Provisioning layer three access for agentless devices
View Patent ↗A method may include obtaining a layer two identification of an endpoint that is seeking access to a network, the endpoint omitting an agent to communicate a layer three address of the endpoint to a policy node, applying one or more authentication rules based on the layer two identification of the endpoint, assigning the layer three address to the endpoint, learning, by the policy node, the layer three address of the endpoint, and provisioning layer three access for the endpoint to the network based on the learned layer three address.
1. A method comprising:
applying, by a device and based on a layer two identification, one or more authentication rules to authenticate an endpoint device seeking access to a network;
determining, by the device, to grant the endpoint device access to the network based on applying the one or more authentication rules;
determining, by the device and based on determining to grant the endpoint device access to the network, one or more permissions associated with the endpoint device accessing the network;
providing, by the device and to the endpoint device, information identifying that access to the network is granted;
receiving, by the device, information identifying a layer three address of the endpoint device from an external device,
the external device being different than the endpoint device,
the layer three address being assigned from a pool of layer three addresses to the endpoint device after application of the one or more authentication rules, the layer three address being associated with the one or more permissions, and
the layer three address being valid only for a particular amount of time that is determined based on an estimated amount of time layer three access for the endpoint device to the network is needed,
the particular amount of time being different for different endpoint devices associated with other layer three addresses from the pool; and
provisioning, by the device, layer three access for the endpoint device to the network for the particular amount of time based on the layer three address and the one or more permissions,
after the particular amount of time, the endpoint device being denied access to the network.
2. The method of claim 1 , further comprising:
detecting transmissions from the endpoint device; and
determining the layer two identification based on the transmissions.
3. The method of claim 1 , further comprising:
determining a media access control address associated with the endpoint device; and
determining the layer two identification based on the media access control address.
4. The method of claim 1 , where provisioning the layer three access includes:
providing the information identifying the layer three address and information identifying the one or more permissions to a firewall device.
5. The method of claim 1 , where determining the one or more permissions includes:
determining, based on the layer two identification, that a condition, for associating the endpoint device with a role, is satisfied,
the role defining the one or more permissions associated with the endpoint device,
determining to associate the endpoint device with the role based on the condition being satisfied, and
where the method further comprises:
granting the one or more permissions to the endpoint device based on the endpoint device being associated with the role.
6. The method of claim 5 , where determining that the condition is satisfied includes:
determining that the endpoint device includes a particular version of anti-virus software.
7. The method of claim 1 , where determining the one or more permissions includes:
identifying a layer two resource associated with the layer two identification, and
determining the one or more permissions based on the layer two resource being associated with the layer two identification.
8. The method of claim 1 , further comprising:
providing, by the device and to the endpoint device, information identifying a layer two permission based on determining to grant the endpoint device access to the network; and
where receiving the information identifying the layer three address of the endpoint device from the external device is based on providing the information identifying the layer two permission to the endpoint device.
9. The method of claim 1 , where receiving the information identifying the layer three address of the endpoint device from the external device includes:
receiving the information identifying the layer three address from the external device based on a request from the endpoint device to the external device.
10. A device comprising:
one or more computer processors to:
authenticate, based on a layer two identification, an endpoint device seeking access to a network;
determine to grant the endpoint device access to the network based on authenticating the endpoint device;
determine, based on determining to grant the endpoint device access to the network, one or more permissions associated with the endpoint device accessing the network;
provide, to the endpoint device, information identifying that access to the network is granted;
receive, based on providing the information identifying that access to the network is granted, information identifying a layer three address of the endpoint device from an external device,
the external device being different than the endpoint device,
the layer three address being assigned from a pool of layer three addresses to the endpoint device after the endpoint device is authenticated,
the layer three address being associated with the one or more permissions, and
the layer three address being valid only for a particular amount of time that is determined based on an estimated amount of time layer three access for the endpoint device to the network is needed,
the particular amount of time being different for different endpoint devices associated with other layer three addresses from the pool; and
provision layer three access for the endpoint device to the network for the particular amount of time based on the layer three address and the one or more permissions,
after the particular amount of time, the endpoint device being denied access to the network.
