# Quote the reason code. The session is AuthZ. Source: https://ai.techclick.in/blog_ise_session_factory Markdown: https://ai.techclick.in/blog_ise_session_factory.md Publisher: Techclick Infosec Pvt Ltd Cisco ISE reason-code first: quote RADIUS Live Logs, split AuthC from AuthZ, and treat the session as the dACL, VLAN, or SGT the NAD applied. Quick answer Supplicant talks to the NAD . NAD talks RADIUS to a PSN . The PSN picks a policy set , then an identity store (AuthC), then an authorization profile . The profile is the session: ACCESS_ACCEPT or ACCESS_REJECT , plus dACL , VLAN , SGT , or URL-Redirect . Posture is after Auth-Accept . Never say “RADIUS failed.” Quote 22056 or 15039 , the policy set, and the result the NAD holds. Say this out loud Authentication names who is on the wire. Authorization names the session. A green Event 5200 with the wrong dACL is still a failed ticket. CoA is how ISE changes that session — if the NAD applies it. ## 1. Why the reason code is first ISE is not “the RADIUS box.” It is identity plus authorization plus (often) profiling and posture. A running Application Server does not mean 802.1X succeeded. A green PSN does not mean that NAD used it. A user who “got on the network” can still be in a remediation dACL. Live Logs sit on MnT and are viewed on the primary PAN . Official path: Operations → RADIUS → Live Logs . Click the Details icon. The fields that close a ticket are Failure Reason , Event , Authentication Policy , Authorization Policy , Authorization Profiles , Security Group , Posture Status , and Session ID . 22056 is “Subject not found in the applicable identity store(s).” That is AuthC — typo, wrong sequence, machine identity hitting a user-only store, or a MAB MAC not in Internal Endpoints. 15039 is “Rejected per authorization profile” — AuthC often passed; AuthZ chose a profile with ACCESS_REJECT (commonly default DenyAccess ). Same word “failed.” Opposite station. Event 5200 is Authentication succeeded. Event 5400 is Authentication failed. Do not mix the two. Do not say this “RADIUS failed — restart ISE.” That sentence hides 22056, 15039, a posture redirect, a missing NAD, and a CoA the switch ignored. Quote the code, then name the result. #### Event 5200 Authentication succeeded. Still read Authorization Profiles, Security Group, and Posture Status. Success here is not “user is productive.” #### Event 5400 Authentication failed. Now you need Failure Reason — 22056, 15039, and 22040 are not interchangeable. https://ise-lab.example.com / Operations / RADIUS / Live Logs Training mock · not live Operations → RADIUS → Live Logs · Primary PAN ### RADIUS Live Logs Status · Identity · Event · Failure Reason · Auth Policy · AuthZ Policy · AuthZ Profiles · SGT FAIL finance.user 5400 22056 Subject not found in the applicable identity store(s) Policy: Wired-MAB-then-Dot1X · Store: Internal Users · Profile: — PASS j.patel 5200 Failure Reason empty AuthZ Profiles: PermitAccess · dACL EMP-ACCESS · Security Group: Employees PASS k.rao 5200 Failure Reason empty · Posture: Unknown AuthZ Profiles: Posture_Redirect · URL-Redirect · dACL QUAR-LIMIT Source: Cisco ISE Administrator Guide 3.3 — Troubleshoot, RADIUS Live Logs. Viewed on the primary PAN. Click Details for Authentication Detail. Lab names only. ## 2. Mental model: AuthC names who, AuthZ is the session Memorize the order before you open Policy Sets. Every ticket is “which station broke?” The last station that succeeded is what the NAD still holds. Flow 1 · session factory ISE session factory: NAD, AuthC, AuthZ result, posture, CoA - The NAD holds the last AuthZ result — that is the session 1 · NAD Switch / WLC / VPN IP + shared secret 2 · AuthC Identity store 22056 lives here 3 · AuthZ Profile + exceptions 15039 lives here 4 · Session = result dACL · VLAN · SGT or URL-Redirect 5 · Posture After Auth-Accept then CoA 6 · CoA — change the live session Posture result, profiler hit, or ANC. ISE sends CoA. The NAD must apply the new AuthZ. If the switch ignores CoA, Live Logs look new and the user stays on the old dACL. PAN