Cisco ISE Live Logs Fail: RADIUS Authentication Detail When 802.1X Dies

Cisco ISE · Techclick CLI troubleshooting lab

Phones and laptops fall to guest VLAN. Switch says RADIUS timeout or reject. ISE GUI is up.

This is a live-ticket style lesson from Techclick Infosec. You will isolate the fault with CLI first, then prove the fix with one clean packet or log.

What you will be able to do

• Name the first CLI command to run on Cisco ISE for this ticket

• Separate the layer that is actually broken from the layer people blame

• Apply one scoped fix instead of a global disable

• Prove the ticket closed with a session, log, or counter

Quick answer

Operations > RADIUS > Live Logs. Open the failed attempt. The root cause line is better than any guess about certificates.

Why this ticket shows up

ISE failures are specific: unknown user, EAP timeout, policy miss, or shared secret. Live Logs name one of them.

Symptoms operators actually see

• RADIUS timeout on the switch

• Reject with no policy match

• Only one NAD fails

• Certificate expired yesterday

CLI first — copy this block

Run these on the Cisco ISE device or console named in the ticket. Do not skip the first show command — it tells you which later command matters.

show logging application ise-psc.log tail 50
show logging application ise-radius-debug.log tail 50
show application status ise
show ntp
show cpu

How to read that output

If Live Logs never receive the request, the NAD never reached ISE (secret, IP, or routing). If they receive a reject, read the authentication detail, not the switch.

Triage order

1. Confirm ISE services are running

2. Find the MAC/user in Live Logs

3. Read authentication policy and failure reason

4. Fix that reason only

5. On the switch, test aaa and radius connectivity

Classic traps

What you see	Real cause	Fix
Rebuild ISE	Shared secret mismatch on one switch	Fix the NAD
Disable 802.1X	One expired cert	Renew EAP cert
Add a new policy set	Existing set already misses because of condition	Fix the condition

Proof the ticket is closed

• Live Log shows Auth Passed

• Endpoint in the right VLAN

• Switch session authorized

Say this in an interview

I open the ISE authentication detail before I touch the switch. The failure reason is already written.

---

Need the full vendor lab, mock interview, and production runbooks? Techclick trains Palo Alto, Zscaler, F5, FortiGate, Check Point, Cisco ISE, Azure and routing with live CLI — start at https://www.techclick.in/