topic Re: WLC Blocking in Wireless

WLC Blocking

workmen — Sat, 05 Mar 2022 11:34:01 GMT

Hi All,

How can I know which 3rd party device is causing the blocking in WLC, there is a description here that it is blockedbyFS.

Is there a way that I can know which FS is causing this? I am assuming this is a forescout because there was an integration made between forescout and WLC via snmpv3. I just want to be sure if a 3rd party is capable of doing it. Please see screenshot below

TIA,

Tim

Re: WLC Blocking

Mark Elsen — Sat, 05 Mar 2022 12:54:52 GMT

>... I am assuming this is a forescout because

- The status BlockbyFS seems rather descriptive indeed (FS=forescout) , are you using FS as a NAC-policy service (network access control). Or ISE or other ? If FS are NAC-policies correct ? If Radius is used , check for authenticating details on the radius server too ? Normally this is not related to SNMP(v3)

Use , for instance an open-SSID as test to verify that basic wireless can work (e.g.)

Re: WLC Blocking

MHM Cisco World — Sat, 05 Mar 2022 14:55:08 GMT

Re: WLC Blocking

Arshad Safrulla — Sat, 05 Mar 2022 18:57:50 GMT

Yes, Provided that you give SNMP write access to ForceScout NAC it can add MAC addresses to Cisco WLC's. I remember this was working only in AierOS WLC's. Forcescount will perform something similar to ISE profiling (compliance check) and if it fails NAC will automatically add the MAC address to disabled clients.

But for the newer 9800's they required a different level of access, as I remember they wanted an user account in the WLC with CLI access to add the MAC addresses to block list.

Re: WLC Blocking

workmen — Sun, 06 Mar 2022 03:39:34 GMT

yes FS is used as NAC. I will verify it with my team

Thank you very much

Re: WLC Blocking

workmen — Sun, 06 Mar 2022 03:41:42 GMT

yes, the currently deployed APs are Cisco AP 3600 and 3700, we have a 9120 ax ap but it runs on vwlc as of now because the 9800 is under VA Scan.

Thank You very much

Re: WLC Blocking

alirafaleiro — Sat, 19 Mar 2022 06:25:29 GMT

The main function of a traditional wireless LAN controller (WLC) is to configure wireless access points (AP) that connect to it locally.

Re: WLC Blocking

Arshad Safrulla — Mon, 07 Mar 2022 03:43:56 GMT

So I believe you have your answer then. Just heard from our security team that when you integrate 9800’s with forcescout you need write access to CLI. SNMP write access will not work with 9800’s.