Which destinations must a NAC quarantine segment reach, and what does each hand an intruder?

## What quarantine actually is Network access control makes a decision at admission. One outcome is a plain deny — the port stays dead. The other, and the one estates actually deploy, is a restricted authorization: the device is admitted but placed somewhere it can do very little. That somewhere is usually called the quarantine or remediation segment, and the name contains the whole problem. A device is put there *because it is broken*, and a device that is broken has to be able to reach the things that fix it. Quarantine that reaches nothing is just a slower deny with a helpdesk ticket attached. ## The reach-list Work it out from the remediation the device must perform, not from a template: | Destination | Why remediation needs it | What it gives an intruder on that device | |---|---|---| | Patch / update service | The actual fix — OS updates, agent version, definitions | An outbound path to a large, trusted, often internet-hosted service | | DNS | To resolve the update, identity and time endpoints at all | A resolver that answers, i.e. an outbound channel that is never fully inspected | | Directory / identity | Machine and user authentication, policy retrieval, credential renewal | Reach to the most valuable service in the estate from an unhealthy host | | Time | TLS certificate validity checks fail on a skewed clock, so nothing downloads | Little on its own, which is why it is the entry people forget to ask for | | Revocation / certificate enrolment | Validating or renewing the certificate the device authenticates with | Minor, but it is another named hole with an owner who must approve it | Each row is a conversation with a different team. The patching owner, the directory owner and the DNS owner each have to agree that a segment full of known-unhealthy machines may talk to their service, and each of them is entitled to ask what happens when one of those machines is not merely unpatched but actively hostile. That negotiation, one owner at a time, is the real cost of running quarantine — far more than the switch configuration. ## The direction of the claim Being in quarantine proves that a check returned a failing result. It does not prove the device is merely out of date, and it does not prove the device is not compromised. Those are different states with the same verdict. So the correct posture toward the reach-list is that every entry is reachable by an adversary, not by a well-meaning laptop; write it as though the host in quarantine is hostile, because sometimes it is, and because an intruder who wants those holes can obtain them by making the device fail on purpose — stopping the health service is enough. ## The failure everybody hits Allow-lists are usually written as addresses, because that is what a filter takes. Update services are usually delivered from content-delivery networks whose addresses change constantly and differ per region and per resolver. The result is an allow-list that worked in the lab, works for a week, and then silently stops matching: devices sit in quarantine, downloads time out, users call, and somebody widens the rule until it is effectively general egress. If the destination cannot be pinned to stable addresses, the honest answers are a forward proxy for the segment that resolves and filters by name, an on-premises distribution point the device can reach instead, or an accepted, documented broad hole that somebody owns. The symmetrical mistake is a resolver split: quarantine points at a restricted DNS view, the update endpoint resolves to an address the filter denies, and the failure looks like a patching problem rather than a network one. ## What quarantine must not reach Say this part out loud in an interview, because it is what separates a reach-list from a second production network. Quarantine should not reach general internet egress, production application or data services, the management plane of the network devices enforcing it, or — ideally — its own peers, since everything else in that segment is by definition unhealthy too. A quarantine that has grown holes for six teams and never lost one is not a control any more; it is a slightly awkward VLAN, and the fact that a device landed there means nothing.