Forescout · eyeSight / eyeControl · Lesson 8 of 10

eyeExtend: share context, do not fight the port

Forescout sees a bad camera. ISE owns user ports. The firewall should quarantine the camera IP. eyeExtend is that bus. This lesson is how to share context without two products slamming the same switchport.

Updated 2026-08-18·16 min read·L2 primary·Quiz at end

After this page you can

Explain eyeExtend as orchestration, not a third NAC.
Pick: Forescout → ISE ANC / pxGrid, or Forescout → firewall object.
Prove a tag landed on ISE or the NGFW.
Not enable switch plugin and ISE CoA for the same event.

The ticket

Forescout flagged malware-like traffic from 10.20.30.80. Virtual FW blocked her. ISE still showed Auth OK VLAN 30. SOC had two truths.

Quick interview answer

eyeExtend connects Forescout to the tools you already own. Typical: publish host properties to ISE (pxGrid / ANC / endpoint group) so ISE CoA re-authorizes, or add the IP to a Palo Alto / Check Point group. Forescout stays the sensor. ISE or the firewall stays the enforcer for that domain.

Forescout sharing context to ISE and firewall — One event, one enforcer. The other system only receives a tag.

Lab data · dummy only

Enterprise Manager fs-em 10.10.10.30 · Appliance fs-app1 10.10.10.31 · span/mirror on sw-access-01 · same LAN 10.20.30.0/24 · Priya 10.20.30.80 · printer 10.20.30.60 · OT PLC 10.50.1.10. Not a live customer.

The bus

Forescout marketplace: eyeExtend for Advanced Compliance and partner modules automate response using products you already have.

Pattern	Sensor	Enforcer
A	Forescout	ISE ANC / CoA
B	Forescout	NGFW object / quarantine
C	ISE Live Logs	Forescout inspect only (rare)

https://fs-em.techclick-lab.in

Training mock · not live

Forescout Console

Asset InventoryPolicyChannelsTools

Modules → eyeExtend Cisco ISE

Connection

ISE pxGrid / API

ise-pan.techclick-lab.in

Action

Assign ANC Quarantine

Direction

Forescout → ISE

Switch plugin

Off for these hosts

eyeExtend Cisco ISE module. Training mock — exact menu names vary by module version.

Three patterns

User VLAN owned by ISE → pattern A. Camera subnet with no ISE → pattern B or Virtual FW (one only). Never A+B+plugin together.

How you wire ISE

Side A — ISE
pxGrid / ERS / ANC enabled on PAN (your train’s module README). Dedicated API user.
Side B — Forescout module
Connect, map “High risk laptop” → ANC Quarantine.
Side C — prove
Trigger on a lab PC. ISE Live Logs show CoA. Session dACL becomes quarantine. Forescout does not also Virtual-FW it.

Four extend failures

1 · Cert/trust for pxGrid

2 · Dual enforce

3 · API user = Super Admin

4 · Mapping every Forescout property into ISE Authz

How to prove it

Close the ticket only when

1) Module status Connected. 2) One lab trigger. 3) Exactly one enforcer log. 4) Rollback: clear ANC / remove FW object.

Traps

Wrong	Right
eyeExtend is a third NAC	It is a bus
Silent mapping	Document the ANC name

Forescout class series: Three products · First day · Discovery · Classification · Policy · Enforcement · Switch plugin · eyeExtend · OT / IoT · vs ISE + interview

Sources

Forescout eyeExtend product / Cisco ISE module docs (confirm exact connector name on your version).
ISE 3.3 pxGrid / ANC.