Enterprise mobility management and network micro-segmentation

1. A non-transitory computer-readable medium embodying at least one program executable in at least one gateway computing device, the at least one program, when executed by the at least one gateway computing device, being configured to cause the at least one gateway computing device to at least:

divide an internal network into a plurality of virtual network segments, wherein the plurality of virtual network segments comprise different configurations of network resources;

receive network traffic from a client device through a virtual private network (VPN) tunnel of an external network, wherein the at least one gateway computing device is coupled to the external network and the internal network;

determine at least one device management attribute associated with the client device, wherein the at least one device management attribute is provided to the gateway computing device by a management application executed by the client device;

embed, by the at least one gateway computing device, the at least one device management attribute in a header of a packet comprising the network traffic;

determine a particular virtual network segment of the plurality of virtual network segments based at least in part on the at least one device management attribute; and

forward the packet comprising the network traffic to the particular virtual network segment, wherein a network device in the internal network receives the packet and evaluates the at least one device management attribute in the header of the packet in order to forward the packet within the internal network.

2. The non-transitory computer-readable medium of claim 1 , wherein when executed to determine the particular virtual network segment of the plurality of virtual network segments based at least in part on the at least one device management attribute further comprises evaluating a compliance status of the client device by applying at least one compliance rule to the at least one device management attribute.

3. The non-transitory computer-readable medium of claim 1 , wherein the VPN tunnel is associated with a single client application executed by the client device.

4. The non-transitory computer-readable medium of claim 1 , wherein the at least one device management attribute includes a jailbreak status of the client device.

5. The non-transitory computer-readable medium of claim 1 , wherein the at least one device management attribute includes a location of the client device.

6. The non-transitory computer-readable medium of claim 1 , wherein the at least one device management attribute includes an identifier of a client application executed by the client device.

7. The non-transitory computer-readable medium of claim 1 , wherein when executed the at least one program further causes the at least one gateway computing device to at least:

receive additional network traffic from the client device through the VPN tunnel;

determine at least one updated device management attribute associated with the client device in response to receiving the additional network traffic;

determine a different virtual network segment of the plurality of virtual network segments based at least in part on the at least one updated device management attribute; and

forward the network traffic to the different virtual network segment.

8. A system, comprising:

at least one gateway computing device; and

a gateway executable by the at least one gateway computing device, the gateway configured to cause the at least one gateway computing device to at least:

divide an internal network into a plurality of virtual network segments, wherein the plurality of virtual network segments comprise different configurations of network resources;

receive network traffic from a client device through a virtual private network (VPN) tunnel of an external network, wherein the at least one gateway computing device is coupled to the external network and the internal network;

determine at least one device management attribute associated with the client device, wherein the at least one device management attribute is provided to the gateway computing device by a management application executed by the client device;

embed, by the at least one gateway computing device, the at least one device management attribute in a header of a packet comprising the network traffic;

determine a particular virtual network segment of the plurality of virtual network segments based at least in part on the at least one device management attribute; and

forward the packet comprising the network traffic to the particular virtual network segment, wherein a network device in the internal network receives the packet and evaluates the at least one device management attribute in the header of the packet in order to forward the packet within the internal network.

9. The system of claim 8 , wherein the network traffic is associated with a destination network resource that is unreachable through the particular virtual network segment.

10. The system of claim 8 , wherein the at least one device management attribute includes a jailbreak status of the client device.

11. The system of claim 8 , wherein the at least one device management attribute includes at least one of: a user identifier or an identifier of the client device.

12. The system of claim 8 , wherein the at least one device management attribute includes a location of the client device.

13. The system of claim 8 , wherein when executed the gateway is further configured to cause the at least one gateway computing device to at least determine a port address associated with the particular virtual network segment, wherein the network traffic is forwarded to the particular virtual network segment using the port address as a source port address.

14. The system of claim 8 , wherein when executed the gateway is further configured to cause the at least one gateway computing device to at least determine an internet protocol (IP) address associated with the particular virtual network segment, wherein the network traffic is forwarded to the particular virtual network segment using the IP address as a source IP address.

15. A method for forwarding network traffic using a gateway device, the method comprising:

dividing an internal network into a plurality of virtual network segments, wherein the plurality of virtual network segments comprise different configurations of network resources;

receiving network traffic from a client device through a virtual private network (VPN) tunnel of an external network, wherein the gateway computing device is coupled to the external network and the internal network;

determining at least one device management attribute associated with the client device, wherein the at least one device management attribute is provided to the gateway computing device by a management application executed by the client device;

embedding, by the gateway computing device, the at least one device management attribute in a header of a packet comprising the network traffic;

determining a particular virtual network segment of the plurality of virtual network segments based at least in part on the at least one device management attribute; and

forwarding the packet comprising the network traffic to the particular virtual network segment, wherein a network device in the internal network receives the packet and evaluates the at least one device management attribute in the header of the packet in order to forward the packet within the internal network.

16. The method of claim 15 , wherein the at least one device management attribute includes a user identifier associated with the client device.

17. The method of claim 15 , wherein the at least one device management attribute includes an identifier of an operating system of the client device.

18. The method of claim 15 , wherein the at least one device management attribute includes a jailbreak status of the client device.

19. The method of claim 15 , further comprising determining a port address associated with the particular virtual network segment, wherein the network traffic is forwarded to the particular virtual network segment using the port address as a source port address.

20. The method of claim 15 , further comprising determining an internet protocol (IP) address associated with the particular virtual network segment, wherein the network traffic is forwarded to the particular virtual network segment using the IP address as a source IP address.