> ## Content Index > Fetch the complete content index at: https://www.pinglabz.com/llms.txt > Use this file to discover other available public pages before exploring further. # Cisco ISE 3.5 Labs: The Complete Series - URL: https://www.pinglabz.com/cisco-ise-lab-series/ - Published: 2026-11-03T20:11:36.000Z - Updated: 2026-11-03T20:23:32.000Z - Description: The hub for the PingLabz Cisco ISE 3.5 lab series: nine hands-on posts covering setup, 802.1X and MAB failures, Live Logs codes, TACACS+ device admin for IOS XE and ASA, policy sets and CoA. - Author: Jaime - Tags: 802.1X, Network Security This is the hub for the PingLabz Cisco ISE lab series. It's nine posts on ISE 3.5.0.527, built in my home lab with Cisco IOS XE switches and routers and an ASAv 9.24 firewall. Most of them follow the same pattern: I break something on purpose, show what the user sees and what Live Logs says, then find the root cause and fix it. The first post covers setup: first boot, the CLI checks that prove the services are up, the forced GUI password reset and the Administration pages to review first. The 802.1X and MAB posts are a casebook of real failures. A switch whose RADIUS requests ISE ignored with 11007 because they came from an address it didn't know. A printer that passed MAB and still got 15039 DenyAccess because the rule matched a MAC format the switch never sends. A contractor who landed in the right VLAN with the right dACL but couldn't resolve a single name, because the dACL's implicit deny dropped DNS. The Live Logs casebook then reproduces five common 802.1X failures in one place. The device admin posts move to TACACS+. One sets up command sets and shell profiles for IOS XE, so the help desk can run show commands but can't enter config mode, then breaks the shared secret to test local fallback. Another does the same for the ASA, including per-command authorization and a console lockout with 22056\. The policy sets post splits routers from firewalls by Device Type and shows how one EQUALS condition locked everyone out with 13036. The last post pushes Change of Authorization from ISE to live sessions: a reauth that moves a user to quarantine, a port bounce, and the 5417 error you get from a wrong CoA key. ![Diagram: Cisco ISE lab series. IOS XE switches send RADIUS for 802.1X and MAB to ISE, highlighted, which sends CoA back. IOS XE routers and an ASAv firewall use TACACS+ for device admin. ISE uses Live Logs and policy sets by device type to return network access results (VLAN, dACL) and device admin command sets and shell profiles.](https://storage.ghost.io/c/ff/28/ff28db4a-11e1-4835-b928-158974cf96c1/content/images/2026/11/hub-cisco-ise-lab-series.png) ## The series in reading order ### Setup 1. [Cisco ISE 3.5 Initial Setup: First Boot, CLI Checks and GUI Login](https://www.pinglabz.com/cisco-ise-3-5-initial-setup/). First boot, CLI service checks, the GUI password reset and the pages to review first. ### 802.1X and MAB troubleshooting 1. [ISE 802.1X Lab: Fixing 11007 "Could not locate Network Device" on a Wired Switch](https://www.pinglabz.com/ise-11007-could-not-locate-network-device/). RADIUS from an address ISE didn't know, and how to fix the source. 2. [ISE MAB Lab: Why a Known Printer Still Gets 15039 DenyAccess](https://www.pinglabz.com/ise-mab-15039-denyaccess-printer/). A known printer rejected because the rule matched the wrong MAC format. 3. [ISE dACL Lab: Contractor Gets VLAN 862, but DNS Is Blocked](https://www.pinglabz.com/ise-dacl-dns-implicit-deny/). The right VLAN and dACL, but the implicit deny dropped DNS. 4. [ISE Live Logs Casebook: Five 802.1X Failures, Reproduced](https://www.pinglabz.com/ise-live-logs-802-1x-failure-codes/). Five 802.1X failures reproduced, with the Live Logs entry and fix for each. ### TACACS+ device admin and policy sets 1. [TACACS+ for Cisco IOS XE with ISE 3.5: Command Sets, Shell Profiles and a Shared Secret Fault](https://www.pinglabz.com/ise-tacacs-ios-device-admin-command-sets/). Command sets and shell profiles for IOS XE, and a shared secret fault with local fallback. 2. [TACACS+ for Cisco ASA with ISE 3.5: Command Authorization, Console Lockout and LOCAL Fallback](https://www.pinglabz.com/ise-tacacs-asa-admin-command-authorization/). ASA command authorization, a 22056 console lockout and LOCAL fallback. 3. [ISE Policy Sets by Device Type: Splitting Router and Firewall Admin Access](https://www.pinglabz.com/ise-policy-sets-device-type-routers-firewalls/). Splitting router and firewall admin by Device Type, and the 13036 lockout. ### Change of Authorization 1. [ISE CoA in Practice: Reauth, Port Bounce and a VLAN Change Pushed from ISE](https://www.pinglabz.com/ise-coa-reauth-port-bounce-live-sessions/). Reauth, port bounce and a VLAN change pushed to live sessions, and the 5417 error. ## Where to start Who this is for: engineers deploying or supporting ISE. If you're staring at a failure code right now, start with the Live Logs casebook. For background on the protocol, see the [802.1X complete guide](https://www.pinglabz.com/802-1x/).