Skip to content

Forescout: GUI (Forescout Console)

Configure Forescout in the Forescout Console so the RTA appliance is admitted onto the network: place it in a dedicated group, exempt that group from any policy that applies a blocking or quarantine action, and keep compliance checks from restricting a device that runs no agent.

Note

For the full explanation of why NAC blocks the appliance and the general fix pattern, see the NAC overview. For upstream connectivity requirements (the endpoint and port the appliance must reach), see Connectivity troubleshooting.

1. Get the appliance MAC address

Obtain the MAC address before making any Forescout changes.

  • Hypervisor/cloud console: open the VM's NIC settings. The MAC is listed there without powering on the appliance.
  • DHCP lease table: if the appliance already got a restricted-segment lease, look up its MAC in your DHCP server's lease log.
  • Switch MAC table: show mac address-table interface <port> on the access switch will show whatever the port learned.

Hyper-V: confirm the MAC the switch actually learns

Hyper-V deployments enable MAC address spoofing on the appliance NIC so that L2 bridging works. The MAC the switch learns may differ from what the Hyper-V manager shows. Check the switch MAC table or the DHCP lease to be certain which address to exempt.

2. Add the appliance to a dedicated group

Group the appliance in its own Forescout group so the exemptions stay narrow and the entry is easy to remove after the engagement.

  1. In the Console's Home view, find the appliance in the Detections pane. Search by its MAC or IP address.
  2. Select the endpoint and manually apply the Add to Group action (actions can be applied to selected endpoints directly from the Home view).
  3. In the action's group selector, choose New Group and name it RTA-Appliances (or your site naming convention). Confirm.

If the appliance has not been detected yet (for example, it never received a lease), add its endpoint record to the Console manually first; see Manually Add an Endpoint in your Forescout Administration Guide.

Blunt alternative: the Ignored IPs group

Forescout ships a built-in Ignored IPs group; endpoints in it are ignored by NAC and Discovery policies entirely. Adding the appliance there also stops policy enforcement against it, but it removes the appliance from normal policy visibility. Prefer the dedicated group with targeted exemptions below.

Manually added group membership does not expire on its own; you remove it with the Group Manager when the engagement ends (see step 5).

3. Exempt the group from blocking and quarantine policies

Forescout enforces through policy actions. The ones that keep the RTA off the network are the Restrict actions, which restrict endpoint access to the network and internet: Switch Block, Assign to VLAN (into a quarantine segment), Virtual Firewall, and similar.

  1. In the Policy view (the Policy Manager), review your active policies and identify every policy whose rules apply a restrict action to unknown, unclassified, or non-compliant devices.
  2. For each such policy, take the appliance out of its enforcement path. Either works:
    • Scope exception: edit the policy scope and add the RTA-Appliances group (or the appliance IP) as an exception, so the policy no longer evaluates the appliance.
    • Match-first rule: add a rule that matches members of RTA-Appliances, apply no restrict action in it, and order it above the rule that blocks or quarantines. The appliance then matches the harmless rule first.
  3. Apply the policy changes.

4. Compliance and classification bypass

The RTA runs no SecureConnector agent, is not domain-joined, and is a hardened Linux appliance, so it can never satisfy agent, antivirus, or patch-level compliance checks. Any compliance policy that restricts non-compliant endpoints will catch it.

  • Add the RTA-Appliances group as a scope exception on your compliance policies (same mechanics as step 3), or confirm those policies apply no restrict action to devices they merely mark non-compliant.
  • Check classification-driven policies too: the appliance classifies as a generic Linux host, so a policy that quarantines unclassified or unmanaged devices needs the same exemption.

Pre-connect 802.1X via the Forescout RADIUS plugin

If your deployment enforces 802.1X at the port through Forescout's RADIUS plugin, an endpoint without a supplicant is evaluated by MAC Authentication Bypass (MAB), that is, by its MAC address. Make sure your MAB handling authorizes the appliance MAC onto a segment with the outbound access described below; the group exemptions in steps 3 and 4 do not by themselves authorize the port.

5. Clear applied actions and verify

Policy exemptions stop new enforcement, but an action already applied to the endpoint stays in force until it is cancelled.

  1. In the Home view, select the appliance endpoint and check which actions are currently applied to it.
  2. Cancel any active restrict action against it (Cancel Actions).
  3. Bounce the appliance's switch port (or power-cycle the VM's network interface) so it requests a fresh DHCP lease on the correct segment.

Then confirm:

  1. Group membership: the endpoint shows as a member of RTA-Appliances in the Console, with no restrict actions applied.
  2. DHCP lease: the appliance receives an IP in the expected subnet, not the quarantine segment.
  3. Connectivity test: from a host on that segment, or directly on the appliance if you have console access, verify egress:
nc -vz connect.remotetesting.secureworks.com 443

A successful connection confirms the appliance can reach its management endpoint. The RTA tunnel should come up within a minute or two of the network admitting it.

Remove the exemptions after the engagement

The group membership and policy exceptions bypass your normal NAC enforcement for that MAC address, which can be spoofed. When the engagement ends, remove the appliance from the RTA-Appliances group with the Group Manager and delete (or empty) the scope exceptions so no unauthorized device can inherit them.