Extreme Networks Sentriant AG Software User's Manual page 165

Table 8: Troubleshooting Quarantined Endpoints (continued)
Enforcement Mode
802.1X
NOTES:
• (*) The gateway does not have to be in the broadcast domain (which is good, since the netmask gives the
endpoint no real broadcast domain), as long as it is in the same (Layer 2) subnet—the router will get you
there.
• (**) Allowing access to the Internet is up to the customer, but is necessary for access to any IP addresses in
Accessible services (System configuration>>Cluster setting defaults area>>Accessible services).
Sentriant AG Software Users Guide, Version 5.2
How endpoints are quarantined and
redirected to Sentriant AG
DHCP server (MS DHCP server, and
so on) gives the endpoint:
• Quarantine range IP address
• Appropriate netmask for
quarantine subnet
• Appropriate default gateway
• Sentriant AG server's IP as DNS
server (will resolve everything
except Accessible services to the
Sentriant AG IP address)
• Very low DHCP lease time (~3
minutes)
ACLs on network devices must be
configured to limit where endpoints
on the quarantine VLAN can go.
Iptables prerouting chains rewrite
traffic coming from quarantine
subnets (as defined in the user
interface) and destined for
Sentriant AG (due to Sentriant AG
DNS) so that:
Sentriant AG:80 --> Sentriant AG:88
Sentriant AG:443 -->
Sentriant AG:89
Traffic coming from non-quarantine
ranges will not be rewritten, so that
users can get to the Sentriant AG
user interface on port 443.
Endpoint Activity
How quarantined endpoints reach
accessible devices
Sentriant AG DNS—As in endpoint
enforcement (for access to names in
Accessible services)
ACLs on the switch prevent
quarantined systems from talking to
production systems, but allow for the
following specific traffic:
• Quarantine --> Sentriant AG (OK)
• Production -?-> Quarantine
(Maybe*)
• Quarantine -|-> Production (NO)
• Quarantine -?-> Internet
(Maybe**)
165