writes policy · PSN answers RADIUS · MnT stores Live Logs · pxGrid publishes the session The NAD radius-server host is a PSN IP, not the PAN. Live Logs are viewed on the primary PAN. Read left → right, then down. Station 4 is the point of the lesson: the session is not AuthC. It is the authorization result the NAD applied. Path · AuthC vs AuthZ Feel only. The real fork: did AuthC fail (22056), or did AuthZ hand back DenyAccess, a printer SGT, or a posture redirect? ### Hard words, once Word Means If you mix it up NAD Network Access Device — switch, WLC, or VPN concentrator that sends RADIUS. You debug ISE while the shared secret or source IP is wrong. No Live Log. Policy set Container: allowed protocols + AuthC rules + exceptions + AuthZ rules. Path: Work Centers → Network Access → Policy Sets. You edit Default while Wired-MAB-then-Dot1X is the set that hit. AuthC / identity store Where ISE looks up who: Internal Users, AD, LDAP, Internal Endpoints (MAB), or a sequence. 22056. User exists in AD; policy pointed at Internal Users. AuthZ / authorization profile The RADIUS result: Access Type, VLAN, dACL, SGT, URL-Redirect, Airespace ACL. 15039 — default DenyAccess, not a dead PSN. Session What the NAD holds after AuthZ — not the password check. You close the ticket on Event 5200 while the dACL is still QUAR-LIMIT. dACL Downloadable ACL named on the authorization profile and pushed to the NAD. You chase a VLAN when the profile only sent a dACL. SGT Security Group Tag (TrustSec). Live Logs column: Security Group . You look only at VLAN and miss the tag the firewall is matching. CoA Change of Authorization (RFC 5176). ISE tells the NAD to reauthorize the same session. You rebuild the policy set because the switch never applied CoA. ## 3. Decision flow at the PSN Cisco’s policy-set evaluation is hierarchical. First the set matches. Then allowed protocols. Then identity-store rules. Then local exceptions, then global exceptions, then authorization rules. If no set matches, the Default policy set runs. You cannot delete Default. Its default authorization rule denies access. Flow 2 · which station do you open? Decision flow: Live Log first, then NAD, AuthC, AuthZ, posture, CoA Ticket: user cannot get on the wire Live Log exist? Ops → RADIUS → Live Logs No Suspect NAD IP · secret · PSN host Yes Reason code? Quote it first 22056 · 5400 Fix the identity store 15039 · 5400 Fix AuthZ / DenyAccess 5200 + redirect Posture after Accept 5200 + wrong SGT Quote the AuthZ result Then prove the NAD applied that result dACL / SGT / VLAN on the switch session · CoA sent vs CoA ignored Live Logs new + NAD old = CoA miss, not a stale policy set Dummy lab: show logging application ise-psc.log tail · then show the NAD session Diamond = decision. If there is no Live Log, stop guessing stores. The NAD never delivered a valid RADIUS request. Interview sentence I open Live Logs first. I quote the reason code, the policy set, and the authorization profile. The session is that profile — dACL, VLAN, or SGT — not the password check. ## 4. How to choose the result (dACL / SGT / VLAN) Do not start in Policy Sets until you know which flow the endpoint is supposed to use, and which result the NAD should hold. Wrong method + right password still fails. Right password + wrong profile is a failed session. If the endpoint is… Use Identity store (AuthC) Session result (AuthZ) Watch this trap Managed laptop / user with a supplicant 802.1X (PEAP-MSCHAPv2 or EAP-TLS) AD or cert store / sequence Employee VLAN + dACL, or SGT Employees Machine identity host/PC.domain hitting a user-only store → 22056 Printer, camera, badge reader, no supplicant MAB Internal Endpoints (MAC) Profiled VLAN / printer dACL / SGT Printers Laptop reuses the drop → leftover HP-Printer profile Contractor / BYOD web login CWA / Guest Guest or sponsor portal Redirect, then Guest after login AuthZ never includes Cisco_WebAuth / URL-Redirect Must prove disk encryption / AV 802.1X + posture Same as 802.1X Unknown → redirect + limited dACL; Compliant → PermitAccess Treating Unknown as AuthC