How to Wireless User communicates to CounterACT in Forescout:-
-->> Wireless endpoints connect to the organization network based on the SSID’s authentication policy.
-->> The WLAN sends an SNMP trap to CounterACT, which is now aware of a new MAC address online and the session details.
-->> The endpoint communicates through the network and the WLAN sees its traffic.
-->> Wireless Plugin polls WLAN devices for information about connected wireless clients.
-->> CounterACT profiles the endpoint’s IP address to determine what it is and begins policy evaluation to ascertain ownership and compliance.
-->> CounterACT places a control action, provided the endpoint falls within an active control policy
The Wireless Plugin polls WLAN devices for information about connected wireless clients. The information can be used toconstruct policy rules. CounterACT can instruct the WLAN device to carry out a Block MAC command, for example when wireless clients are not compliant withCounterACT policies. Blocking is based on the wireless client’s MAC address. Detected MAC addresses are blocked on all wireless controllers that areconfigured to communicate with the plugin
For DOT.1X authentication wireless users --
-->> The client'sauthentication by 802.1x method.
-----> After successful authentication with the associated SSID then CounterACT monitors mirrored traffic from the WLC and sees the endpoint’s IP address
-->> CounterACT will assign the correct user and machine profile.
