Is Forescout seeing this host — first tool + proof field

1. Why “is it seeing / why no control?” is five questions

Operators collapse five failures into one sentence. The host never landed in inventory. Classification left it Unclassified. Policy matched but the action is still disabled. Switch Plugin SNMP is up and CLI write is dead. RADIUS rejected the supplicant. Those are five first clicks.

This page is the night-shift desk for proof. The factory taught seen ≠ class ≠ comply ≠ plugin write. Here you learn the five Console tools you actually open, in order, when someone asks you to prove Forescout is seeing the host — or to explain why there is no control.

Hero · five tiles, one ticket

2. Mental model — five proof tools

Memorise five named objects before you click. Each tool is allowed to prove one thing. Over-claiming a field is how you ship a bad change at 02:00.

3. Decision flow — ticket → first tool

Flowchart first. Do not open Policy Manager until a diamond says so.

Path · pick the branch before the menu

4. How to choose — first tool + proof field

Print this next to the Console. If you cannot recite the proof field, you are not ready to change anything.

5. Runbook Side A → B → C

Side A proves inventory and class. Side B proves the Policy Action and the plugin that must carry it. Side C proves 802.1X / NAC admission. On a messy Sev-2, do them in this order until a field lights up.

Side A — Inventory + classify (is it seen, what is it)

1. Open All Hosts, not Policy Manager

   Path: Console Home → Views pane → All Hosts. Official: the number in parentheses is currently detected devices. Filter the Detections pane by the ticket IP or MAC. If the host is missing, stop. There is no Policy Action to chase. Source: eyeSight Administration Guide — Working in the Forescout Console / All Hosts.

2. Open Host Details

   Double-click the endpoint in the Detections pane. Official: the Host Details dialog provides policy detections, endpoint properties, and details about actions. Properties with unresolved, empty, or null values are hidden — empty is a finding, not a blank screen. Source: The Host Details dialog (eyeSight 9.1.x).

3. If the Detections pane is noisy, use Host Log

   Official columns: Appliance, Details, Host, IPv6 Address, MAC Address, Status, Time, Type/Name. If a policy action is complete, Status is OK. Filter by Policy or Property. Source: Host Log — investigate endpoint activity.

4. Read the three classification properties

   On the Profile tab: Function, Operating System, Vendor and Model. Use Show troubleshooting messages for Profile Sources. Function Classified By tells you Device Classification Engine versus a Set Function Classification action. Unclassified group = classification work. Source: Primary Classification template (9.1.x).

Side B — Policy action + plugin status (why no control)

1. Read the Policy Actions tab before you edit the policy

   Same Host Details dialog → Policy Actions tab. Official: information in this tab can be exported (Policy Action Log). Quote the action name and whether it is enabled. Official reason to disable actions: “test your policies and get a sense of network compliance before … taking actions on network devices.” Source: Working with Actions; The Host Details dialog.

2. Name the restrict action you actually have

   Switch Plugin restrict actions: Assign to VLAN, Provision VLAN (persistent — does not revert), Switch Block (port off), Access Port ACL, Endpoint Address ACL. eyeControl also ships Virtual Firewall and HTTP Notification / HTTP Login. A Virtual Firewall block is not a switch ACL. Source: Switch-related policies; Working with Actions.

3. Prove the plugin that must carry the action

   Tools → Options → Modules — plugin / module running or stopped (Host Log also records plugin/module status). Then the specific pane:

   • Switch: Tools → Options → Switch. On the host, quote Switch SNMP Status and Switch CLI Status. Assign to VLAN on several vendors uses CLI to assign and SNMP to bounce. Read-ok is not write-ok.
   • WMI: Tools → Options → Modules → Endpoint → HPS Inspection Engine → Configure. Remote Inspection “uses WMI and other standard domain/host management protocols.” Also check Windows Manageable Domain / Windows Manageable Local / Windows Manageable SecureConnector.
   • HTTP: Tools → Options → NAC → HTTP Redirection. HTTP Login / HTTP Notification / Start SecureConnector (HTTP install) all depend on redirection being enabled. Partial Enforcement disables HTTP Actions.

