We performed a comparison between Forescout Platform and Fortinet FortiNAC based on real PeerSpot user reviews.
Find out in this report how the two Network Access Control (NAC) solutions compare in terms of features, pricing, service and support, easy of deployment, and ROI."The 802.1X compliance authentication feature of this solution is very good."
"The initial setup is easy, taking no more than two or three weeks."
"We think it's simple. We think it's very useful and we really like reports and everything."
"Forescout Platform provides multiple features. They have a very effective device fingerprinting in their cloud. You do not need to add any devices manually, such as in Mac devices. Other solutions you have to add IoT devices and OT devices manually. This is one of the major areas that Forescout Platform is excelling in."
"It allows for good detection of all the vendor products we have on-site."
"Within three or four days, we have complete visibility of your infrastructure on the network. Compared to other solutions, the deployment of the solution is easier and we can close the project quickly."
"Forescout CounterACT has allowed us to better open our access and control wireless access globally from our HQ. This allows us to monitor the network access for every office globally. This has improved overall security, reducing risk and opening up the opportunity to provide greater end user flexibility."
"The most valuable feature of the Forescout Platform it's highly customizable and flexible."
"When it works, it's great. It keeps things off the network which are supposed to be off the network."
"The solution is good at giving a deep dive into each product. It tells you, for example, what is connected to the network. It gives us good reporting tools."
"The tool provides us with a list of devices that tries to connect to our network. It offers us a lot of network visibility."
"The support responds to our queries within two to four hours."
"Compared to other NAC vendors, Fortinet’s user interface is more user-friendly."
"The most valuable features are usability and security."
"The most valuable feature of the solution is having visibility over the IoT devices on the network."
"The most valuable features of Fortinet FortiNAC are access control, automation, artificial intelligence, analysis, and security, and it is a unified solution. You can combine a lot of features within the solution."
"The solution's customer support is bad and should be improved."
"As a product, there is nothing to complain about. However, they should improve their overall support. You need that level of knowledge, that level of information is clearly not available. First and foremost, that information is not accessible. The second point to mention is that once you purchase the later support and services. That is, they will continue to charge you for every service."
"Forescout Platform isn't flexible with connections to devices like printers and forces you to re-enter details like the MAC address after any breakdowns."
"Forescout Platform needs to improve how the device works in preventing rogue servers."
"As a user, if I am using a laptop that is Wi-Fi connected, Forescout identifies my port connectivity as one user license, and if I take that same laptop with the same username to a wired network, which is also the same network that is used for the Wi-Fi connection, Forescout detects it as a separate license."
"Forescout Platform could improve the costs of integrations."
"They should improve features related to IT security. ForeScout should analyze behavior to see if the behavior is malicious behavior and block this device. They should develop the ability to analyze the behavior of the device in my environment."
"We experienced some detection issues when checking compliance for the Sophos agent."
"I hope that Fortinet can add a feature with a remediation mechanism when you find a broken piece so that you can click on something and download the needed update or resolve the firewall issue more easily. Currently, we have to use an external remediation server to download updates."
"The deployment of Fortinet FortiNAC could be better. When we are deploying the solution we have some level of dependencies with other vendors for their connection to Fortinet FortiNAC. Without these dependencies, it would be better."
"The course content could be improved, it's not that simple to work through."
"The response and resolution time for technical support issues need to be improved."
"The reporting can also use improvement."
"Fortinet's local support could be improved."
"The training from Fortinet FortiNAC could improve. Fortinet has to plan for better training for its partners. Additionally, device management should have more integration with other devices, such as new and third-party devices."
"The training documentation needs to be more transparent."
Forescout Platform is ranked 4th in Network Access Control (NAC) with 69 reviews while Fortinet FortiNAC is ranked 3rd in Network Access Control (NAC) with 43 reviews. Forescout Platform is rated 8.4, while Fortinet FortiNAC is rated 7.6. The top reviewer of Forescout Platform writes "We can go granular on each endpoint, quarantine non-compliant machines, and target vulnerabilities through scripting". On the other hand, the top reviewer of Fortinet FortiNAC writes "I like the solution's native integration with other devices from the same vendor". Forescout Platform is most compared with Cisco ISE (Identity Services Engine), Aruba ClearPass, Nozomi Networks, Armis and Tenable Security Center, whereas Fortinet FortiNAC is most compared with Cisco ISE (Identity Services Engine), Aruba ClearPass, Fortinet FortiAuthenticator, Fortinet FortiClient and Portnox CORE. See our Forescout Platform vs. Fortinet FortiNAC report.
See our list of best Network Access Control (NAC) vendors.
We monitor all Network Access Control (NAC) reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.
Hi Nkwa,
I did some research comparing ForeScout with ClearPass.
Fundamentally they do the same but in a very different ways. It is important to understand these differences and how they could help you to achieve or not what you need in your organization. I will only point these differences and not every single detail. This is based on my own experience and I do not represent either ForeScout or Aruba ClearPass.
DISCOVERY PROCESS / Profiler - METHODS.
• NetFlow or SFlow: ForeScout do not support Sflow only NetFlow. Is this important? Yes, it is if your switches are not Cisco or any other vendor that support the NetFlow protocol.
ForeScout says: "This capability becomes more relevant in large scale deployments, where the CounterACT packet engine is limited in its "ability to detect activity in remote sites and branch offices". Use of information reported by NetFlow improves visibility and speeds detection of new endpoints." Reference: https:\www.forescout.com\wp-content\uploads\2018\04\CounterACT_NetFlow_1.2.pdf Page 3.
