Novell ZENWORKS NETWORK ACCESS CONTROL 5.0 - 09-22-2008 User Manual page 152

Troubleshooting Quarantined Endpoints
Table 4-1
Enforcement Mode
DHCP Endpoint
mode enforcement
152 Novell ZENworks Network Access Control Users Guide
How endpoints are quarantined and
redirected to Novell ZENworks Network
Access Control
DHCP server (Novell ZENworks
Network Access Control) gives the
endpoint:
Quarantine range IP address (*)
255.255.255.255 netmask
(effectively blocks outgoing traffic
from the endpoint)
No default gateway
Novell ZENworks Network Access
Control server's IP as DNS server
(will resolve everything except
to the Novell
accessible devices
ZENworks Network Access
Control IP address)
The switch is configured with
additional IP helper addresses to
forward broadcast DHCP
requests to ESs as well as
production DHCP servers.
How quarantined endpoints reach
accessible devices
DHCP server (Novell ZENworks
Network Access Control) also sends:
A static route to the Novell
ZENworks Network Access
Control server IP via a gateway
(*)
Static routes to any IP addresses
defined in Accessible
services
Novell ZENworks Network Access
Control DNS — Novell ZENworks
Network Access Control will add any
listed in Accessible
names
services to the named.conf file so
the endpoint will be able to resolve the
names (to get the real IP). Unless there
are corresponding static routes, the
endpoint will not be able to access
them directly.
Novell ZENworks Network Access
Control Web Proxy — The Novell
ZENworks Network Access Control
server also advertises a Web proxy
server for endpoints that autodetect
Web proxies. This proxy will redirect all
Web requests through Novell
ZENworks Network Access Control,
and traffic destined for
names
Accessible services will be
proxied through Novell ZENworks
Network Access Control.
NOTE: Windows update does not
honor autoproxy. Workarounds include:
Adding Windows update
hostnames AND IP addresses to
Accessible services, or
Manually setting Novell
ZENworks Network Access
Control as the proxy (this would
require reversing this setting it
once a system was out of
quarantine).
in