   Sources: Global configuration options for the Switch plugin; Working with Remote Inspection; Policy preferences (HTTP Redirection); Working with Actions.

4. Read Switch Port Action on the host

   Official properties: Switch Port Action (Assign to VLAN, Provision VLAN, or Switch Block assigned to the port), Switch Port VLAN, Switch IP/FQDN and Port Name. If Policy Actions says Assign to VLAN and Switch Port VLAN never moved, you have a plugin-write ticket — not a posture ticket. Source: Switch-related policies — Switch properties.

Path:            Host Details → Policy Actions
Quote:           action name + enabled/disabled + Host Log Status
If action pending:
  Tools → Options → Modules     (running / stopped)
  Switch SNMP Status            (read path)
  Switch CLI Status             (write / bounce path)
  Switch Port Action            (what the port thinks)
  Switch Port VLAN              (did it move)
HPS / WMI:       Windows Manageable Domain | Local | SecureConnector
HTTP:            Tools → Options → NAC → HTTP Redirection
Mode check:      Partial Enforcement disables HTTP Actions + Virtual Firewall

Side C — 802.1X / NAC admission state

1. Open 802.1X properties, not All Hosts host-count

   On Host Details, read the RADIUS plugin properties. Official Authentication Decision properties: 802.1X Last Authentication State - User Credentials, … Computer Credentials, … MAC Based — each is RADIUS-Accepted or RADIUS-Rejected. 802.1X RADIUS Authentication State is the last Accept or Reject. Source: RADIUS properties for use in policy conditions.

2. Read Authorization Source before you blame the switch

   802.1X Authorization Source is one of: Policy Action Authorization, MAC Address Repository Authorization, Pre-Admission Authorization Rule. Official note: the final reply might differ from the authentication state “due to any imposed authorization.” A RADIUS-Accept plus a restrictive Authorize action is still a working NAC — quote both. Source: same RADIUS properties topic.

3. If authentication failed, read the debug field — then stop changing VLANs

   802.1X RADIUS Log Details holds debug messages of the last failed authentication. 802.1X Authentication Type names EAP-TLS, EAP-TTLS, MAB, PEAP, PEAP-EAP-TLS. A cert expiry (802.1X Client Cert Expiration) is not a Switch Plugin outage. Source: RADIUS properties — Advanced / Authentication Details / Client certificate.

6. Five tickets as full stories

These five land every quarter. Memorise first tool + proof field. Times and identities below are lab-only.

Journey · one amber hop is the ticket

FS-EVD-01 — Prove inventory (All Hosts / Host Details)

01:42 · P2. Priya on a new floor jack. Helpdesk photo of “I have an IP.” L1 already drafted an Assign to VLAN on Corporate-Posture.

First tool: Console Home → All Hosts. Search 10.10.8.22 and the MAC from the switch CAM. Double-click → Host Details.

If missing: Forescout is not seeing the host. Quote the empty Detections result and the managed-range / SPAN / DHCP-helper check you will do next. There is no Policy Action. Do not enable a restrict on a host that does not exist.

If present: quote IP, MAC, and Host Log Time of the last event. You have proved inventory. You have not proved class, action, plugin, or 802.1X.

FS-EVD-02 — Prove match / classify (Profile tab)

02:05 · P2. The host is in All Hosts. Function is empty. It sits in the Unclassified group. Night lead wants a default Switch Block on “anything unknown.”

First tool: Host Details Profile tab. Click Show troubleshooting messages for Profile Sources.

Proof field: Function, Operating System, Vendor and Model — all unresolved — plus membership in the Unclassified group created by the Primary Classification template. Official: if a device does not meet any group or eyeSight cannot evaluate it, it is placed in Unclassified. Classification policies also use active methods (open ports, Nmap, WMI / SMB / RRP depending on HPS configuration). Sensitive endpoints should have been excluded — do not Nmap an OT VLAN at 02:00.

FS-EVD-03 — Prove the Policy Action

02:20 · P2. Function = Windows Workstation. SAP is dead. Someone wants DHCP rebuilt.

