Endpoint Activity
Troubleshooting Quarantined Endpoints
4-24
Enforcement Mode
How endpoints are quarantined and
redirected to NAC 800
How quarantined endpoints reach
accessible devices
DHCP mode
Endpoint
enforcement
DHCP server (NAC 800) gives the
endpoint:
• Quarantine range IP address (*)
• 255.255.255.255 netmask (effectively
blocks outgoing traffic from the
endpoint)
• No default gateway
• NAC 800 server's IP as DNS server
(will resolve everything except
accessible devices
to the NAC 800 IP
address)
• The switch is configured with
additional IP helper addresses to
forward broadcast DHCP requests to
ESs as well as production DHCP
servers.
DHCP server (NAC 800) also sends:
• A static route to the NAC 800 server
IP via a gateway (*)
• Static routes to any IP addresses
defined in
Accessible services
NAC 800 DNS – NAC 800 will add any
names
listed in
Accessible services
to the
named.conf
file so the
endpoint will be able to resolve the
names (to get the real IP). Unless there
are corresponding static routes, the
endpoint will not be able to access
them directly.
NAC 800 Web Proxy – The NAC 800
server also advertises a Web proxy
server for endpoints that autodetect
Web proxies. This proxy will redirect all
Web requests through NAC 800, and
traffic destined for
names
in
Accessible services
will be proxied
through NAC 800.
NOTE:
Windows update does not honor
autoproxy. Workarounds include:
• Adding Windows update
hostnames AND IP addresses to
Accessible services
, or
• Manually setting NAC 800 as the
proxy (this would require reversing
this setting it once a system was out
of quarantine).
NOTES:
• (*) The gateway does not have to be in the broadcast domain (which is good, since the netmask gives the endpoint no
real broadcast domain), as long as it is in the same (Layer 2) subnet—the router will get you there.
• (**) Allowing access to the Internet is up to the customer, but is necessary for access to any
IP addresses
in
Accessible services
(
System configuration>>Cluster setting defaults area>>Accessible services
).
Table 4-1.
Troubleshooting Quarantined Endpoints
Summary of Contents for ProCurve NAC 800
Page 1: ...HP ProCurve Network Access Controller 800 Users Guide ...
Page 2: ......
Page 3: ...ProCurve Network Access Controller 800 Release 1 1 Users Guide ...
Page 43: ...2 1 2 Clusters and Servers Chapter Contents Overview 2 2 Installation Examples 2 3 ...
Page 71: ...System Configuration Management Server 3 23 Figure 3 9 System Configuration Management Server ...
Page 80: ...System Configuration User Accounts 3 32 Figure 3 12 System Configuration User Accounts ...
Page 88: ...System Configuration User Roles 3 40 Figure 3 16 System Configuration User Roles ...
Page 180: ... This page intentionally left blank ...
Page 208: ... This page intentionally left blank ...
Page 234: ...End user Access Mac OS X Endpoint Settings 5 26 Figure 5 14 Mac System Preferences ...
Page 288: ... This page intentionally left blank ...
Page 302: ... This page intentionally left blank ...
Page 306: ...High Availability and Load Balancing High Availability 8 4 Figure 8 2 DHCP Installation ...
Page 307: ...High Availability and Load Balancing High Availability 8 5 Figure 8 3 802 1X Installation ...
Page 309: ...9 1 9 Inline Quarantine Method Chapter Contents Inline 9 2 ...
Page 312: ... This page intentionally left blank ...
Page 315: ...DHCP Quarantine Method Overview 10 3 Figure 10 1 DHCP Installation ...
Page 318: ... This page intentionally left blank ...
Page 323: ...802 1X Quarantine Method NAC 800 and 802 1X 11 5 Figure 11 2 NAC 800 802 1X Enforcement ...
Page 324: ...802 1X Quarantine Method NAC 800 and 802 1X 11 6 Figure 11 3 802 1X Communications ...
Page 380: ... This page intentionally left blank ...
Page 418: ... This page intentionally left blank ...
Page 425: ...Reports Viewing Report Details 14 7 Figure 14 3 Test Details Report ...
Page 459: ...System Administration Creating and Replacing SSL Certificates 15 31 10 Save and exit the file ...
Page 468: ... This page intentionally left blank ...
Page 480: ... This page intentionally left blank ...
Page 526: ...Tests Help Security Settings Windows B 34 http www pcworld com article id 112138 article html ...
Page 532: ... This page intentionally left blank ...
Page 562: ... This page intentionally left blank ...