The ticket
Weekend scan. Monday the filler line is down. NAC is blamed even if it was “just discovery.” You will not be that engineer.
OT/IoT/medical devices often have no supplicant, fragile stacks, and long life. Forescout eyeSight can discover without agents (docs). For these prefixes: passive only, no NMAP, no WMI, no Virtual FW unless OT signed it. ISE 802.1X is for users, not PLCs.
Enterprise Manager fs-em 10.10.10.30 · Appliance fs-app1 10.10.10.31 · span/mirror on sw-access-01 · same LAN 10.20.30.0/24 · Priya 10.20.30.80 · printer 10.20.30.60 · OT PLC 10.50.1.10. Not a live customer.
Why OT is different
- No patch window like Windows.
- Active probes can crash a service.
- Safety > NAC purity.
OT_Inspect
Allowed actions
| Action | OT |
|---|---|
| Passive classify | Yes |
| Email new device | Yes |
| NMAP / WMI | No |
| 802.1X PEAP | No in this design |
| Virtual FW | Only with OT change ticket |
How you handle a new PLC
Side A — detect
OT_Inspect fires. Mail OT. Do not auto-block.
Side B — classify passively
Vendor from traffic, MAC OUI as a hint only.
Side C — inventory CMDB
eyeExtend to ServiceNow if you have it. Still no scan.
Four OT failures
1 · Global NMAP includes OT
2 · Same policy as laptops
3 · Silent Virtual FW “just a deny”
4 · No OT owner in the ticket
How to prove it
1) 10.50.1.0/24 is excluded from active. 2) New PLC generated notify only. 3) No 802.1X on that VLAN. 4) OT engineer named in the ticket.
Traps
| Phrase | Reply |
|---|---|
| “NAC means 802.1X everywhere” | Not on PLCs |
| “Quick scan to classify” | No |
Knowledge check
Judgment items. One best answer. Reasons send you back to the matching section.
Forescout class series: Three products · First day · Discovery · Classification · Policy · Enforcement · Switch plugin · eyeExtend · OT / IoT · vs ISE + interview
Sources
- Forescout OT/IoT/medical positioning — agentless visibility.
- Lesson 3 discovery excludes.
Related: Forescout evidence desk · session factory · Cisco ISE series.