The Campus Access Field Kit is a 55-page, print-ready runbook for wired 802.1X, MAB and Cisco ISE policy. It follows one rule: prove which step of one login failed before anyone edits a port, a rule or an ACL. It's included in PingLabz Pro, with nothing extra to buy.
Working on wireless controllers? That is the separate Catalyst 9800 Field Kit.
Campus Access Field Kit: 802.1X + ISE
Included with PingLabz Pro · 55 pages · US Letter PDF
The 802.1X troubleshooting field guide, rollout, fallback VLAN, MAB and ISE policy workbooks, plus three ISE 3.5 cases built in my home lab.
Already a member? Sign in.
What's inside
- Start here and the RADIUS evidence map (pages 2–3): three ways a wired login fails, and the first counter that tells them apart.
- A1 802.1X troubleshooting field guide (pages 4–22): one login fails; find the first missing result.
- A2 802.1X switch rollout workbook (pages 23–28): plan a pilot, or decide whether to expand.
- A3 Fallback VLAN design workbook (pages 29–34): what the port does when auth fails or RADIUS is down.
- A4 MAB endpoint admission workbook (pages 35–40): a printer or camera needs a MAB exception.
- A5 ISE wired policy proof workbook (pages 41–46): you changed an ISE rule and need to prove which one matches.
- B1 ISE 3.5 case: 11007 network device (pages 47–48): RADIUS times out and ISE shows 5405.
- B2 ISE 3.5 case: MAB 15039 (pages 49–51): a known MAC still gets DenyAccess.
- B3 ISE 3.5 case: dACL implicit deny (pages 52–54): authorized and in the right VLAN, but an app still fails.
How it was built
Section A is the field guide and four workbooks. They are checked against the cited Cisco documents (ISE 3.5), not run as printed. Section B is three ISE 3.5 cases built in my home lab, with placeholder secrets such as <RADIUS_SHARED_SECRET>. Confirm on your own release before you change anything.
What it doesn't include
- Cisco images or ISE licences. Cisco doesn't allow images to be redistributed, so you bring your own.
- Wireless controller operations. Those are in the Catalyst 9800 Field Kit.
Free: 802.1X & Wireless First Response Kit
The first ten minutes of an access incident, on 28 printable pages: the Windows 11 wired 802.1X checklist, EAPOL packet reading, host-mode selection and Catalyst 9800 first-response commands. Get the free kit with a PingLabz account.
The lab walkthroughs are free to read: 802.1X with FreeRADIUS on Cisco, MAB with FreeRADIUS, 802.1X dynamic VLAN assignment, and the ISE 3.5 labs: initial setup, 11007 network device, MAB 15039 DenyAccess and dACL blocking DNS.
Already a Pro member? Sign in and the download button appears above. When the kit is updated, this page gets the new version first.