Six Cisco devices, three sites, two axes. Build a site-and-role Ansible inventory with group_vars and host_vars, catch a site variable silently beating a role variable, and learn why ansible_group_priority couldn't fix it.
Install ansible-core and the Cisco collections in a venv, build a three-router inventory with a vault, and run a first playbook on IOS XE 17.18. Real runs, including the two failures every first attempt hits, and the idempotent second run.
I split one ISE 3.5 TACACS+ policy into a router set and a firewall set using Device Type groups. The help desk lost firewall access as planned, but a Device Type EQUALS condition also dropped the router into the Default policy set and locked everyone out with 13036.
I pointed a Cisco ASAv 9.24 at ISE 3.5 for TACACS+ device admin: auto-enable to privilege 15, per-command authorization, a console admin locked out by 22056, a 13011 shared secret fault, and when the LOCAL fallback user can and can't log in.
I pushed Change of Authorization from ISE 3.5 to an access switch three ways: a reauth that moved a logged-in user from the staff VLAN to quarantine without dropping the link, a port bounce, and a broken CoA key that produced 5417 Dynamic Authorization failed. Real output for each.
I set up ISE 3.5 as the TACACS+ server for an IOS XE router: a network admin with full access and a help desk user who can run show commands but not show running-config or enter config mode. Then I broke the shared secret and watched the local fallback take over. Real Live Logs for every case.
Five 802.1X failures I broke on purpose against Cisco ISE 3.5: a bad shared secret, an unknown user, a wrong password, a supplicant that rejects the ISE certificate, and a disabled account. For each one: what the user sees, the Live Logs entry, the root cause and the fix.
The contractor authenticated, landed in VLAN 862 and got the web-only dACL from ISE. HTTPS to the portal's IP worked, but the portal's name never resolved. The dACL's implicit deny was dropping DNS. Here's the lab, the evidence and the fix.
The printer's MAC was in ISE, in the right endpoint identity group, and MAB authentication passed. ISE still sent an Access-Reject. The authorization rule was matching a MAC string that the switch never sends. Here's the lab, the evidence and the fix.
The switch was configured, the users existed, the policy was right, and every login still failed. ISE was throwing the request away with 11007 because it didn't recognise the address the switch sent from. Here's how I reproduced it, read the evidence, and fixed it.
Cisco ISE 3.5.0.527 first boot, built in my home lab: setup values, CLI checks that prove the services are up, the forced GUI password reset and the Administration pages to review first.
Built in my home lab on IOS XE 17.18: a privilege 5 NOC user got an empty config, then every secret. Parser views worked, once exec and console authorization were on.