Working With Ranges - HP ProCurve NAC 800 User Manual
Hide thumbs
Also See for ProCurve NAC 800:
- User manual (560 pages) ,
- User manual (586 pages) ,
- User manual (474 pages)
Table of Contents
Advertisement
NOTE:
NOTE:
Working with Ranges
In NAC 800 implementations, particularly in trial installations where you are
connecting and disconnecting cables to a number of different types of end-
points, you can filter the activity by specifying the following:
■
Ranges to monitor – This property filters results in the display
window. Only the ranges specified here are shown and tested.
Endpoints that fall outside this range will not be tested.
Ranges to ignore – This property filters results in the display window.
■
Only ranges that fall outside of this list are shown and tested; ranges
in this list are ignored. Endpoints in this range will not be tested or
displayed. For example, include servers, printers, VoIP phones or
other devices that you do not want to be tested in this list.
■
Ranges to enforce – This property is valid for only DHCP mode. It
modifies the iptables NFQUEUE rule such that only the networks set
to be enforced will ever get quarantine addresses.
There is one caveat to note with ranges to monitor and ranges to ignore; if
endpoints have IP addresses outside of the ranges to monitor and ranges to
ignore, and if the ES is capable of controlling network access for those
endpoints, the endpoints can still be quarantined by consequence of the NAC
policy rules for Operating Systems and Inactive endpoints.
Entries made to either Ranges to Monitor or Ranges to Enforce will take effect
for newly discovered endpoints only; Previous entries discovered will not be
removed from the display. To permanently remove these entries, run the
resetTestData.py script from the command line. The script clears all existing
endpoints and endpoint test data from the display.
To specify ranges to monitor:
Home window>>System configuration>>Select an Enforcement
Cluster>>Advanced menu option
In the Endpoint detection area, enter the range of addresses to monitor in the
IP addresses to monitor text field. Separate ranges with a hyphen or use CIDR
notation.
To specify ranges to ignore:
System Administration
Working with Ranges
15-25
Advertisement
Table of Contents
