topic Re: ForeScout in General Topics

ForeScout

biskit — Sat, 09 Feb 2019 18:35:15 GMT

Hi all,

Does anyone have any experience with ForeScout products? One of my customers has asked the question:

We are exploring options on Wi-Fi portals for guest access on our Wi-Fi.

One option is to utilize our Forescout however we then need a local DNS which can resolve the local Forescout device but also any subsequent DNS requests.

Can the [Check Point] firewall do this or can it acts as a DNS forwarder to our internal DNS server – and if so is there any issue / concern with this approach?

I don't know well ForeScount well enough (at all!) to immediately answer him. His question doesn't tell me how ForeScout DNS works so I wondered if anyone else happens to know or has done a similar thing in their environment? My first thought is that he really doesn't want visitors and guests using his internal DNS. Does anyone with experience with this product know if that's what he probably means?

Thanks,

Matt

Re: ForeScout

Vladimir — Sat, 09 Feb 2019 20:06:14 GMT

No ForeScout expert here, but I suspect that I can extrapolate what your client is trying to achieve.

They are likely trying to implement ForeScout NAC and use it to perform DNS forwarding for guests.

If this is the case and all Check Point devices have to do is to resolve the ForeScout devices names then you can even hard code them in Gaia of your Check Point devices.

If they are actually looking to use Check Point as forwarders, these capabilities are present in SMB appliances with embedded Gaia:

...but not in the enterprise models which rely on a dedicated external DNS infrastructure.

It is likely you can jury-rig something to make it work, but I would not recommend it.

Re: ForeScout

Poh_Seng_Anthon — Mon, 11 Feb 2019 03:23:04 GMT

Hi Matt

You can follow the configuration based on the link below.

https://www.forescout.com/wp-content/uploads/2018/04/CounterACT_DNS_Enforce_1.2.pdf

regards

Anthony