HP ProCurve NAC 800 User Manual page 204

Endpoint Activity
Troubleshooting Quarantined Endpoints
Enforcement Mode
DHCP mode Endpoint
enforcement
NOTES:
• (*) The gateway does not have to be in the broadcast domain (which is good, since the netmask gives the endpoint no
real broadcast domain), as long as it is in the same (Layer 2) subnet—the router will get you there.
• (**) Allowing access to the Internet is up to the customer, but is necessary for access to any IP addresses in
Accessible services
Table 4-1. Troubleshooting Quarantined Endpoints
4-24
How endpoints are quarantined and
redirected to NAC 800
DHCP server (NAC 800) gives the
endpoint:
• Quarantine range IP address (*)
• 255.255.255.255 netmask (effectively
blocks outgoing traffic from the
endpoint)
• No default gateway
• NAC 800 server's IP as DNS server
(will resolve everything except
accessible devices to the NAC 800 IP
address)
• The switch is configured with
additional IP helper addresses to
forward broadcast DHCP requests to
ESs as well as production DHCP
servers.
System configuration>>Cluster setting defaults area>>Accessible services
(
How quarantined endpoints reach
accessible devices
DHCP server (NAC 800) also sends:
• A static route to the NAC 800 server
IP via a gateway (*)
• Static routes to any IP addresses
Accessible services
defined in
NAC 800 DNS – NAC 800 will add any
Accessible services
names listed in
to the named.conf file so the
endpoint will be able to resolve the
names (to get the real IP). Unless there
are corresponding static routes, the
endpoint will not be able to access
them directly.
NAC 800 Web Proxy – The NAC 800
server also advertises a Web proxy
server for endpoints that autodetect
Web proxies. This proxy will redirect all
Web requests through NAC 800, and
traffic destined for names in
Accessible services
will be proxied
through NAC 800.
NOTE:
Windows update does not honor
autoproxy. Workarounds include:
• Adding Windows update
hostnames AND IP addresses to
Accessible services
, or
• Manually setting NAC 800 as the
proxy (this would require reversing
this setting it once a system was out
of quarantine).
).