HP 800 Series, User Manual

Page: 313 / 586

DHCP Quarantine Method
Configuring NAC 800 for DHCP
10-5
Configuring the Router ACLs
In order to sufficiently restrict access to and from the quarantine area, you
must configure your router Access Control Lists (ACLs) as follows:
■ Allow traffic to and from the NAC 800 server and the quarantined
network.
■
If you want to allow access to other endpoints outside of the quaran-
tine area (for example a Software Update Service (SUS) server), allow
access to the server and port to and from the quarantined network.
■
All other traffic should be denied both to and from the quarantined
network.
TIP:
Restrict access to and from the quarantined network at the switch level as
well.
Configuring Windows Update Service for XP SP2
If you plan to use Endpoint Routing Enforcement, note that most endpoints
running Windows XP Service Pack 2 cannot run Windows Update successfully
from within quarantine, because of a WinHTTP bug that as of this writing has
not been fixed (see http://support.microsoft.com/kb/919477/ for more details.)
Endpoints not in quarantine are not affected.
The problem occurs because the Windows Update (WU) client software uses
WinHTTP to connect to Microsoft's download sites; Internet Explorer con-
nects to windowsupdate.microsoft.com; however, an error is displayed once
the user clicks on the
Express
or
Custom
download buttons that invoke the WU
client software.
Short of a Microsoft fix, the only way to update XP SP2 endpoints in quarantine
is to deploy a local update server (such as Microsoft's free Windows Server
Update Services, WSUS -- see
http://www.microsoft.com/technet/windowsserver/wsus/default.mspx) and
make sure that this server is listed in
Accessible Services and Devices (“Acces-
sible Services” on page 3-112).