# First day: span up, enforce off

Source: https://ai.techclick.in/blog_forescout_first_day_appliance
Markdown: https://ai.techclick.in/blog_forescout_first_day_appliance.md
Publisher: Techclick Infosec Pvt Ltd

First-day Forescout: EM, appliance IP, span, management route, NTP. Dummy fs-app1 10.10.10.31.

## The ticket

 Inventory is empty. The span is on VLAN 1. Users live on VLAN 30. Forescout is fine. The mirror is wrong.

  Quick interview answer

 Appliance needs a management address (10.10.10.31), connectivity to EM (10.10.10.30), NTP, and a  monitor  interface on a SPAN/TAP that actually sees the user/OT VLANs. Response/enforcement is a different interface used later. Do not mix them.

  Hero · first span

 If the SPAN source VLAN is wrong, classification will look “broken” forever.
  Lab data · dummy only
 Enterprise Manager  fs-em   10.10.10.30  · Appliance  fs-app1   10.10.10.31  · span/mirror on  sw-access-01  · same LAN  10.20.30.0/24  · Priya  10.20.30.80  · printer  10.20.30.60  · OT PLC  10.50.1.10 . Not a live customer.

## Two NICs

   NIC  Job

  Management  EM, DNS, NTP, eyeExtend
  Monitor  Receive SPAN/TAP copies
  Response (later)  Virtual FW / HTTP / ARP actions

     https://fs-em.techclick-lab.in

     Training mock · not live

       Forescout Console

       Asset Inventory  Policy  Channels  Tools

       Tools → Options → Channels

### Channel VLAN30

        Appliance  fs-app1

  Monitor interface  eth1 — SPAN from sw-access-01 Gi1/0/24

  In-line / Virtual FW  Off

  Hosts seen  12 in last hour

        Cancel  Save

   Channels / interface assignment. Training mock.

## SPAN vs TAP vs plugin

 SPAN is fine for class. TAP is cleaner in production. Switch plugin (lesson 7) is for CLI VLAN/ACL, not a substitute for a visibility span if you want DHCP/HTTP banners.

## First-day runbook

- #### Side A — switch Monitor session source VLAN 30 + printer VLAN, dest Gi1/0/24 toward fs-app1.

- #### Side B — appliance Set 10.10.10.31, default route, NTP, join EM.

- #### Side C — prove Asset Inventory: Priya and printer appear within minutes. Packet counters increment on eth1.

  IOS SPAN · dummy  monitor session 1 source vlan 30 , 40
monitor session 1 destination interface Gi1/0/24
show monitor session 1
# Destination Port: Gi1/0/24
# Ingress: Disabled

## Four first-day failures

### 1 · Wrong VLAN in SPAN

### 2 · Both NICs in one broadcast domain, looping

### 3 · No NTP — later 802.1X/ISE join looks flaky

### 4 · Appliance not approved on EM

## How to prove it

  Close first day only when

 1) EM shows appliance Connected. 2) SPAN session is up. 3) Lab hosts visible. 4) Virtual FW off.

## Traps

   Empty inventory  Check SPAN source, not the policy tree

## Knowledge check

   Judgment items. One best answer. Reasons send you back to the matching section.

       Q1
       Monitor NIC should see…

           A SPAN/TAP of the real user/OT VLANs
           Only the internet
           Only EM HA
           AD SYSVOL

       Correct:  a . Concept.

       Q2
       Virtual FW on day one?

           Off
           On for Unknown
           On for the span NIC
           On for NTP

       Correct:  a . Proof.

       Q3
       Empty inventory, appliance green. First?

           SPAN source VLANs
           Delete EM
           Enable ISE CoA
           Turn off DNS

       Correct:  a . Ticket.

       Q4
       Management IP in this lab?

           10.10.10.31
           10.20.30.80
           203.0.113.25
           127.0.0.1

       Correct:  a . Lab.

       Q5
       Why NTP on first day?

           Later ISE/AD/cert integrations hate skew
           SPAN requires NTP packets
           Virtual FW is NTP
           Printers boot from NTP

       Correct:  a . Failure 3.

       Q6
       Response NIC vs monitor NIC?

           Response is for later enforcement actions
           They must be the same port
           Response is EM only
           Monitor is 802.1X

       Correct:  a . Two NICs.

       Check answers
       Reset

  Forescout class series:   Three products  ·  First day  ·  Discovery  ·  Classification  ·  Policy  ·  Enforcement  ·  Switch plugin  ·  eyeExtend  ·  OT / IoT  ·  vs ISE + interview

## Sources

- Forescout installation / appliance channel documentation for your train (8.x / 9.x).
- Cisco SPAN configuration (NAD side).

 Related:  Forescout evidence desk  ·  session factory  ·  Cisco ISE series .

---
Cite this Techclick lesson with the source URL. Do not invent fees, batch dates, or job guarantees.
Browse all lessons: https://ai.techclick.in/blogs
AI index: https://ai.techclick.in/llms.txt