topic Re: Meraki integration with Forescout in Wireless

Meraki integration with Forescout

ggarolla — Wed, 29 Jan 2025 09:54:16 GMT

Dear colleagues,

I am looking into the possibility of migrating from our current 802.1X setup, which uses Windows Server NPS to authenticate both wired and wireless users, to Forescout. For your reference, we have Meraki switches and APs and we use EAP-TLS as authentication protocol.

I was able to configure the wired authentication part, but I am having issues finding documentation or hints for the wireless part.

I configured the Dashboard integration, using Meraki API and that works.

However, I am not sure how to configure APs as RADIUS clients in Forescout and then I am not quite sure how to configure the authentication policy to differentiate it from the wired one.

Do you guys have any experience in using Forescout as RADIUS server for Meraki APs?

Thanks!

Re: Meraki integration with Forescout

I3udder — Wed, 29 Jan 2025 11:26:42 GMT

For at least to differentiate between wired and wireless clients you need to use NAS Device Properties like Called Station ID for example. You can use the same as in Windows Server NPS. I think you need to add every AP in the Wireless section of Forescout. You can find this under Tools --> Options

https://docs.forescout.com/bundle/radius-4-7-3-h/page/c-properties-for-use-in-policy-c-d1e5130.html#t_radius_451_h_radius_properties_for_use_in_policy_c_d1e5130

Re: Meraki integration with Forescout

David-H1 — Wed, 29 Jan 2025 14:27:10 GMT

@ggarolla if you need help getting in touch with someone at Forescout, I'd recommend clicking "demo this app" on their marketplace listing

Re: Meraki integration with Forescout

ggarolla — Wed, 29 Jan 2025 14:35:35 GMT

The problem is that apparently the Wireless plugin in Forescout does not support Meraki APs, hence why I am not sure how and if I can add them as RADIUS clients.

Re: Meraki integration with Forescout

Philip D'Ath — Wed, 29 Jan 2025 19:57:41 GMT

I have no experience with Forescout. Typically with RADIUS servers you can add a subnet (e,g. 10.0.0.0/8) and provide a configuration for every device in that subnet.

You shouldn't need to say what kind of device it is. The RADIUS request says what kind of authentication the device requires (such as wired or WiFi 802.1x).