First tool: Host Details → Policy Actions tab. Also filter Host Log to Policy.

Proof field: action = Assign to VLAN (lab VLAN 20 / restrict), Host Log Status = OK at 02:14:19. That name is the ticket. The user path matches a restrict VLAN, not a missing IP helper. Finish posture (AV / disk-encrypt / domain — whatever Corporate-Posture checks) or add a time-boxed group exception with an owner. Do not recreate DHCP.

FS-EVD-04 — Prove plugin status (Switch / WMI / HTTP)

02:40 · P1. Corporate-Posture evaluates. Policy Actions shows Assign to VLAN. Switch Port VLAN is still 10. L1 wants the policy deleted.

First tool: Tools → Options → Modules (Switch Plugin running?) then host properties Switch SNMP Status and Switch CLI Status.

Proof field: SNMP = OK, CLI = fail (lab: auth). Official: on several vendors the plugin uses CLI to assign the VLAN and SNMP to bounce the port — both credentials need write. Connected + read-ok is the classic lie. Also check: action threshold (default 2% of endpoints per action type per Appliance), “Maximum allowed endpoints connected to port” (hub / phone + PC), trunk port (Assign to VLAN is not applied on trunks), and Partial Enforcement (HTTP / Virtual Firewall disabled).

If the action was HTTP Notification and the user never saw a page: quote Tools → Options → NAC → HTTP Redirection and Partial Enforcement. If posture is stuck pending: quote HPS Inspection Engine running + Windows Manageable Domain (WMI Remote Inspection) versus SecureConnector.

FS-EVD-05 — Prove 802.1X / NAC state

03:00 · P2. Contractor cannot join the corp SSID. “NAC is down.” Application Segment thinking from another vendor is leaking into the channel.

First tool: Host Details → 802.1X / RADIUS properties. If there is no host record, you are back on FS-EVD-01 (the authenticator never forwarded RADIUS, or the endpoint is not in the managed range).

Proof field: 802.1X Last Authentication State - User Credentials = RADIUS-Rejected, 802.1X Authentication Type = PEAP, 802.1X RADIUS Log Details = the last failure, 802.1X Authorization Source empty because auth never succeeded. That is an admission ticket. Restarting the Switch Plugin will not mint a cert or fix a password. If state is RADIUS-Accepted and 802.1X Authorization Source = Policy Action Authorization, the user was admitted and then authorized by policy — go to FS-EVD-03, not “NAC is down.”

7. Traps + close-the-ticket proof

Proof · named field, then Closed

Sources

• Forescout eyeSight Administration Guide 9.1.x — Console, policies, actions
• The Host Details dialog — policy detections, properties, Policy Actions tab / Policy Action Log
• Host Log — investigate endpoint activity — Appliance, Details, Host, MAC, Status (OK), Time, Type/Name; plugin/module running or stopped
• Primary Classification template — Function, Operating System, Vendor and Model, Unclassified group, Profile Sources, Function Classified By; Tools → Options → Discovery → Inventory
• Working with Actions — enable/disable actions to sense compliance; HTTP Login / HTTP Notification; Virtual Firewall; action thresholds; Tools → Options → Modules → Help
• Switch-related policies — Switch SNMP Status, Switch CLI Status, Switch Port Action, Switch Port VLAN, Assign to VLAN / Provision VLAN / Switch Block / ACL
• Global configuration options for the Switch plugin — Tools → Options → Switch; maximum endpoints per port; VoIP bounce
• Working with Remote Inspection — WMI and domain/host management protocols; HPS Inspection Engine
• Policy preferences — Tools → Options → NAC → HTTP Redirection
• RADIUS properties for use in policy conditions — 802.1X Last Authentication State, RADIUS Authentication State, Authorization Source, RADIUS Log Details
• Create an Authorization Source policy — Policy tab; RADIUS → 802.1X → 802.1X Enforcement → Authorization Source

Related: Blog 1 · Forescout session factory · Policy Manager deep-dive · Classification deep-dive · NAC enforcement methods · Forescout practice hub