HP ProCurve NAC 800 User Manual page 207

Enforcement Mode
802.1X
NOTES:
• (*) The gateway does not have to be in the broadcast domain (which is good, since the netmask gives the endpoint no
real broadcast domain), as long as it is in the same (Layer 2) subnet—the router will get you there.
• (**) Allowing access to the Internet is up to the customer, but is necessary for access to any IP addresses in
Accessible services
Table 4-1. Troubleshooting Quarantined Endpoints (cont.)
How endpoints are quarantined and
redirected to NAC 800
DHCP server (MS DHCP server, and so
on) gives the endpoint:
• Quarantine range IP address
• Appropriate netmask for quarantine
subnet
• Appropriate default gateway
• NAC 800 server's IP as DNS server
(will resolve everything except
Accessible services
800 IP address)
• Very low DHCP lease time (~3
minutes)
ACLs on network devices must be
configured to limit where endpoints on
the quarantine VLAN can go.
Iptables prerouting chains rewrite
traffic coming from quarantine subnets
(as defined in the user interface) and
destined for NAC 800 (due to NAC 800
DNS) so that:
NAC 800:80 --> NAC 800:88
NAC 800:443 --> NAC 800:89
Traffic coming from non-quarantine
ranges will not be rewritten, so that
users can get to the NAC 800 user
interface on port 443.
System configuration>>Cluster setting defaults area>>Accessible services
(
Troubleshooting Quarantined Endpoints
How quarantined endpoints reach
accessible devices
NAC 800 DNS – As in endpoint
enforcement (for access to names in
Accessible services
ACLs on the switch prevent
quarantined systems from talking to
production systems, but allow for the
following specific traffic:
• Quarantine --> NAC 800 (OK)
• Production -?-> Quarantine
to the NAC
(Maybe*)
• Quarantine -|-> Production (NO)
• Quarantine -?-> Internet (Maybe**)
Endpoint Activity
)
).
4-27