HP 800 User Manual page 193

Enforcement Mode
802.1X
NOTES:
• (*) The gateway does not have to be in the broadcast domain (which is good, since the netmask gives the endpoint no
real broadcast domain), as long as it is in the same (Layer 2) subnet—the router will get you there.
• (**) Allowing access to the Internet is up to the customer, but is necessary for access to any IP addresses in
services System configuration>>Cluster setting defaults area>>Accessible services
(
Table 4-1. Troubleshooting Quarantined Endpoints (cont.)
How endpoints are quarantined and
redirected to NAC 800
DHCP server (MS DHCP server, and so
on) gives the endpoint:
• Quarantine range IP address
• Appropriate netmask for quarantine
subnet
• Appropriate default gateway
• NAC 800 server's IP as DNS server
(will resolve everything except
Accessible services
to the NAC 800
IP address)
• Very low DHCP lease time (~3
minutes)
ACLs on network devices must be
configured to limit where endpoints on
the quarantine VLAN can go.
Iptables prerouting chains rewrite traffic
coming from quarantine subnets (as
defined in the user interface) and
destined for NAC 800 (due to NAC 800
DNS) so that:
NAC 800:80 --> NAC 800:88
NAC 800:443 --> NAC 800:89
Traffic coming from non-quarantine
ranges will not be rewritten, so that users
can get to the NAC 800 user interface on
port 443.
Endpoint Activity
Troubleshooting Quarantined Endpoints
How quarantined endpoints reach
accessible devices
NAC 800 DNS – As in endpoint
enforcement (for access to names in
Accessible services
)
ACLs on the switch prevent
quarantined systems from talking to
production systems, but allow for the
following specific traffic:
• Quarantine --> NAC 800 (OK)
• Production -?-> Quarantine
(Maybe*)
• Quarantine -|-> Production (NO)
• Quarantine -?-> Internet (Maybe**)
Accessible
).
4-27