3.12 Quarantining, DHCP

To select the DHCP quarantine method:

Home window>>System configuration>>Quarantining

  1. Select a cluster.

  2. In the Quarantine method area, select the DHCP radio button.

  3. Click ok.

The following sections contain more information:

3.12.1 DHCP Server Configuration

Inline DHCP server is selected by default. If you want to use the DHCP plug-in, which allows you to use multiple DHCP servers, see the instructions in Section 15.0, DHCP Plug-in.

3.12.2 Setting DHCP Enforcement

NOTE:See Section 10.1.3, Configuring Windows Update Service for XP SP2 for information on using Windows Update Service for devices in quarantine.

To set DHCP enforcement:

Home window>>System configuration>>Quarantining>>DHCP quarantine method radio button

Figure 3-37 System Configuration, Quarantining, DHCP Enforcement

  1. Inline DHCP server is selected by default. If you wish to use multiple DHCP servers, see the instructions in Section 15.0, DHCP Plug-in.

  2. Select one of the following radio buttons:

    • Enforce DHCP requests from all IP addresses — Allows DHCP requests from all IP addresses.

    • Restrict enforcement of DHCP requests to quarantine and non-quarantine subnets — Specify individual DHCP relay agent IP addresses, separated by carriage returns in the DHCP relay IP addresses to enforce text box.

      These addresses must be a subset of either the quarantined or non-quarantined subnets. This limits the enforcement scope to DHCP requests relayed via these IP addresses, allowing you to restrict enforcement to only those DHCP requests which are forwarded via particular routers or Layer 3 switches. If set, DHCP traffic coming from a source IP not listed will be passed without intervention.

      NOTE:Construction of the DHCP relay packet's source IP address is vendor-dependent. Some implementations (for example, Extreme) use the IP address of the interface closest to the DHCP server as the source IP for DHCP forwarding, which means the resultant packet may not have a source IP that corresponds to those used on the endpoint's physical subnet. Check your switch vendor's implementation to be sure you are entering correct IP information.

  3. Click ok.

3.12.3 Adding a DHCP Quarantine Area

To add a quarantine area:

Home window>>System configuration>>Quarantining>>DHCP quarantine method radio button>>DHCP quarantine areas area

  1. Click add a quarantine area. The Add quarantine area window appears.

    Figure 3-38 Add a Quarantine Area

  2. In the Add quarantine area window, enter the following information:

    • Quarantined subnet — The CIDR network that represents the IP space and netmask.

    • DHCP IP Range — The start and end DHCP IP addresses to be assigned to quarantined endpoints.

    • Gateway — The gateway temporarily assigned to endpoints.

    • Domain suffix — The domain name assigned to DHCP clients.

    • Non-quarantined subnets — All subnetworks on your LAN except those specified in the quarantined subnet field, separated by a carriage return.

    NOTE:The quarantine area subnets and non-quarantined subnets should be entered using Classless Inter-domain Routing address (CIDR) notation (see Section 16.6, Entering Networks Using CIDR Format).

  3. Choose a DHCP quarantine option:

    • Router access control lists (ACLs) — This option restricts the network access of non-compliant endpoints by assigning DHCP settings on a quarantined network. The network, gateway, and ACLs restricting traffic must be configured on your router, which is accomplished by multinetting or adding a virtual interface to the router that acts as the quarantine gateway IP address. The quarantine area DHCP settings must reflect this configuration on your router. The subnets specified in each area must be unique; that is, neither the quarantined nor the non-quarantined subnets in one area can be quarantined or non-quarantined in another.

    • Static routes assigned on the endpoint — This option restricts the network access of non-compliant endpoints by vending DHCP settings with no gateway and a netmask of 255.255.255.255. Static routes and a Web proxy server built into Novell ZENworks Network Access Control allow the endpoint access to specific networks, IP addresses, and Web sites. These networks, IP addresses, and Web sites are configured in the accessible endpoint list setting (System Configuration>>Accessible Services). The quarantine areas can either be a subset of your existing DHCP scopes or a separate network multinetted on your router.

      For endpoints to see the outside Web sites listed in Accessible Services, the browser being used on the endpoint must have the Auto-proxy setting turned on. Furthermore for the Windows Update service to work, the endpoint will need manual proxy settings pointing to TCP port 3128 on the Enforcement Server assigned to this endpoint. See Section 10.1.3, Configuring Windows Update Service for XP SP2 for more information about this problem.

    HINT:The quarantine areas can either be a subset of your existing DHCP scopes or a separate network multinetted on your router. If this option is not selected, enforcement must occur using ACLs on your router.

    HINT:To set up multiple quarantine areas, click Add a quarantine area, then enter the information detailed in Step 2 for each additional quarantine area.

  4. Click ok.

3.12.4 Sorting the DHCP Quarantine Area

To sort the quarantine area:

Home window>>System configuration>>Quarantining>>DHCP radio button

  1. Click one of the following the column headings to sort the quarantine area by category:

    • subnet

    • dhcp ip range

    • gateway

    • non-quarantine subnets

    • domain suffix

    • d (indicates the quarantine option selected in Step 3)

  2. The DHCP quarantine area sorts by the column name clicked.

3.12.5 Editing a DHCP Quarantine Area

To edit a DHCP quarantine area:

Home window>>System configuration>>Quarantining>>DHCP radio button

  1. Click edit next to the quarantine area you want to edit. The Quarantine area window appears:

    Figure 3-39 Quarantine Area

  2. Edit the information in the fields you want to change. See Section 3.12.3, Adding a DHCP Quarantine Area for information on Quarantine area options.

  3. Click ok.

3.12.6 Deleting a DHCP Quarantine Area

To delete a DHCP quarantine area:

Home window>>System configuration>>Quarantining

  1. Click delete next to the quarantine area you want to remove. The Delete quarantine area confirmation window appears

  2. Click yes.