Agentless security services

1. A computing apparatus, comprising:

a hardware platform comprising a processor, a memory, and a network interface; and

instructions encoded within the memory to instruct the processor to:

push instructions to a home gateway to map a plurality of endpoint devices to a plurality of mutually-exclusive source ports;

receive an incoming packet via the network interface;

extract from the incoming packet a source port and a source internet protocol (IP) address;

correlate the source port and source IP to a device identifier (ID) based on one of the mutually-exclusive source ports;

receive from a cloud service a network policy for the device ID based on one of the mutually-exclusive source ports; and

apply the network policy to the incoming packet.

2. The computing apparatus of claim 1 , wherein the instructions are further to:

receive an enumeration of a plurality of devices connected to a local network;

assign device identifiers to the plurality of devices; and

assign mutually-exclusive source port ranges to the plurality of devices.

3. The computing apparatus of claim 2 , wherein the device identifiers include media access control (MAC) addresses of the plurality of devices.

4. The computing apparatus of claim 2 , wherein the device identifiers include hashes of media access control (MAC) addresses of the plurality of devices.

5. The computing apparatus of claim 1 , wherein the instructions are further to:

inspect a destination port of the incoming packet;

correlate the destination port to a non-standard domain name system (DNS) query port; and

apply a device policy to the incoming packet according to the non-standard DNS query port.

6. The computing apparatus of claim 1 , wherein pushing translation instructions comprises operating a TR69 interface.

7. The computing apparatus of claim 1 , wherein pushing translation instructions comprises pushing out text configuration instructions for a network address translation (NAT) engine.

8. The computing apparatus of claim 1 , wherein the instructions are further to push translation instructions to a home gateway with instructions to map DNS queries to a non-standard destination port.

9. The computing apparatus of claim 1 , wherein the instructions are further to push translation instructions to a home gateway with instructions to map DNS queries to device-specific non-standard destination ports for a plurality of LAN-connected devices.

10. One or more tangible, non-transitory computer-readable storage media having stored thereon executable instructions to:

receive an incoming network packet;

inspect the incoming network packet to determine a source or destination port;

correlate the source or destination port to a subscriber identification (ID), comprising querying a list of mutually-exclusive port assignments, wherein the mutually-exclusive port assignments correlate to the subscriber ID;

receive from a cloud service a policy according to the subscriber ID; and

apply the policy to the incoming network packet.

11. The one or more tangible, non-transitory computer-readable media of claim 10 , wherein the instructions are further to correlate the source or destination port to a particular device or class of devices enumerated on a network of the subscriber ID.

12. The one or more tangible, non-transitory computer-readable media of claim 10 , wherein the incoming network packet comprises a domain name system (DNS) query, and wherein the source or destination port is a destination port other than 53.

13. The one or more tangible, non-transitory computer-readable media of claim 10 , wherein the source or destination port is a source port, and wherein the instructions are further to correlate the source port to a source port range assigned to a device enumerated on a network of the subscriber ID.

14. The one or more tangible, non-transitory computer-readable media of claim 10 , wherein the instructions are further to:

receive an enumeration of a plurality of devices connected to a local network;

assign device identifiers to the plurality of devices; and

assign mutually-exclusive source port ranges to the plurality of devices.

15. A computer-implemented method, comprising:

extracting from a network packet a source internet protocol (IP) address and a port number;

correlating the source IP address to a subscriber identification (ID) for a subscriber to a cloud-based security service;

correlating the port number to a device or group of devices enumerated on a home network of the subscriber, wherein a plurality of devices or groups of devices are assigned mutually-exclusive source port ranges;

receiving a network security policy according to the device or group of devices; and

applying the network security policy to the network packet.

16. The computer-implemented method of claim 15 , further comprising correlating a source or destination port to a particular device or class of devices enumerated on a network of the subscriber ID.

17. The computer-implemented method of claim 16 , wherein the network packet comprises a domain name system (DNS) query, and wherein the source or destination port is a destination port other than 53.

18. The computer-implemented method of claim 16 , wherein the source or destination port is a source port, further comprising correlating the source port to a source port range assigned to a device enumerated on a network of the subscriber ID.

19. The method of claim 15 , further comprising:

receiving an enumeration of a plurality of devices connected to a local network;

assigning device identifiers to the plurality of devices; and

assigning mutually-exclusive source port ranges to the plurality of devices.