11. The device of claim 10 , where the one or more computer processors are further to:
receive, from a sensor device, information detected from data transmitted from the endpoint device,
the sensor device being different from the device; and
determine the layer two identification based on the information received from the sensor device.
12. The device of claim 10 , where the one or more computer processors are further to:
determine a media access control address associated with the endpoint device; and
determine the layer two identification based on the media access control address.
13. The device of claim 10 , where, when provisioning the layer three access, the one or more computer processors are to:
provide the information identifying the layer three address and information identifying the one or more permissions to a firewall device.
14. The device of claim 10 , where, when determining the one or more permissions, the one or more computer processors are to:
determine, based on the layer two identification, that a condition associated with the endpoint device is satisfied, and
where the one or more computer processors are to:
grant the one or more permissions to the endpoint device based on the condition being satisfied.
15. The device of claim 14 , where, when determining that the condition is satisfied, the one or more computer processors are to:
determine that the endpoint device is virus-free.
16. The device of claim 10 , where, when determining the one or more permissions, the one or more computer processors are to:
identify, based on a mapping of layer two resources and layer two identifications, a layer two resource associated with the layer two identification, and
determine the one or more permissions based on the layer two resource.
17. A non-transitory computer-readable medium storing instructions, the instructions comprising:
one or more instructions that, when executed by one or more computer processors of a device, cause the one or more computer processors to:
determine to grant an endpoint device access to a network based on applying one or more authentication rules;
determine, based on determining to grant the endpoint device access to the network, one or more permissions associated with the endpoint device accessing the network;
provide, to the endpoint device, information identifying that access to the network is granted;
receive, based on providing the information identifying that access to the network is granted, information identifying a layer three address of the endpoint device from an external device,
the external device being different than the endpoint device,
the layer three address being assigned from a pool of layer three addresses to the endpoint device after application of the one or more authentication rules,
the layer three address being associated with the one or more permissions, and
the layer three address being valid only for a particular amount of time that is determined based on an estimated amount of time layer three access for the endpoint device to the network is needed,
the particular amount of time being different for different endpoint devices associated with other layer three addresses from the pool; and
cause the endpoint device to be provisioned for layer three access to the network for the particular amount of time based on the layer three address and the one or more permissions,
after the particular amount of time, the endpoint device being denied access to the network.
18. The non-transitory computer-readable medium of claim 17 , where the instructions further comprise:
one or more instructions that, when executed by the one or more computer processors, cause the one or more computer processors to:
determine a media access control address associated with the endpoint device;
determine a vendor associated with the endpoint device based on the media access control address; and
determine a layer two identification based on the vendor associated with the endpoint device; and
where the one or more instructions to determine to grant the endpoint device access to the network include:
one or more instructions that, when executed by the one or more computer processors, cause the one or more computer processors to:
determine to grant the endpoint device access to the network based on the layer two identification.
19. The non-transitory computer-readable medium of claim 18 , where the one or more instructions to determine the one or more permissions include:
one or more instructions that, when executed by the one or more computer processors, cause the one or more computer processors to:
determine, based on the layer two identification, that a condition, for associating the endpoint device with a role, is satisfied,
the role defining the one or more permissions associated with the endpoint device, and
the condition being satisfied when one or more of:
the endpoint device includes a particular version of security software, or
the endpoint device is determined to not have a virus,
determine to associate the endpoint device with the role based on the condition being satisfied, and
determine to grant the one or more permissions to the endpoint device based on the endpoint device being associated with the role.
20. The non-transitory computer-readable medium of claim 18 , where the one or more instructions to determine the one or more permissions include:
one or more instructions that, when executed by the one or more computer processors, cause the one or more computer processors to:
identify a layer two resource associated with the layer two identification, and
determine the one or more permissions based on the layer two resource being associated with the layer two identification.