Configure ForeScout so devices being assessed for compliance do not communicate with other devices in the DMZ or other network segments. There are different approaches; however, this typically involves isolating noncompliant devices into a quarantine or assessment zone until they meet compliance requirements. The following are examples. Create a Quarantine VLAN: 1. Set up a dedicated VLAN (e.g., "Quarantine_VLAN") for devices under assessment. 2. This VLAN should have restricted access, blocking communication to other devices or production network segments. 3. Allow traffic only to specific remediation servers (e.g., patch servers, ForeScout appliance for assessment). 4. Configure the switches to support dynamic VLAN assignment via CounterACT. 5. Enforce Network Isolation using a VLAN: - Select the "Quarantine_VLAN". - CounterACT will instruct the switch (via SNMP or CLI) to move the device to this VLAN upon detection. Or ACL Enforcement Method: 1. If VLANs are not feasible, use the **Apply ACL** action. 2. Configure an ACL on the switches or routers to block all traffic from the device’s IP or MAC to other network devices, allowing only traffic to remediation servers (e.g., IP of patch server, DNS, or CounterACT appliance). - Example ACL (syntax depends on the switch/router): ``` deny ip <device_IP> 0.0.0.0 <network_range> <network_mask> permit ip <device_IP> 0.0.0.0 <remediation_server_IP> 0.0.0.0 permit ip <device_IP> 0.0.0.0 <forescout_IP> 0.0.0.0 deny ip any any ``` Or Virtual Firewall Method: 1. Use CounterACT’s Virtual Firewall action to block all traffic from the device except to specific IPs/ports (e.g., remediation servers, CounterACT). 2. Configure rules in the action settings to allow only necessary outbound traffic.