Meraki integration with Forescout

[ggarolla]

Dear colleagues,

I am looking into the possibility of migrating from our current 802.1X setup, which uses Windows Server NPS to authenticate both wired and wireless users, to Forescout. For your reference, we have Meraki switches and APs and we use EAP-TLS as authentication protocol.

I was able to configure the wired authentication part, but I am having issues finding documentation or hints for the wireless part.

I configured the Dashboard integration, using Meraki API and that works.

However, I am not sure how to configure APs as RADIUS clients in Forescout and then I am not quite sure how to configure the authentication policy to differentiate it from the wired one.

Do you guys have any experience in using Forescout as RADIUS server for Meraki APs?

Thanks!

[JeroenVercoulen]

For at least to differentiate between wired and wireless clients you need to use NAS Device Properties like Called Station ID for example. You can use the same as in Windows Server NPS. I think you need to add every AP in the Wireless section of Forescout. You can find this under Tools --> Options

https://docs.forescout.com/bundle/radius-4-7-3-h/page/c-properties-for-use-in-policy-c-d1e5130.html#...

[ggarolla]

The problem is that apparently the Wireless plugin in Forescout does not support Meraki APs, hence why I am not sure how and if I can add them as RADIUS clients.

[David-H]

@ggarolla if you need help getting in touch with someone at Forescout, I'd recommend clicking "demo this app" on their marketplace listing

[PhilipDAth]

I have no experience with Forescout.  Typically with RADIUS servers you can add a subnet (e,g. 10.0.0.0/8) and provide a configuration for every device in that subnet.

You shouldn't need to say what kind of device it is.  The RADIUS request says what kind of authentication the device requires (such as wired or WiFi 802.1x).