fail Unknown device, visibility only MAB + profiler, No CoA if you only watch Internal Endpoints Limited or monitor Global profiler CoA = No CoA overrides per-profile CoA https://ise-lab.example.com / Policy / Policy Elements / Results / Authorization / Authorization Profiles Training mock · not live Policy → Policy Elements → Results → Authorization → Authorization Profiles → EMP-ACCESS ### Authorization Profile · EMP-ACCESS Name EMP-ACCESS Access Type ACCESS_ACCEPT DACL Name EMP-ACCESS VLAN 20 · Employees Security Group Employees Web Redirection Not set Cancel Submit Source: Cisco ISE Administrator Guide 3.3 — Segmentation, Authorization Profiles. Access Type, DACL Name, VLAN, and Security Group are the session. Identity Source is not on this page. Lab names only. ## 5. Do: Live Logs, AuthC, AuthZ proof Primary sources for this block: Cisco ISE Administrator Guide 3.3 — Troubleshoot (Live Logs) and Segmentation (policy sets, authorization profiles). Confirm live UI labels on your release before you change production. ### Side A — Live Logs first If ISE has no Live Log, the PSN never accepted a valid request. Do not edit AuthZ until you have a row — or you have proved the NAD object is missing. #### Open Live Logs on the primary PAN Path: Operations → RADIUS → Live Logs . Filter Identity or Endpoint ID. Click Details . Write down Event, Failure Reason, Authentication Policy, Authorization Policy, Authorization Profiles, Security Group, Posture Status, Session ID, Network Device. - #### If the row is empty Path: Administration → Network Resources → Network Devices → Add . IP Address must be the RADIUS source the NAD actually uses. Shared Secret must match (lab only — never a production secret in chat). Device Profile decides which CoA method ISE will send. RADIUS host on the switch/WLC = PSN IP, not PAN. - #### If Event is 5400 Stop at Failure Reason. 22056 → Side B (store). 15039 → Side C (profile / default deny). 22040 → password or shared secret. Do not restart Application Server for any of those. ### Side B — AuthC (who) - #### Open the set that actually hit Work Centers → Network Access → Policy Sets . Insert a set above Default. Condition it on Device Type, Location, or NAS-IP so wireless guest never hits wired 802.1X rules. - #### Authentication policy Dot1X rule → AD or All_User_ID_Stores. MAB rule → Internal Endpoints. Set If User not found deliberately: REJECT for 802.1X user rules; CONTINUE only when you truly want MAB fallback on the same set. - #### Prove 22056 is a store miss Quote the store on the Details report. A contractor in AD who hits Internal Users is still 22056. A machine identity host/… hitting a user-only sequence is still 22056. Restarting the PSN does not create the account. ### Side C — AuthZ (the session) - #### Authorization policy order Exceptions, then specific (Compliant_Devices_Access), then posture Unknown redirect, then profiled phones, then Default DenyAccess. Profiles live under Policy → Policy Elements → Results → Authorization → Authorization Profiles . - #### Name the result on the profile Access Type = ACCESS_ACCEPT or ACCESS_REJECT. Then DACL Name, VLAN, Security Group, Web Redirection. That tuple is what the NAD should hold. Event 5200 with Authorization Profiles = DenyAccess is 15039 territory — AuthC passed, AuthZ rejected. - #### Posture pair (if you enforce) Unknown / NonCompliant → URL-Redirect and a remediation dACL. Compliant → PermitAccess (or your employee profile). CoA is mandatory to move the session when posture status changes. Enable aaa server radius dynamic-author on Catalyst with the PSN as client. - #### Prove the NAD applied it Live Log Authorization Profiles / Security Group must match the switch or WLC session. If Live Logs show the new profile and the NAD still has the old VLAN or dACL, treat it as CoA ignored. Do not rebuild the set. Dummy lab · ISE-LAB/admin# · Event 5400, not 5200 show logging application ise-psc.log tail 10:42:18 5400 Authentication failed User: finance.user NAS: 10.10.1.2 Policy: Wired-MAB-then-Dot1X Failure: 22056 