Forescout · eyeSight / eyeControl · Lesson 7 of 10

Switch plugin: the switch is the muscle, Forescout is the brain

Virtual FW is the appliance. The switch plugin logs into sw-access-01 and sets a VLAN or ACL. That is powerful and easy to break STP/voice if you miss the voice VLAN. This lesson is that plugin — credentials, commands, rollback.

Updated 2026-08-18·16 min read·L2 primary·Quiz at end

After this page you can

Describe switch plugin vs Virtual FW.
Use a least-privilege login, not local admin forever.
Change one test port, prove, have a rollback.
Not move voice and data VLANs blindly.

The ticket

A control policy “quarantine VLAN 99” ran campus-wide. Phones lost CDP voice VLAN. Helpdesk spent the night. The plugin worked. The blast radius was the bug.

Quick interview answer

Switch plugin: Forescout uses SNMP/CLI/NETCONF (train-dependent) to apply VLAN/ACL. The NAD is still the enforcer. Scope the switch list, use a dedicated TACACS user, and test one interface. Voice: do not strip the voice VLAN. Rollback = known good template.

Forescout telling a switch to change a VLAN — If you can do it in IOS, the plugin can do it at 02:00 — for better or worse.

Lab data · dummy only

Enterprise Manager fs-em 10.10.10.30 · Appliance fs-app1 10.10.10.31 · span/mirror on sw-access-01 · same LAN 10.20.30.0/24 · Priya 10.20.30.80 · printer 10.20.30.60 · OT PLC 10.50.1.10. Not a live customer.

Plugin vs Virtual FW

	Switch plugin	Virtual FW
Where enforced	Switch	Appliance path
Sees original MAC/VLAN	Yes	May rewrite path
Blast radius	Whole switch if scoped wrong	Hosts the appliance can reach

https://fs-em.techclick-lab.in

Training mock · not live

Forescout Console

Asset InventoryPolicyChannelsTools

Tools → Options → Switch / Plugin

sw-access-01

10.10.10.2

Access

SSH, user fs-nac (TACACS)

Allowed commands

vlan / interface switchport access

Pilot ports

Gi1/0/20 only

Switch plugin inventory. Training mock.

When to use it

You already own Catalyst access and want VLAN quarantine without ISE. If ISE already owns 802.1X, do not also plugin-VLAN those ports.

How you enable it

Side A — AAA user
fs-nac can only change a port range. Logged.
Side B — plugin + one port
Map Gi1/0/20 camera to VLAN 50. Not the whole stack.
Side C — prove + rollback
show run interface Gi1/0/20. Keep the old VLAN in the ticket. Revert command ready.

dummy proof

show run interface Gi1/0/20
# switchport access vlan 50
# switchport voice vlan 70   ← must still be here for phones
show authentication sessions interface Gi1/0/20

Four plugin failures

1 · Credentials = local cisco/cisco

2 · Policy applies to all interfaces including uplinks

3 · Voice VLAN stripped

4 · No rollback user on-call

How to prove it

Close the ticket only when

1) Only the test port changed. 2) Voice VLAN intact if it is a phone. 3) AAA log shows fs-nac. 4) Rollback pasted in the ticket.

Traps

Wrong	Right
Plugin + ISE VLAN on same port	One owner (lesson 6)
Wildcard interface Gi1/0/*	Explicit list

Forescout class series: Three products · First day · Discovery · Classification · Policy · Enforcement · Switch plugin · eyeExtend · OT / IoT · vs ISE + interview

Sources

Forescout switch plugin / switch integration guides for your IOS train.
Lesson 6 — one enforcement owner.