HP 800 User Manual page 136

System Configuration
Quarantining
NOTE:
TIP:
3-88
1. In the Add quarantine area window, enter the following information:
Quarantined subnet – The CIDR network that represents the IP space
•
and netmask.
• DHCP IP Range – The start and end DHCP IP addresses to be assigned
to quarantined endpoints.
Gateway – The gateway temporarily assigned to endpoints.
•
Domain suffix – The domain name assigned to DHCP clients.
•
• Non-quarantined subnet(s) – All subnetworks on your LAN except those
specified in the quarantined subnet field, separated by a carriage
return.
The quarantine area subnet(s) and non-quarantined subnet(s) should be
entered using Classless Inter-domain Routing address (CIDR) notation (see
"Entering Networks Using CIDR Format" on page 13-9).
2. Choose a DHCP quarantine option:
Static routes assigned on the endpoint – This option restricts the
•
network access of non-compliant endpoints by vending DHCP set-
tings with no gateway and a netmask of 255.255.255.255. Static routes
and a Web proxy server built into NAC 800 allow the endpoint access
to specific networks, IP addresses, and Web sites. These networks, IP
addresses, and Web sites are configured in the accessible endpoint
list setting (System Configuration>>Accessible Services). The quaran-
tine areas can either be a subset of your existing DHCP scopes or a
separate network multinetted on your router.
• Router access control lists (ACLs) – This option restricts the network
access of non-compliant endpoints by assigning DHCP settings on a
quarantined network. The network, gateway, and ACLs restricting
traffic must be configured on your router, which is accomplished by
multinetting or adding a virtual interface to the router that acts as the
quarantine gateway IP address. The quarantine area DHCP settings
must reflect this configuration on your router. The subnets specified
in each area must be unique; that is, neither the quarantined nor the
non-quarantined subnets in one area can be quarantined or non-
quarantined in another.
The quarantine areas can either be a subset of your existing DHCP scopes or
a separate network multinetted on your router. If this option is not selected,
enforcement must occur using ACLs on your router.