HP 800 Series, User Manual

Page: 448 / 586

System Administration
Working with Ranges
15-24
Working with Ranges
In NAC 800 implementations, particularly in trial installations where you are
connecting and disconnecting cables to a number of different types of end-
points, you can filter the activity by specifying the following:
■ Ranges to monitor – This property filters results in the display
window, it does
not keep NAC 800 from testing other systems.
■
Ranges to ignore – Does not test the ranges listed.
■ Ranges to enforce – This property is only valid for DHCP mode. It
modifies the iptables NFQUEUE rule such that only the networks set
to be enforced will ever get quarantine addresses.
To specify ranges to monitor:
Home window>>System configuration>>Select an Enforcement
Cluster>>Advanced menu option
In the
Endpoint detection
area, enter the range of addresses to monitor in the
IP addresses to monitor text field. Separate ranges with a hyphen or use CIDR
notation.
To specify ranges to ignore:
Home window>>System configuration>>Enforcement clusters &
servers>>Select an Enforcement Cluster>>Advanced menu option
In the Endpoint detection area, enter the range of addresses to ignore in the IP
addresses to ignore
text field. Separate ranges with a hyphen or use CIDR
notation.
To specify ranges to enforce:
Home window>>System configuration>>Quarantining menu option
1. Select the
DHCP
radio button in the
Quarantine method
area.
2. Select the
Restrict enforcement of DHCP requests to quarantined or non-
quarantined subnets
radio button.
3. Enter IP addresses in the DHCP relay IP addresses to enforce text box. Enter
individual DHCP relay agent IP addresses, separated by carriage returns.
These addresses are monitored in addition to the quarantined or non-
quarantined subnets.