Forescout

The RTA is a headless Linux appliance with no 802.1X supplicant, no domain membership, and no NAC agent (it does not run Forescout's SecureConnector). On a Forescout-monitored network the appliance deploys fine, but eyeSight discovers it as an unknown, unclassified, or non-compliant device, and a policy applies a restrict action against it (Switch Block, Assign to VLAN into a quarantine segment, or Virtual Firewall). The appliance then never gets usable network access and cannot reach its endpoint.

Note

For general background on why NAC blocks RTAs and what the fix looks like across vendors, see the NAC overview and the full connectivity troubleshooting background.

The resolution is three steps: put the appliance in a dedicated Forescout group, exempt that group from any policy that applies a blocking or quarantine action, and make sure compliance checks the appliance can never satisfy do not restrict it.

Choose how to apply the fix

• GUI (Forescout Console)

  Group the appliance, exempt it from blocking and compliance policies, and clear any applied restrict actions in the Forescout Console.

• AI assistant (LLM)

  Paste one prompt into your AI assistant and let it walk the Console changes with you.