ClearPass:
NetFlow V5/V9 and V10 aka IPFIX + sFLOW are supported.
Reference: www.arubanetworks.com
ORCHESTRATE = Integration/Collaboration with other Systems.
ForeScout:
* ForeScout
is able to interchange contextual information with 3rd party solutions, however the most of the contextual collaboration capabilities are available using an Extended Module option and ForeScout charges separately for this.
Reference Links:
www.forescout.com
www.cdw.com
www.cdw.com
Clear Pass:
* 140+ Integrations are included as part of the core solution. Basically, you can integrate ClearPass to anything in your IT infrastructure at no extra cost to share contextual information. Firewalls, MDM, TicketSystem, SIEM, etc.. Using build-in Modules or APIs. You can request as well customized APIs.
Reference Link www.arubanetworks.com
Reference Link www.arubanetworks.com
AGENT OR AGENTLESS?
Basically, an agent based solution needs a software installed, while an agentless approach don't.
Independently of what NAC solution you will use, it is important to understand if you need or not an agent.
When a device connects to a network, the agent software performs some actions that have been defined in a central access controller or policy management platform. If persistent, the agent performs auto-remediation functions during a connection and will permanently monitor the device throughout a session to “fix” things that may change.
The dissolvable agent: a user clicks on a web portal link to download the agent, which authenticates the user and device, checks the endpoint for compliance, and allows access to the network if policy conditions are met. It then disappears until the user runs it again.
ForeScout
ForeScout is proud to claim that they don’t require an agent (agentless approach NAC) but this is not completely true. ForeScout needs a “dissolvable agent” for authorization & compliance of unmanaged assets e.g. Employee BYOD, Contractor Laptops, printers, CCTV cameras, Smart TVs, etc. Agentless is fine when all your devices are Windows and all of them are under your management. For none windows devices you will need the dissolvable agent to perform health check and remediation.
Based on this explanation having an agent or not is irrelevant for most of the cases. there many identities sources from where you can extract contextual information to help the NAC to do his work, examples are: AD, Wireless AP, End-Point protection software, SCCM, MDM, the Switches, the Firewall, etc...
To do this you need integration, this is possible with ForeScout using the extended module /Plugins and normally paying the extra cost.
Reference Link: www.forescout.com
ClearPass
Clear pass can run with an agent and without the agent. It hast the persistence option, the dissolvable option for BYOD and Guest devices. It can be easily integrated to the mentioned identity stores at no extra cost.
www.bradfordnetworks.com
community.arubanetworks.com
community.extremenetworks.com
802.1X RADIUS AUTHENTICATION OR NOT
Here is one of the major differences. Both support Radius authentication. ClearPass see it like the most secure way to protect your network and ForeScout see it like something complex that you should try to avoid if possible, in my opinion.
ForeScout
* says: 802.1X presents several deployments, operational and troubleshooting challenges, particularly on wired networks.
* To perform RADIUS-based network authentication you need a “Plugin” to forward the authentication requests to an external authentication Sever, like the Microsoft NPS. Page 10, Reference link , you will need as well a Switch Plugin for wired network RADIUS-based deployment and a Wireless plugin for wireless network RADIUS-based deployment. All this sounds like a complexity to me.
* By not having 802.1x configured you save also configuring all switches on your network. Which is not a big problem because you do this once during the useful life of the switch.
* Not build-in TACACS+ - centralized remote authentication to network devices like switches, routers, etc.
Reference Link:
www.forescout.com
ClearPass:
* Is build-in CA and if you like you can use an external CA as well.
* Centralizing the radius authentication make the administration and configuration very easy because you don’t have to manage the NAC and the CA separated.
* No plugin is needed for non-802.1x Auth and non-domain joined devices. In this case you can enforce machine authentication and many other security layers to allow non-domain devices to safely connect without a certificate.
* non-domain devices can automatically or manually be provisioned using a guest network and dissolvable agent.
* Integration with the Aruba Wireless system for Radius Authentication is very easy (if you own an Aruba Wireless Infrastructure) and no extra cost.
You must configure your switches to work with 802.1x. This can be easily done using a template on HPE IMC.
• Build in TACACS+
DEPLOYMENT AND INITIAL POLICY SETUP:
ForeScout: preferred method is: I let you in then I find out who you are.
• ForeScout CounterACT propose the Post-connect deployment strategy for network visibility and access control in which endpoints are initially allowed access to the network while CounterACT profiles them to determine ownership and compliance. Access to the network is then adjusted based on profiling results and security policy.
Reference link: www.forescout.com
This makes sense on new deployments because the NAC can be configured transparent to the end user with no dramatic impact. My question is: What is the process after deployment? Do I let you in then I find a good policy for you?
ClearPass: preferred method is: I let you in if you tell me something about you. Then depending on the roles/policies this unknown device will be moved to a quarantine VLAN for remediation or moved to a dead end VLAN. At the same time this will trigger a ticket to helpdesk and a message to the user to know what is happening and what is the next step.
SUPPORT, SERVICE and DOCUMENTATION:
ForeScout:
• The references are very good everywhere you read in internet. Also, the expertise of their engineers. You can browse a little and it won't be hard to find references.
Online support, documentation, communities (forescout Chatter), etc.
Aruba/HPE
The references are very good everywhere you read in internet. Also, the expertise of their engineers. You can browse anywhere on internet and it won't be hard to find references.
Online support, documentation, communities (aruba airheads), etc.
PRICE:
This will depend on many factors. I would suggest that you consult both and make your own decision.