Applying policies to subnets

1. A method performed by data processing apparatus, the method comprising:

maintaining associations among a plurality of subnets of a network, a plurality of policies, and a plurality of client types, wherein each subnet has an associated client type and an associated policy;

determining, for a particular client device that is not hosted on the network, a client type of the particular client device;

identifying a subnet having an associated client type that matches the determined client type of the particular client device;

hosting the particular client device on the identified subnet;

determining, for the particular client device after the particular client device has been hosted on the subnet, (i) a client type of the particular client device, and (ii) a client type associated with the subnet on which the particular client device is hosted;

ensuring the particular client device is on the correct subnet by comparing, for the particular client device after the particular client device has been hosted on the subnet, (i) the determined client type of the particular client device with (ii) the determined client type associated with the subnet on which the particular client device is hosted; and

responsive to a determination that the client type of the particular client device matches the client type associated with the subnet that hosts the particular client device, applying, to the particular client device, the policy associated with the subnet that hosts the particular client device.

2. The method of claim 1 , wherein maintaining associations among the plurality of subnets of the network, the plurality of policies, and the plurality of client types comprises maintaining associations among the plurality of subnets of the network, the plurality of policies, and the plurality of client types and the plurality of parameters, wherein each client type has an associated parameter; and

wherein determining, for the particular client device, (i) the client type of the particular client device, and (ii) the client type associated with the subnet on which the particular client device is hosted comprises:

passively monitoring network traffic of the client devices;

examining a parameter of the passively monitored network traffic; and

comparing the parameter of the passively monitored network traffic with the associated parameters of the client types of the maintained associations.

3. The method of claim 2 , wherein the parameter of the passively monitored network traffic is a User-Agent header.

4. The method of claim 1 , wherein determining, for the particular client device, (i) the client type of the particular client device, and (ii) the client type associated with the subnet on which the particular client device is hosted comprises:

redirecting at least some network traffic of the client devices to a server on the network;

receiving, at the server on the network, the redirected traffic; and

examining a parameter of the redirected traffic.

5. The method of claim 4 , wherein the parameter of the redirected traffic is a cookie.

6. The method of claim 4 , wherein the server is a transparent proxy configured to transparently route the redirected traffic to the redirected traffic's original destination.

7. The method of claim 1 , wherein:

the network includes a first subnet and a second subnet;

stationary clients are associated with the first subnet;

bring-your-own-device clients are associated with the second subnet; and

a more restrictive policy is associated with the second subnet and a less restrictive policy is associated with the first subnet.

8. The method of claim 1 wherein the data processing apparatus comprises a plurality of hardware devices, each hardware device include a separate processor and memory unit;

wherein a first hardware devices is configured to route traffic to and from the client devices into and out of the network; and

wherein a second hardware device is configured to perform the steps of:

maintaining associations among the plurality of subnets of the network, the plurality of policies, and the plurality of client types, wherein each subnet has an associated client type and an associated policy;

determining, for the particular client device, (i) the client type of the particular client device, and (ii) the client type associated with the subnet on which the particular client device is hosted;

comparing, for the particular client device, (i) the determined client type of the particular client device with (ii) the determined client type associated with the subnet on which the particular client device is hosted; and

responsive to a determination that the client type of the particular client device matches the client type associated with the subnet that hosts the particular client device, applying, to the particular client device, the policy associated with the subnet that hosts the particular client device.

9. A non-transitory computer storage media encoded with computer program instructions that, when executed by one or more processors, cause a computer device to perform operation comprising:

maintaining associations among a plurality of subnets of a network, a plurality of policies, and a plurality of client types, wherein each subnet has an associated client type and an associated policy;

determining, for a particular client device that is not hosted on the network, a client type of the particular client device;

identifying a subnet having an associated client type that matches the determined client type of the particular client device;

hosting the particular client device on the identified subnet;

determining, for the particular client device after the particular client device has been hosted on the subnet, (i) a client type of the particular client device, and (ii) a client type associated with the subnet on which the particular client device is hosted;

ensuring the particular client device is on the correct subnet by comparing, for the particular client device after the particular client device has been hosted on the subnet, (i) the determined client type of the particular client device with (ii) the determined client type associated with the subnet on which the particular client device is hosted; and

responsive to a determination that the client type of the particular client device matches the client type associated with the subnet that hosts the particular client device, applying, to the particular client device, the policy associated with the subnet that hosts the particular client device.

