Policy Set First. Then AuthC. Then VLAN, dACL, or SGT.

Cisco ISE authentication vs authorization, in the language of a reject on Gi1/0/12.

I don’t open a reject with the switch. I open it with the order ISE actually used.

A Policy Set matched. Then an authentication rule decided whether Priya on Gi1/0/12 is anyone at all. Only after that does authorization have a VLAN, a dACL, or an SGT to hand out. If you start at the port, you will debug a clean NAD and miss that authorization never ran.

Priya’s morning is the language I want. Cable in. 802.1X. Switch debug looks like a good student. ISE already knew the sentence: certificate and identity, named, and no authorization step after it. That is not a VLAN problem. That is the order.

Real Cisco ISE Live Logs (Operations → RADIUS → Live Logs).

Live Logs still in the frame, but the story starts at Policy Set, not at the port

The order is the product

Policy Sets are first-match. Wired_802.1X versus Wireless is not a naming convention. It is two different books. ISE opens one. It does not open the other.

Inside the set you matched, authentication rules run. AuthC is who. Identity store, EAP method, certificate or password. If who fails, ISE does not keep walking so you can have a nice…