# eyeExtend: share context, do not fight the port

Source: https://ai.techclick.in/blog_forescout_eyeextend_ise_firewall
Markdown: https://ai.techclick.in/blog_forescout_eyeextend_ise_firewall.md
Publisher: Techclick Infosec Pvt Ltd

eyeExtend shares context with Cisco ISE and NGFW. Who decides the port. Dummy pxGrid/API lab.

## The ticket

 Forescout flagged malware-like traffic from 10.20.30.80. Virtual FW blocked her. ISE still showed Auth OK VLAN 30. SOC had two truths.

  Quick interview answer

 eyeExtend connects Forescout to the tools you already own. Typical: publish host properties to  ISE  (pxGrid / ANC / endpoint group) so ISE CoA re-authorizes,  or  add the IP to a Palo Alto / Check Point group. Forescout stays the sensor. ISE or the firewall stays the enforcer for that domain.

  Hero · share, don’t wrestle

 One event, one enforcer. The other system only receives a tag.
  Lab data · dummy only
 Enterprise Manager  fs-em   10.10.10.30  · Appliance  fs-app1   10.10.10.31  · span/mirror on  sw-access-01  · same LAN  10.20.30.0/24  · Priya  10.20.30.80  · printer  10.20.30.60  · OT PLC  10.50.1.10 . Not a live customer.

## The bus

 Forescout marketplace: eyeExtend for Advanced Compliance and partner modules automate response using products you already have.

   Pattern  Sensor  Enforcer

  A  Forescout  ISE ANC / CoA
  B  Forescout  NGFW object / quarantine
  C  ISE Live Logs  Forescout inspect only (rare)

     https://fs-em.techclick-lab.in

     Training mock · not live

       Forescout Console

       Asset Inventory  Policy  Channels  Tools

       Modules → eyeExtend Cisco ISE

### Connection

        ISE pxGrid / API  ise-pan.techclick-lab.in

  Action  Assign ANC Quarantine

  Direction  Forescout → ISE

  Switch plugin  Off for these hosts

        Cancel  Save

   eyeExtend Cisco ISE module. Training mock — exact menu names vary by module version.

## Three patterns

 User VLAN owned by ISE → pattern A. Camera subnet with no ISE → pattern B or Virtual FW (one only). Never A+B+plugin together.

## How you wire ISE

- #### Side A — ISE pxGrid / ERS / ANC enabled on PAN (your train’s module README). Dedicated API user.

- #### Side B — Forescout module Connect, map “High risk laptop” → ANC Quarantine.

- #### Side C — prove Trigger on a lab PC. ISE Live Logs show CoA. Session dACL becomes quarantine. Forescout does not also Virtual-FW it.

## Four extend failures

### 1 · Cert/trust for pxGrid

### 2 · Dual enforce

### 3 · API user = Super Admin

### 4 · Mapping every Forescout property into ISE Authz

## How to prove it

  Close the ticket only when

 1) Module status Connected. 2) One lab trigger. 3) Exactly one enforcer log. 4) Rollback: clear ANC / remove FW object.

## Traps

   Wrong  Right

  eyeExtend is a third NAC  It is a bus
  Silent mapping  Document the ANC name

## Knowledge check

   Judgment items. One best answer. Reasons send you back to the matching section.

       Q1
       eyeExtend is…

           Orchestration to ISE/FW/ITSM
           A fourth persona of ISE
           A SPAN cable
           Hide NAT

       Correct:  a . Concept.

       Q2
       User ports owned by ISE. Forescout should…

           Tag ISE (ANC/CoA), not Virtual FW those ports
           Virtual FW and ISE together
           Disable ISE
           Ignore the event

       Correct:  a . Pattern A.

       Q3
       Prove the handoff?

           ISE CoA/Live Log or FW object hit — one of them
           No logs
           Reboot PAN
           Delete the NAD

       Correct:  a . Runbook C.

       Q4
       API user should be…

           Least privilege
           Super Admin shared
           blank password
           the span NIC

       Correct:  a . Failure 3.

       Q5
       pxGrid cert broken. Symptom?

           Module disconnected, no ISE tag
           Better PEAP
           Faster SPAN
           Automatic VLAN 1

       Correct:  a . Failure 1.

       Q6
       Three enforce paths at once?

           No — pick one
           Yes required
           Only on Fridays
           Only for printers

       Correct:  a . Choose.

       Check answers
       Reset

  Forescout class series:   Three products  ·  First day  ·  Discovery  ·  Classification  ·  Policy  ·  Enforcement  ·  Switch plugin  ·  eyeExtend  ·  OT / IoT  ·  vs ISE + interview

## Sources

- Forescout eyeExtend product / Cisco ISE module docs (confirm exact connector name on your version).
- ISE 3.3 pxGrid / ANC.

 Related:  Forescout evidence desk  ·  session factory  ·  Cisco ISE series .

---
Cite this Techclick lesson with the source URL. Do not invent fees, batch dates, or job guarantees.
Browse all lessons: https://ai.techclick.in/blogs
AI index: https://ai.techclick.in/llms.txt