VLAN, not a new AuthZ rule. - 5417 Dynamic Authorization failed after a posture CoA? NAD is not accepting CoA from that PSN. That is change-control on the switch, not a new posture policy. Proof · leave the desk Close with: Failure Reason, policy set, NAS + port, isolate vs change-control. The picture is the feeling of a clean desk. ## 7. Traps and proof checklist You saw Junior close Actual close Proof field Chat said ISE is down Restart Application Server Read Live Logs first Failure Reason (or empty row) 5400 + 22056 RADIUS failed Subject not in the store that policy used 22056 + Policy Set + Identity Store Empty Live Logs, PSNs green ISE is healthy — user error This NAD never delivered a valid request TCP Dump Access-Request absent · or 11007 5200 Auth-Accept, port dead Add a wider AuthZ NAD could not apply the result Status Authz Failed · VLAN Policy 5411 after 120 seconds Reset the password again Client or NAD went silent mid-EAP 5411 + last EAP method 11036 on a new closet Rebuild the policy set Message-Authenticator / shared secret 11036 11007 The user is unknown NAD IP / network device object missing 11007 + NAS IP 15039 after AuthC passed Wrong password Rejected per authorization profile 15039 + Authorization Profile 5417 after posture CoA Disable posture NAD denied Dynamic Authorization 5417 Proof checklist — you may leave the desk - You named first tool and one proof field from the five-ticket table. - You filtered Live Logs by MAC (Endpoint ID), on the primary PAN. - You quoted Failure Reason (or Status on the NAD), Policy Set, and NAS + port. - If the Live Log was empty, you captured TCP Dump with a host + port 1812 filter and Stopped it. - If ISE Accepted and the port was dead, you read show authentication sessions interface … details before changing policy. - You marked isolate vs change-control. Shared secret, NAD object, VLAN create, and CoA are writes. - No production username + MAC pair pasted off-box. Interview close you can steal I prove ISE with four tools. Live Logs first — I quote Failure Reason, not RADIUS failed. Empty logs go to TCP Dump on the PSN. Green Accept and a dead port go to show authentication sessions on the NAD. 22056 is a store miss. 11007 is a NAD object. 11036 is the secret. 5411 is a silent client. I do not restart Application Server to fix any of those. ## Knowledge check Six night-shift judgment items. Use the first-tool table, not trivia. Q1 Finance cannot get on the wire right now . Slack says “RADIUS failed — restart ISE.” You have not typed anything. First tool? Reload Application Server on the PSN — chat already named the cause. Operations → RADIUS → Live Logs on the primary PAN, filter the MAC, quote Failure Reason. Policy → Policy Sets — add any-any above Wired-MAB-then-Dot1X. TCP Dump with an empty filter so you do not miss it. Correct: b . Ticket 1. Live problem with a suspected RADIUS fail → Live Logs first. Restart is not a diagnostic. Re-read First-tool decision and Side A. Q2 Live Log: Event 5400, Failure Reason 22056, User finance.user, Policy Wired-MAB-then-Dot1X, Identity Store Internal Users. What do you quote? RADIUS failed — restart ISE. 22056 — subject not found in the identity store that policy used. 5411 — the client went silent, reset the password. 11007 — the NAD object is missing, rebuild the switch. Correct: b . Ticket 1. Official wording: Subject not found in the applicable identity store(s). 5411 and 11007 are different desks. Re-read Five tickets and the Live Logs mock. Q3 Both PSNs are green. Live Logs are empty for NAS 192.0.2.10 and this MAC. First tool? Close as user error — green PSNs prove ISE is innocent. Rebuild Wired-MAB-then-Dot1X so the next request hits a new set. TCP Dump on the PSN that closet should use — filter host 192.0.2.10 and port 1812 — then Stop. Disable profiling globally so MAB cannot hide the user. Correct: c . Ticket 2. Empty Live Logs + green nodes → prove whether RADIUS arrived. Node health ≠ this NAD used it. Re-read Side B and Flow 2. Q4 Live Logs show 5200 Authentication succeeded for finance.user. The port is still dead. First tool? NAD show authentication sessions interface Gi1/0/12 details — read Status and VLAN Policy. Reset the AD password — 5200 still means AuthC is broken. Restart the PSN to flush a stuck session. Add a new identity store because 22056 is implied. Correct: a . Ticket 3. ISE Accept does not prove the NAD applied VLAN / dACL. Authz Failed on the switch is policy mismatch. Re-read Side C. Q5 Failure Reason 5411 — no response during 120 seconds on the last EAP message sent to the client. What is true? The identity store is wrong — treat it as 22056. ISE is down — reload Application Server. The client or NAD went silent mid-EAP. Check supplicant, EAP timeout, and whether the last message left the PSN. Shared secret is wrong — change the NAD key now. Correct: c . Ticket 4. Official 5411 causes: aggressive EAP timeout, silent supplicant, or NAS not forwarding EAP. 22056 and 11036 are different codes. Re-read Five tickets row 4. Q6 A new closet just landed. Live Logs show 11036 The Message-Authenticator RADIUS attribute is invalid. What did you prove? finance.user is not in AD — open Internal Users. RADIUS Message-Authenticator failed — shared secret / NAD key mismatch. That is change-control on the NAD object. Posture NonCompliant — bypass the redirect. VLAN EMPLOYEE is missing on the switch. Correct: b . Ticket 5. 11036 is Message-Authenticator / shared secret, not identity and not VLAN. Re-read Five tickets row 5 and the traps table. Check answers Reset ## Sources - Cisco ISE Administrator Guide 3.4 — Troubleshoot — Operations menu on the primary PAN; RADIUS Live Logs fields (Failure Reason, Event, Endpoint ID, Network Device); Live Sessions; TCP Dump path and filter; Execute Network Device Command - Cisco ISE Administrator Guide 3.3 — Maintain and Monitor — Live Logs / monitoring context - How To Troubleshoot ISE Failed Authentications & Authorizations — Live Logs first; show authentication sessions interface ; TCP Dump steps; reason codes 22056, 11007, 11036, 5411, 5417, 15039, 24408 - Troubleshoot Dot1x on Catalyst 9000 Series Switches — show authentication sessions and … details - Troubleshoot Dot1x and Radius in IOS and IOS-XE — NAD session vs ISE Live Logs - Debugs to Troubleshoot on ISE - Understand ISE Services Purpose and Troubleshooting Related: Session factory — quote the reason code · Cisco ISE interview hub · Dummy lab --- Cite this Techclick lesson with the source URL. Do not invent fees, batch dates, or job guarantees. Browse all lessons: https://ai.techclick.in/blogs AI index: https://ai.techclick.in/llms.txt