Cisco ISE Policy Set Not Hit: Policy Hit Count When the Default Rule Wins

Cisco ISE · Techclick CLI troubleshooting lab

You built a new policy set for contractors. They still hit Wired_802.1X default. Conditions look right.

This is a live-ticket style lesson from Techclick Infosec. You will isolate the fault with CLI first, then prove the fix with one clean packet or log.

What you will be able to do

• Name the first CLI command to run on Cisco ISE for this ticket

• Separate the layer that is actually broken from the layer people blame

• Apply one scoped fix instead of a global disable

• Prove the ticket closed with a session, log, or counter

Quick answer

Policy sets are first match. A broader set above yours wins. Live Logs show the policy set name that actually fired.

Why this ticket shows up

ISE does not merge sets. Order is everything.

Symptoms operators actually see

• Live Log policy set is not yours

• Your set hit count 0

• Condition uses the wrong NAD IP

• Device group empty

CLI first — copy this block

Run these on the Cisco ISE device or console named in the ticket. Do not skip the first show command — it tells you which later command matters.

show logging application ise-psc.log tail 30
# then in GUI Live Logs read Policy Set / AuthZ rule
show running-config | include radius

How to read that output

If Live Logs name another set, yours never evaluated. Move yours above the broader set or tighten the one above.

Triage order

1. Read the policy set from a failed or unexpected pass

2. Compare conditions to the NAD IP and protocol

3. Reorder sets

4. Send one test auth

5. Confirm hit count increments

Classic traps

What you see	Real cause	Fix
Duplicate the whole set	Order is wrong	Move it
Add more conditions	The set above already matches all wired	Tighten the one above
Blame the switch	ISE chose a set	It is ISE order

Proof the ticket is closed

• Live Log shows your policy set and rule

• Hit count +1

• Contractor gets the right profile

Say this in an interview

I trust the Live Log policy set name, not the set I intended. First match wins.

---

Need the full vendor lab, mock interview, and production runbooks? Techclick trains Palo Alto, Zscaler, F5, FortiGate, Check Point, Cisco ISE, Azure and routing with live CLI — start at https://www.techclick.in/