# OT / IoT: see it, do not poke it

Source: https://ai.techclick.in/blog_forescout_ot_iot_dont_scan_blind
Markdown: https://ai.techclick.in/blog_forescout_ot_iot_dont_scan_blind.md
Publisher: Techclick Infosec Pvt Ltd

OT/medical/IoT: passive visibility, vendor-safe actions, no NMAP. Dummy PLC 10.50.1.10.

## The ticket

 Weekend scan. Monday the filler line is down. NAC is blamed even if it was “just discovery.” You will not be that engineer.

  Quick interview answer

 OT/IoT/medical devices often have no supplicant, fragile stacks, and long life. Forescout eyeSight can discover without agents (docs). For these prefixes: passive only, no NMAP, no WMI, no Virtual FW unless OT signed it. ISE 802.1X is for users, not PLCs.

  Hero · do not poke

 Inventory is a win. A scan that “probably is fine” is not.
  Lab data · dummy only
 Enterprise Manager  fs-em   10.10.10.30  · Appliance  fs-app1   10.10.10.31  · span/mirror on  sw-access-01  · same LAN  10.20.30.0/24  · Priya  10.20.30.80  · printer  10.20.30.60  · OT PLC  10.50.1.10 . Not a live customer.

## Why OT is different

- No patch window like Windows.

- Active probes can crash a service.

- Safety > NAC purity.

     https://fs-em.techclick-lab.in

     Training mock · not live

       Forescout Console

       Asset Inventory  Policy  Channels  Tools

       Policy → OT_Inspect

### OT_Inspect

        Match  10.50.1.0/24

  Discovery  Passive only

  Control  None

  Notify  OT engineering DL

        Cancel  Save

   OT inspect policy. Training mock.

## Allowed actions

   Action  OT

  Passive classify  Yes
  Email new device  Yes
  NMAP / WMI  No
  802.1X PEAP  No in this design
  Virtual FW  Only with OT change ticket

## How you handle a new PLC

- #### Side A — detect OT_Inspect fires. Mail OT. Do not auto-block.

- #### Side B — classify passively Vendor from traffic, MAC OUI as a hint only.

- #### Side C — inventory CMDB eyeExtend to ServiceNow if you have it. Still no scan.

## Four OT failures

### 1 · Global NMAP includes OT

### 2 · Same policy as laptops

### 3 · Silent Virtual FW “just a deny”

### 4 · No OT owner in the ticket

## How to prove it

  Close the ticket only when

 1) 10.50.1.0/24 is excluded from active. 2) New PLC generated notify only. 3) No 802.1X on that VLAN. 4) OT engineer named in the ticket.

## Traps

   Phrase  Reply

  “NAC means 802.1X everywhere”  Not on PLCs
  “Quick scan to classify”  No

## Knowledge check

   Judgment items. One best answer. Reasons send you back to the matching section.

       Q1
       Default OT action?

           Passive see + notify
           NMAP now
           PEAP
           Permit ip any any on users

       Correct:  a . Choose.

       Q2
       Why no NMAP on 10.50.1.0/24?

           Active scans can fault PLCs
           Forescout cannot see OT
           RADIUS forbids OT
           SPAN cannot copy OT

       Correct:  a . Ticket.

       Q3
       802.1X PEAP on a PLC in this design?

           No
           Yes required
           Only weekends
           Instead of inventory

       Correct:  a . Table.

       Q4
       Virtual FW on OT?

           Only with OT-signed change
           Always
           Never mention OT
           Use instead of notify always

       Correct:  a . Table.

       Q5
       New PLC ticket must name…

           An OT engineer
           Only the SOC intern
           No one
           The printer vendor

       Correct:  a . Proof 4.

       Q6
       Same policy as Windows laptops?

           No — separate OT_Inspect
           Yes always
           Only if PEAP works
           Only if ISE is down

       Correct:  a . Failure 2.

       Check answers
       Reset

  Forescout class series:   Three products  ·  First day  ·  Discovery  ·  Classification  ·  Policy  ·  Enforcement  ·  Switch plugin  ·  eyeExtend  ·  OT / IoT  ·  vs ISE + interview

## Sources

- Forescout OT/IoT/medical positioning — agentless visibility.
- Lesson 3 discovery excludes.

 Related:  Forescout evidence desk  ·  session factory  ·  Cisco ISE series .

---
Cite this Techclick lesson with the source URL. Do not invent fees, batch dates, or job guarantees.
Browse all lessons: https://ai.techclick.in/blogs
AI index: https://ai.techclick.in/llms.txt