HP ProCurve NAC 800, Руководство пользователя

Страница: 275 / 591

NAC Policies
NAC Policy Tasks
6-9
6. Select the Operating systems that will not be tested but are allowed network
access.
• Windows ME, Windows 98, Windows 95, Windows NT
• UNIX
•
All other unsupported OSs
NOTE:
In DHCP mode, if an endpoint with an unsupported OS already has a DHCP-
assigned IP address, NAC 800 cannot affect this endpoint in any way until the
lease on the existing IP address for that endpoint expires. If an endpoint with
an unsupported OS has a static IP address, NAC 800 cannot affect this
endpoint in any way. In both of these cases, the System Monitor window may
show the quarantined icon next to these endpoints; however, if you hover
your mouse over the red circle, the actual status shows that the endpoint
should be quarantined, but the quarantine action was unsuccessful.
CAUTION:
Allowing untested endpoints on your network contains risks. See “Untestable
Endpoints and DHCP Mode” on page 7-11 for more information.
NOTE:
A security best practice is to not allow unsupported operating systems
(untested endpoints) on your network. It is more secure to allow untested
endpoints access to your network on a case-by-case basis by adding them to
the System configuration>>Exceptions>>Whitelist window.
7. In the Retest frequency area , enter how frequently NAC 800 should retest
a connected machine.
TIP:
A lower number ensures higher security, but puts more load on the NAC 800
server.
8. In the Inactive endpoints area , enter how long an end-user can be inactive
before they are quarantined. To allow end-users to remain connected
indefinitely select
never quarantine inactive endpoints .