The Forescout Switch Plugin is designed such that the Access Port ACL and Endpoint Address ACL actions are mutually exclusive. These actions often target the same or conflicting traffic filtering mechanisms within a network switch's hardware or software. Applying an ACL to a physical port (Access Port ACL) while simultaneously trying to apply a source-address-based ACL (Endpoint Address ACL) for the same endpoint can lead to unpredictable results or configuration errors on the switch. Therefore, the Forescout platform enforces the use of only one of these ACL action types on a single endpoint at any given time.

A. Access Port ACL & Switch Block: These actions are not mutually exclusive; they can be used in a tiered enforcement policy, where an ACL is applied first, followed by a block if remediation fails.

B. Switch Block & Assign to VLAN: While a blocked (shutdown) port is not an active member of a VLAN, these actions represent different escalation levels in a policy rather than a technical conflict within Forescout's action framework.

C. Endpoint Address ACL & Assign to VLAN: These actions are complementary. An endpoint can be moved to a quarantine VLAN, and an address-based ACL can be applied to control its traffic within that VLAN.

E. Access Port ACL & Assign to VLAN: This is a very common and complementary action pair. An endpoint is frequently moved to a remediation VLAN, and a port-based ACL is applied to restrict its access.

1. Forescout Switch Plugin Configuration Guide, Version 8.4 (October 2023): In the section "ACL Actions," the guide explicitly states, "The Access Port ACL and Endpoint Address ACL actions are mutually exclusive. You can only apply one of these actions on an endpoint at any given time." (Page 31)

2. Forescout Administration Guide, Version 8.4.1 (November 2023): The guide describes the "Switch Restrict" actions, detailing the functionality of "Access Port ACL" and "Endpoint Address ACL" separately. The exclusivity is a function of the plugin's implementation to prevent switch misconfiguration. (Chapter 28: "Working with Policies," Section: "Restrict Actions," Sub-section: "Switch Actions")