Subject not found in the applicable identity store(s) What you say: “Live log 22056 — user not in the identity store used by that policy.” Next: check which ID store the policy set calls. Then prove process health so nobody restarts a healthy box: Dummy lab · process health ≠ RADIUS success show application status ise ISE PROCESS NAME STATE Database running Application Server running M&T Session Database running ISE Indexing Engine running Green success = these log fields Live Log: Event 5200, Failure Reason empty, Policy Set = the set you intended, Identity Store = AD (or the store you designed), Authorization Profiles = EMP-ACCESS (or PermitAccess), Security Group = the SGT you designed, Posture Status = Compliant or not required. NAD session shows the same VLAN / dACL / SGT. ## 6. Runtime path after go-live A healthy user session is not “ISE is up.” It is this sequence, end to end. The NAD session at the end is the authorization result. - Supplicant starts EAP (or MAB sends the MAC). - NAD sends Access-Request to the PSN in its server group. - PSN matches a policy set → allowed protocols → identity store → AuthZ (exceptions first). - Access-Accept carries VLAN / dACL / SGT / redirect. Access-Reject is still an ISE decision — read 15039 before you blame the switch ACL. - If posture is on: first Accept is often Unknown + URL-Redirect. The agent reports. ISE sends CoA . NAD reauthorizes. Second Live Log shows Compliant or NonCompliant and a new profile. - Profiler may CoA later if the endpoint identity changes. ANC Quarantine is a human (or SOAR) action — treat it as change-control. - pxGrid can publish the session to FMC / DNAC. pxGrid down looks like “ISE worked, the firewall never saw the SGT.” Proof · quote the session, then close Feel only. Close from Live Log fields plus the NAD session. Application Server running is not proof. Personas in one line PAN authors and replicates policy. PSN answers RADIUS. MnT stores Live Logs (view them on the primary PAN). pxGrid is the bus. The NAD points at PSN IPs. ### Four tickets, four stations 22056, contractor not in the store. Event 5400. “ISE is up. The store that policy called does not contain this user.” Open the AuthC rule. Do not restart the PSN. 15039, default deny. AuthC often passed. Authorization Profiles is DenyAccess. “Rejected per authorization profile — fix the hit rule, not the password.” 5200 + printer SGT. Password works. Endpoint Profile = HP-Printer, static=no. Authorization followed the printer rule. Quote the profile. Do not reset AD. 5200 + old VLAN. Live Logs show the new profile. Switch session is stale. ISE sent CoA; the NAD ignored it. Quote aaa server radius dynamic-author . Do not rebuild the set. ## 7. Traps + proof checklist Failure Looks like Station Do this 22056 “RADIUS failed” AuthC / store Quote the store on the hit policy. Fix sequence or identity. Do not restart ISE. 15039 “RADIUS failed” AuthZ Hit rule is often Default DenyAccess. Fix conditions, not the password. 5200 + wrong dACL/SGT Auth success, no apps AuthZ result / profiler Quote Authorization Profiles and Security Group. Re-profile or change the rule. Posture NonCompliant Auth success, remediation page Posture after Accept Restricted dACL until the check is green and CoA fires. No Live Log Port hanging NAD Device object, source IP, shared secret, PSN as radius host. CoA ignored ISE new, NAD old NAD CoA dynamic-author + NAD profile. Do not rebuild AuthZ. ANC Quarantine Good creds, still dead Change-control Name the owner. Do not reset the password. FMC has no user / SGT “ISE worked” pxGrid Publish path, not a new policy set. Proof checklist (pilot or ticket close) - Live Log row exists for this MAC / user / NAS IP on the primary PAN. - Reason code quoted — or Event 5200 with empty Failure Reason. - Policy set name is the set you designed, not an accidental Default hit. - Identity store matches the method (AD vs Internal Endpoints). - Authorization Profiles + VLAN / dACL / SGT match intent — that tuple is the session. - NAD session shows the same result. If not, CoA is