HP 800 Series, User Manual

Page: 143 / 586

System Configuration
Quarantining, DHCP
3-95
must reflect this configuration on your router. The subnets specified
in each area must be unique; that is, neither the quarantined nor the
non-quarantined subnets in one area can be quarantined or non-
quarantined in another.
•
Static routes assigned on the endpoint
– This option restricts the
network access of non-compliant endpoints by vending DHCP set-
tings with no gateway and a netmask of 255.255.255.255. Static routes
and a Web proxy server built into NAC 800 allow the endpoint access
to specific networks, IP addresses, and Web sites. These networks, IP
addresses, and Web sites are configured in the accessible endpoint
list setting (
System Configuration>>Accessible Services
). The quaran-
tine areas can either be a subset of your existing DHCP scopes or a
separate network multinetted on your router.
For endpoints to see the outside Web sites listed in Accessible Ser-
vices , the browser being used on the endpoint must have the Auto-
proxy setting turned on. Furthermore for the Windows Update service
to work, the endpoint will need manual proxy settings pointing to TCP
port 3128 on the Enforcement Server assigned to this endpoint. See
“Configuring Windows Update Service for XP SP2” on page 10-5 for
more information about this problem.
TIP:
The quarantine areas can either be a subset of your existing DHCP scopes or
a separate network multinetted on your router. If this option is not selected,
enforcement must occur using ACLs on your router.
TIP:
To set up multiple quarantine areas, click Add a quarantine area, then enter
the information detailed in step 2 for each additional quarantine area.
4. Click ok .
Sorting the DHCP Quarantine Area
To sort the quarantine area:
Home window>>System configuration>>Quarantining>>DHCP radio button
1. Click one of the following the column headings to sort the quarantine area
by category:
• subnet
• dhcp ip range
• gateway