Hands-on Cisco IOS XE lab walkthroughs. Each lab ships with a real CML topology, configs you can paste, and verified show output. Articles tagged Labs cover the full CCNA 200-301 blueprint across Network Fundamentals, Network Access, IP Connectivity, IP Services, and Security Fundamentals.
One ISE 3.5 TACACS+ policy split into a router set and a firewall set using Device Type groups. The help desk lost firewall access as planned, but a Device Type EQUALS condition dropped the router into the Default policy set and denied everyone with 13036.
A Cisco ASAv 9.24 on ISE 3.5 TACACS+: auto-enable to privilege 15, per-command authorization, a console admin locked out by 22056, a 13011 shared secret fault, and when the LOCAL fallback user can and cannot log in.
Change of Authorization from ISE 3.5 to an access switch three ways: a reauth that moved a logged-in user from the staff VLAN to quarantine without dropping the link, a port bounce, and a broken CoA key that produced 5417 Dynamic Authorization failed.
ISE 3.5 as the TACACS+ server for an IOS XE router: a network admin with full access and a help desk user limited to show commands, with real Live Logs for 13023 and 13025, then a broken shared secret (13011) and the local fallback.
Five 802.1X failures caused on purpose against Cisco ISE 3.5: a bad shared secret, an unknown user, a wrong password, a supplicant that rejects the ISE certificate, and a disabled account. For each: what the user sees, the Live Logs entry, the cause and the fix.
The contractor authenticated, landed in VLAN 862 and got the web-only dACL from ISE. HTTPS to the portal IP worked, but the name never resolved because the implicit deny dropped DNS. The evidence on switch and ISE, the fix, and why saving the dACL is not enough.
The printer was in the right ISE endpoint identity group and MAB authentication passed, but ISE still sent an Access-Reject. The authorization rule matched a dotted MAC string, while ISE evaluates the hyphenated Calling-Station-ID. The evidence and the fix.
The switch was configured, the users existed, the policy was right, and every login still failed. ISE dropped each request with 11007 because the network device entry used the SVI address, not the address RADIUS came from. The evidence on client, switch and ISE, and the fix.
Five dead SSH sessions filled every VTY line on IOS XE 17.18.2 and new SSH was refused. clear line from the console, then service tcp-keepalives-in, exec-timeout 5 0 and a reserved admin line, with real show users timings for each fix.
login block-for on IOS XE 17.18.2 stopped an SSH password loop after three tries, then the default sl_def_acl locked out the admin too. The quiet-mode access-class fix, the login local line AAA removed, and syslog proof of both sides.
A VTY access-class with a subnet mask instead of a wildcard locked the NOC out of SSH on IOS XE 17.18.2. After the fix, moving management into a VRF locked it out again with zero ACL hits. Both recoveries from the console, and the access-class vrfname fix.
Save show output from an IOL console and a pcap from the client namespace in one Containerlab run: 10 ICMP frames, 0 kernel drops, management addresses redacted, and the node named host that put the veth in the wrong namespace.