HP Access Control Client Software manual IP address = 192.168.8.1/24 IP address = 192.168.9.1/24

Access Control Concepts

ProCurve NAC 800

Because remediation is a key component of an endpoint integrity solution, the NAC 800 does not follow this strategy. Instead, it places quarantined endpoints in a subnet that exists in the private network, albeit in carefully controlled way.

You can establish the quarantine subnet in one of these ways:

■The NAC 800 assigns to quarantined endpoints IP addresses that are valid but unused in the production network. The quarantined “subnet” is not truly a subnet, but rather an unused subset of an existing subnet.

For example, the network includes three Class C user subnets, each with 100 users:

•10.1.2.0/24

•10.1.3.0/24

•10.1.4.0/24

The DHCP server assigns users addresses in the 25 to 125 range—for example, 10.1.2.25 to 10.1.2.125. The second half of each subnet (10.1.X.128/25) is available for quarantined endpoints:

•Quarantine “subnet” = 10.1.2.128/25

•Quarantine “subnet” = 10.1.3.128/25

•Quarantine “subnet” = 10.1.4.128/25

Of course, the scopes on the network DHCP server must exclude these addresses so that a healthy endpoint is not inadvertently assigned an address in the quarantined subset.

■The network administrator multinets the quarantine subnet on an existing VLAN. Each VLAN requires its own quarantine subnet.

For example, the network includes two Class C subnets, each with

250 users:

•192.168.8.0/24

•192.168.12.0/24

A quarantine subnet isolates non-compliant endpoints from each existing subnet:

•Quarantine subnet = 192.168.9.0/24

•Quarantine subnet = 192.168.13.0/24

The network administrator sets up multinetting on infrastructure devices to accommodate the quarantine subnets. For example, a routing switch could have this configuration:

•VLAN 2

IP address = 192.168.8.1/24 IP address = 192.168.9.1/24

1-50