An administrator adds a new network device to the Cisco ISE configuration to authenticate endpoints to the network. The RADIUS test fails after the administrator configures all of the settings in Cisco ISE and adds the proper configurations to the switch. What is the issue"?

The RADIUS protocol uses a shared secret to create a message authenticator for validating communication between the Network Access Device (NAD), such as a switch, and the RADIUS server (Cisco ISE). A failed RADIUS test immediately after configuring a new NAD is a primary indicator of a mismatched shared secret. If the secret configured on the switch does not exactly match the one configured in Cisco ISE for that device, ISE will be unable to validate the RADIUS packet and will drop it, causing the test to fail. This is a fundamental step in establishing trusted communication, which must succeed before any endpoint authentication can be processed.

A. Endpoint profiling occurs after a successful authentication. A failed RADIUS test indicates the initial communication between the switch and ISE failed, so profiling would not have started.
B. The RADIUS test from a network device verifies connectivity and the shared secret with the ISE server; it does not involve or validate specific endpoint credentials.
D. While certificates are crucial for certain EAP-based authentication methods, the fundamental RADIUS communication between the switch and ISE is secured by the shared secret, not a switch certificate.

1. Cisco Identity Services Engine Administrator Guide, Release 3.2, "Add Network Devices to Cisco ISE" section: This guide details the required configuration for adding a network device. Under the "RADIUS" settings, it states, "Enter the shared secret key that is used to encrypt and decrypt packets between Cisco ISE and the network device." This highlights the shared secret's critical role in the initial communication setup.

2. Cisco Identity Services Engine (ISE) Troubleshooting Guide, "Troubleshoot RADIUS Authentication Issues" section: In the table for "RADIUS Troubleshooting," a common failure reason is "RADIUS Request Dropped." The guide explicitly states a primary cause is a "Possible misconfiguration of shared secret on ISE or the NAD." This directly links a failed RADIUS communication to an incorrect shared secret.

3. Cisco, "ISE RADIUS Network Access Attributes," Document ID: 117622, "RADIUS Shared Secret" section: This document explains, "The shared secret is a case-sensitive key shared between the NAD and the ISE. It is used to authenticate the NAD to the ISE and to encrypt certain RADIUS attributes." This confirms its function as the primary authentication mechanism between the two devices.