10. The computer storage media of claim 9 , the operations further comprising, responsive to a determination that the client type of the particular client device does not match the client type associated with the subnet that hosts the particular client device, apply a corrective action to the particular client device.

11. The computer storage media of claim 9 , wherein maintaining associations among the plurality of subnets of the network, the plurality of policies, and the plurality of client types comprises maintaining associations among the plurality of subnets of the network, the plurality of policies, and the plurality of client types and the plurality of parameters, wherein each client type has an associated parameter; and

wherein determining, for a particular client device, (i) the client type of the particular client device, and (ii) the client type associated with the subnet on which the particular client device is hosted comprises:

passively monitoring network traffic of the client devices;

examining a parameter of the passively monitored network traffic; and

comparing the parameter of the passively monitored network traffic with the associated parameters of the client types of the maintained associations.

12. The computer storage media of claim 9 , wherein determining, for the particular client device, (i) the client type of the particular client device, and (ii) the client type associated with the subnet on which the particular client device is hosted comprises:

redirecting at least some network traffic of the client devices to a server on the network;

receiving, at the server on the network, the redirected traffic; and

examining a parameter of the redirected traffic.

13. The computer storage media of claim 12 , wherein the server is a transparent proxy configured to transparently route the redirected traffic to the redirected traffic's original destination.

14. A system comprising:

one or more processors configured to execute computer program instructions; and

computer storage media encoded with computer program instructions that, when executed by one or more processors, cause a computer device to perform operation comprising:

maintaining associations among a plurality of subnets of a network, a plurality of policies, and a plurality of client types, wherein each subnet has an associated client type and an associated policy;

determining, for a particular client device that is not hosted on the network, a client type of the particular client device;

identifying a subnet having an associated client type that matches the determined client type of the particular client device;

hosting the particular client device on the identified subnet;

determining, for the particular client device after the particular client device has been hosted on the subnet, (i) a client type of the particular client device, and (ii) a client type associated with the subnet on which the particular client device is hosted;

ensuring the particular client device is on the correct subnet by comparing, for the particular client device after the particular client device has been hosted on the subnet, (i) the determined client type of the particular client device with (ii) the determined client type associated with the subnet on which the particular client device is hosted; and

responsive to a determination that the client type of the particular client device matches the client type associated with the subnet that hosts the particular client device, applying, to the particular client device, the policy associated with the subnet that hosts the particular client device.

15. The system of claim 14 , the operations further comprising, responsive to a determination that the client type of the particular client device does not match the client type associated with the subnet that hosts the particular client device, apply a corrective action to the particular client device.

16. The system of claim 14 , wherein maintaining associations among the plurality of subnets of the network, the plurality of policies, and the plurality of client types comprises maintaining associations among the plurality of subnets of the network, the plurality of policies, and the plurality of client types and the plurality of parameters, wherein each client type has an associated parameter; and

wherein determining, for the particular client device, (i) the client type of the particular client device, and (ii) the client type associated with the subnet on which the particular client device is hosted comprises:

passively monitoring network traffic of the client devices;

examining a parameter of the passively monitored network traffic; and

comparing the parameter of the passively monitored network traffic with the associated parameters of the client types of the maintained associations.

17. The system of claim 14 , wherein determining, for the particular client device, (i) the client type of the particular client device, and (ii) the client type associated with the subnet on which the particular client device is hosted comprises:

redirecting at least some network traffic of the client devices to a server on the network;

receiving, at the server on the network, the redirected traffic; and

examining a parameter of the redirected traffic.

18. The system of claim 17 , wherein the server is a transparent proxy configured to transparently route the redirected traffic to the redirected traffic's original destination.