HP 800 User Manual page 132
Network access controller 800
Hide thumbs
Also See for 800:
- User manual (586 pages) ,
- Manual (106 pages) ,
- Installation manual (34 pages)
Table of Contents
Advertisement
System Configuration
Quarantining, DHCP
NOTE:
3-86
•
Quarantined subnet – The CIDR network that represents the IP space
and netmask.
DHCP IP Range – The start and end DHCP IP addresses to be assigned
•
to quarantined endpoints.
•
Gateway – The gateway temporarily assigned to endpoints.
Domain suffix – The domain name assigned to DHCP clients.
•
Non-quarantined subnets – All subnetworks on your LAN except those
•
specified in the quarantined subnet field, separated by a carriage
return.
The quarantine area subnets and non-quarantined subnets should be entered
using Classless Inter-domain Routing address (CIDR) notation (see "Entering
Networks Using CIDR Format" on page 15-13).
3.
Choose a DHCP quarantine option:
•
Router access control lists (ACLs) – This option restricts the network
access of non-compliant endpoints by assigning DHCP settings on a
quarantined network. The network, gateway, and ACLs restricting
traffic must be configured on your router, which is accomplished by
multinetting or adding a virtual interface to the router that acts as the
quarantine gateway IP address. The quarantine area DHCP settings
must reflect this configuration on your router. The subnets specified
in each area must be unique; that is, neither the quarantined nor the
non-quarantined subnets in one area can be quarantined or non-
quarantined in another.
Static routes assigned on the endpoint – This option restricts the
•
network access of non-compliant endpoints by vending DHCP set-
tings with no gateway and a netmask of 255.255.255.255. Static routes
and a Web proxy server built into NAC 800 allow the endpoint access
to specific networks, IP addresses, and Web sites. These networks, IP
addresses, and Web sites are configured in the accessible endpoint
list setting (System Configuration>>Accessible Services). The quaran-
tine areas can either be a subset of your existing DHCP scopes or a
separate network multinetted on your router.
For endpoints to see the outside Web sites listed in Accessible Ser-
vices, the browser being used on the endpoint must have the Auto-
proxy setting turned on. Furthermore for the Windows Update service
to work, the endpoint will need manual proxy settings pointing to TCP
port 3128 on the Enforcement Server assigned to this endpoint. See
"Configuring Windows Update Service for XP SP2" on page 10-5 for
more information about this problem.
Advertisement
Chapters
Table of Contents
