Extreme Networks AG200 User Manual page 108

System Configuration
NOTE
The quarantine area subnet(s) and non-quarantined subnet(s) should be entered using Classless Inter-domain
Routing address (CIDR) notation (see
2 Choose a DHCP quarantine option:
Static routes assigned on the endpoint —This option restricts the network access of non-
■
compliant endpoints by vending DHCP settings with no gateway and a netmask of
255.255.255.255. Static routes and a Web proxy server built into Sentriant AG allow the endpoint
access to specific networks, IP addresses, and Web sites. These networks, IP addresses, and Web
sites are configured in the accessible endpoint list setting (System Configuration>>Accessible
Services). The quarantine areas can either be a subset of your existing DHCP scopes or a separate
network multinetted on your router.
Router access control lists (ACLs)—This option restricts the network access of non-compliant
■
endpoints by assigning DHCP settings on a quarantined network. The network, gateway, and
ACLs restricting traffic must be configured on your router, which is accomplished by multinetting
or adding a virtual interface to the router that acts as the quarantine gateway IP address. The
quarantine area DHCP settings must reflect this configuration on your router. The subnets
specified in each area must be unique; that is, neither the quarantined nor the non-quarantined
subnets in one area can be quarantined or non-quarantined in another.
NOTE
The quarantine areas can either be a subset of your existing DHCP scopes or a separate network multinetted on your
router. If this option is not selected, enforcement must occur using ACLs on your router.
NOTE
To set up multiple quarantine areas, click Add a quarantine area, then enter the information detailed in
each additional quarantine area.
3 Click ok.
108
"Entering Networks Using CIDR Format" on page 299).
step 1
Sentriant AG Users' Guide, Version 5.0
for