WLC Blocking

[workmen]

Hi All, 

How can I know which 3rd party device is causing the blocking in WLC, there is a description here that it is blockedbyFS.

Is there a way that I can know which FS is causing this? I am assuming this is a forescout because there was an integration made between forescout and WLC via snmpv3. I just want to be sure if a 3rd party is capable of doing it. Please see screenshot below

TIA, 

Tim

[marce1000]

                                         >... I am assuming this is a forescout because 

 - The status BlockbyFS seems rather descriptive indeed (FS=forescout) , are you using FS as a NAC-policy service (network access control). Or ISE or other ? If FS are NAC-policies correct ? If Radius is used , check for authenticating details on the radius server too  ? Normally this is not related to SNMP(v3)

                                    Use , for instance an open-SSID as test to verify that basic wireless can work (e.g.)

 M.

[workmen]

yes FS is used as NAC. I will verify it with my team

Thank you very much

[MHM Cisco World]

---

Follow

[Arshad Safrulla]

Yes, Provided that you give SNMP write access to ForceScout NAC it can add MAC addresses to Cisco WLC's. I remember this was working only in AierOS WLC's. Forcescount will perform something similar to ISE profiling (compliance check) and if it fails NAC will automatically add the MAC address to disabled clients. 

But for the newer 9800's they required a different level of access, as I remember they wanted an user account in the WLC with CLI access to add the MAC addresses to block list. 

[workmen]

yes, the currently deployed APs are Cisco AP 3600 and 3700, we have a 9120 ax ap but it runs on vwlc as of now because the 9800 is under VA Scan.

Thank You very much

[Arshad Safrulla]

So I believe you have your answer then. Just heard from our security team that when you integrate 9800’s with forcescout you need write access to CLI. SNMP write access will not work with 9800’s.

[alirafaleiro]

The main function of a traditional wireless LAN controller (WLC) is to configure wireless access points (AP) that connect to it locally.