1.0

www.vmware.com
248
VMware ACE Administrator’s Manual
Network Quarantine Plug-Ins
The following table outlines the basic information you need to write network
quarantine plug-ins.
Updating Virtual Machine Versions with the nq-set Command
The comments in the sample network quarantine scripts provided with VMware ACE
Manager mention the nq-set command. If you update the guest operating system
or other software in the virtual machine after distributing it, be sure your updater runs
the nq-set command inside the virtual machine to update the virtual machine’s
version descriptor appropriately.
If you do not run nq-set, VMware ACE cannot detect that the virtual machine has
been updated.
Question Explanation
When does this script execute? This script executes at power on, at reset and when a virtual
machine sends a network quarantine descriptor update.
What relevant environment variables
are available to the script?
VMWARE_NQ_DESCRIPTOR contains the string last set by a
guest update. To do a guest update, you run nq-set (a
command provided by VMware Tools) in the guest operating
system.
What is the expected output? The output of the script may be one of the following, in all
capital letters as shown:
• YES — The current network quarantine descriptor is valid
and should be given normal access.
• NO — The current network quarantine descriptor is valid
and should be given restricted access.
• REJECT — The current network quarantine descriptor is
invalid.
What can I do with this script? The script should do both of the following:
• Verify that the string contained in
VMWARE_NQ_DESCRIPTOR is valid.
• Evaluate the network quarantine descriptor and decide
whether to give normal or restricted access to the virtual
machine.
Where should the output of the
script go?
The script should send its output to StdOut.
What should the exit code of the
script be?
It should be 0. Any nonzero exit code voids any output to
StdOut.