Novell ZENworks Network Access Control 5.0, User Manual

Page: 153 / 534

Endpoint Activity 153
no
vd
ocx
(e
n)
24
Ma
rch 20
09
DHCP
mode Network
enforcement DHCP server (Novell ZENworks
Network Access Control) gives the
endpoint:
Š
Quarantine range IP address
Š
Appropriate netmask for
quarantine subnet
Š
Appropriate default gateway
Š
Novell ZENworks Network Access
Control server's IP as DNS server
(will resolve everything except
Accessible services
to the
Novell ZENworks Network Access
Control IP address)
Š
The switch is configured with
additional IP helper addresses to
forward broadcast DHCP
requests to ESs as well as
production DHCP servers.
Switches must be configured for
multinetting (
multinetting segment
) so
there can be two networks on the same
physical device (or devices) that
cohabitate, but they should not be able
to talk to one another as enforced by
the switch (using ACLs). Each port on
the switch will be allowed to be on
either the production or quarantine
network, and the switch will have a
secondary IP address assigned to the
gateway port (so there will be different
gateway IP addresses for the
production and quarantine networks).
Novell ZENworks Network Access
Control (fake root) DNS
— As in
endpoint enforcement (for access to
names in Accessible services). The
DNS server forwards requests for
accessible services to a real DHCP
server for resolution.
ACLs on the switch prevent
quarantined systems from talking to
production systems, but allow for the
following specific traffic:
Š
Quarantine --> Novell ZENworks
Network Access Control (OK)
Š
Production --> Quarantine (OK)
Š
Quarantine -|-> Production (NO)
Š
Quarantine -?-> Internet (Maybe*)
Enforcement Mode
How endpoints are quarantined and
redirected to Novell ZENworks Network
Access Control
How quarantined endpoints reach
accessible devices