HP 800 Series, User Manual

Page: 202 / 586

Endpoint Activity
Troubleshooting Quarantined Endpoints
4-24
Enforcement Mode How endpoints are quarantined and
redirected to NAC 800 How quarantined endpoints reach
accessible devices
DHCP mode Endpoint
enforcement DHCP server (NAC 800) gives the
endpoint:
• Quarantine range IP address (*)
• 255.255.255.255 netmask (effectively
blocks outgoing traffic from the
endpoint)
• No default gateway
• NAC 800 server's IP as DNS server
(will resolve everything except
accessible devices to the NAC 800 IP
address)
• The switch is configured with
additional IP helper addresses to
forward broadcast DHCP requests to
ESs as well as production DHCP
servers.
DHCP server (NAC 800) also sends:
• A static route to the NAC 800 server
IP via a gateway (*)
• Static routes to any IP addresses
defined in
Accessible services
NAC 800 DNS – NAC 800 will add any
names listed in
Accessible services
to the
named.conf
file so the
endpoint will be able to resolve the
names (to get the real IP). Unless there
are corresponding static routes, the
endpoint will not be able to access
them directly.
NAC 800 Web Proxy – The NAC 800
server also advertises a Web proxy
server for endpoints that autodetect
Web proxies. This proxy will redirect all
Web requests through NAC 800, and
traffic destined for
names in
Accessible services
will be proxied
through NAC 800.
NOTE:
Windows update does not honor
autoproxy. Workarounds include:
• Adding Windows update
hostnames AND IP addresses to
Accessible services
, or
• Manually setting NAC 800 as the
proxy (this would require reversing
this setting it once a system was out
of quarantine).
NOTES:
• (*) The gateway does not have to be in the broadcast domain (which is good, since the netmask gives the endpoint no
real broadcast domain), as long as it is in the same (Layer 2) subnet—the router will get you there.
• (**) Allowing access to the Internet is up to the customer, but is necessary for access to any IP addresses in
Accessible services
(
System configuration>>Cluster setting defaults area>>Accessible services
).
Table 4-1. Troubleshooting Quarantined Endpoints