HP ProCurve NAC 800, User Manual, Page: 207 / 591

Endpoint Activity
Troubleshooting Quarantined Endpoints
4-27
802.1X DHCP server (MS DHCP server, and so
on) gives the endpoint:
• Quarantine range IP address
• Appropriate netmask for quarantine
subnet
• Appropriate default gateway
• NAC 800 server's IP as DNS server
(will resolve everything except
Accessible services
to the NAC
800 IP address)
• Very low DHCP lease time (~3
minutes)
ACLs on network devices must be
configured to limit where endpoints on
the quarantine VLAN can go.
Iptables prerouting chains rewrite
traffic coming from quarantine subnets
(as defined in the user interface) and
destined for NAC 800 (due to NAC 800
DNS) so that:
NAC 800:80 --> NAC 800:88
NAC 800:443 --> NAC 800:89
Traffic coming from non-quarantine
ranges will not be rewritten, so that
users can get to the NAC 800 user
interface on port 443.
NAC 800 DNS – As in endpoint
enforcement (for access to
names in
Accessible services
)
ACLs on the switch prevent
quarantined systems from talking to
production systems, but allow for the
following specific traffic:
• Quarantine --> NAC 800 (OK)
• Production -?-> Quarantine
(Maybe*)
• Quarantine -|-> Production (NO)
• Quarantine -?-> Internet (Maybe**)
Enforcement Mode How endpoints are quarantined and
redirected to NAC 800 How quarantined endpoints reach
accessible devices
NOTES:
• (*) The gateway does not have to be in the broadcast domain (which is good, since the netmask gives the endpoint no
real broadcast domain), as long as it is in the same (Layer 2) subnet—the router will get you there.
• (**) Allowing access to the Internet is up to the customer, but is necessary for access to any IP addresses in
Accessible services
(
System configuration>>Cluster setting defaults area>>Accessible services
).
Table 4-1. Troubleshooting Quarantined Endpoints (cont.)