HP Access Control Client Software manual Dhcp Deployment

Access Control Concepts

ProCurve NAC 800

DHCP Deployment

With this deployment method, the NAC 800 intercepts and responds to end- points’ DHCP requests, assigning them IP addresses on a quarantine subnet. It then tests endpoints for compliance with NAC policies. Healthy endpoints are allowed to receive DHCP addresses from the network DHCP server and are granted complete network access. Non-compliant endpoints, on the other hand, remain in the quarantine subnet.

In a cluster of NAC 800s, the devices might share roles between them. For example, one or two NAC 800 ESs act as PEPs, intercepting DHCP requests, while multiple NAC 800 ESs test the endpoints and decide whether they should be quarantined. All the ESs are controlled by an MS, which acts as the repository for NAC policies.

Process for DHCP Quarantining. The NAC 800 enforces this process to control a endpoint’s network access:

1.The endpoint connects to a switch port or associates to an AP. The PEP does not enforce an access control method on the port, so the Data-Link Layer connection activates.

2.The endpoint sends a DHCP message, requesting a valid IP address for itself, the IP address of its default gateway and DNS server, and all the other configurations necessary for full connectivity.

3.Network infrastructure devices forward the DHCP request to the DHCP server.

N o t e	Exactly how the devices forward the request depends on the network
	infrastructure.
	In a network with a single VLAN, the devices flood the request as a
	broadcast. In a network with multiple VLANs, network infrastructure
	devices usually implement DHCP relay, routing DHCP requests to a helper
	address (the address of a DHCP server on another subnet). When you add
	a NAC 800 deployed with the DHCP method, you must configure two
	helper addresses: the network DHCP server’s and the NAC 800’s. The
	devices initially send DHCP requests to the first helper address, the
	network DHCP server’s.

4.The NAC 800, which is installed between the DHCP server and the server’s switch, intercepts the request. It decides how to handle the request based on the endpoint’s integrity posture.

1-48