the next sentence. - If posture is in scope: status Compliant, or Unknown/NonCompliant explained. - Never paste real usernames and MACs together into a public chat. Dummy lab data only. ## Knowledge check Six judgment items. Mapped to Live Logs, AuthC vs AuthZ, and the session-as-result rule. Check answers, then Reset to retry. Q1 A ticket says only “RADIUS failed.” What is the first sentence you put on the ticket? Restart the PSN, then retest the port. Quote the Live Log reason code, the policy set that hit, and the authorization result. Disable 802.1X on the access VLAN to restore service. Rebuild the Default policy set from scratch. Correct: b . Re-read Quick Answer and Why the reason code is first. “RADIUS failed” hides 22056, 15039, posture, and a missing NAD. Q2 Live Log shows Event 5400 and Failure Reason 22056 — Subject not found in the applicable identity store(s). What broke? The PSN process is down; restart Application Server. The identity store (or sequence) used by that policy set does not contain this subject. Posture failed after Auth-Accept. The switch ignored CoA. Correct: b . Re-read Mental model and Side B. 22056 is AuthC — a store miss — not posture and not 15039. Q3 Failure Reason is 15039 — Rejected per authorization profile. AuthC looks clean. What is the session? ACCESS_ACCEPT with PermitAccess — the NAD just dropped the dACL. A posture Unknown redirect that still needs CoA. ACCESS_REJECT from the hit AuthZ profile — often default DenyAccess. No session exists because the NAD object is missing. Correct: c . Re-read Why the reason code is first and Side C. 15039 is AuthZ. The session result is reject. Q4 User passed AuthC. Live Log shows Event 5200, Authorization Profiles = PermitAccess, Security Group = Employees, dACL EMP-ACCESS. The switch still has last week’s VLAN. What is the live session? Whatever AuthZ the NAD still holds — the old VLAN — until CoA is applied. The AD group membership. VLAN is cosmetic. The policy set name on the PSN. Event 5200 itself. Auth success means the new profile is live. Correct: a . Re-read Mental model and Runtime path. The session is the authorization result the NAD applied, not the row ISE just wrote. Q5 Event 5200, Posture Status = Unknown, Authorization Profiles includes URL-Redirect and a limited dACL. What is true? This is an AuthC failure — the identity store rejected the user. The NAD is missing from Network Devices. 15039 default deny — edit Default authorization. Posture ran after Auth-Accept. Restricted AuthZ applies until the check is green and CoA fires. Correct: d . Re-read Runtime path. Posture is after Accept. The session is already the redirect profile. Q6 A new closet switch has no Live Log rows at all. Application Server is running. What is the first fault domain? Posture Unknown — add a URL-Redirect profile. ISE never saw a valid NAD. Match Network Device IP and shared secret; RADIUS host must be a PSN. pxGrid is down, so MnT cannot store logs. 15039 default deny — edit Default authorization. Correct: b . Re-read Decision flow and Side A. No log means the request never arrived as a valid NAD. You cannot quote a reason code that does not exist. Check answers Reset ## Sources - Cisco ISE Administrator Guide 3.3 — Troubleshoot (RADIUS Live Logs fields; primary PAN) - Cisco ISE Administrator Guide 3.3 — Segmentation (Policy Sets, AuthC, AuthZ, Authorization Profiles, dACL, SGT) - Cisco ISE Administrator Guide 3.3 — Secure Access (Network Devices, Shared Secret) - Cisco ISE Administrator Guide 3.3 — Compliance (Posture) - Cisco ISE Syslogs — message list (22056 and related codes) - Configure External RADIUS Servers on ISE — 15039 vs external reject - How To Troubleshoot ISE Failed Authentications (Live Logs, 22056, 15039) - Tips for New ISE administrators — Live Logs status Related: Blog 2 · Evidence desk · Cisco ISE interview hub · Dummy lab --- Cite this Techclick lesson with the source URL. Do not invent fees, batch dates, or job guarantees. Browse all lessons: https://ai.techclick.in/blogs AI index: https://ai.techclick.in/llms.txt