A method in an Internet Protocol, IP, based router in a network, the method comprising: receiving, at the router in a message from a link authentication device, an authenticated client identifier and a corresponding authenticated Media Access Control, MAC, address for a client device attached to the network based on the authenticated MAC address, the link authentication device having established with the client device a link having the corresponding authenticated MAC address, the authenticated MAC address based on link layer authentication of a MAC address used by the client device relative to the authenticated client identifier and according to a prescribed link layer authentication protocol to authenticate use of the MAC address by the client device and to prevent spoofing of the authenticated MAC address; creating, by the router, a cache entry in the router specifying the authenticated client identifier and the corresponding authenticated MAC address; receiving, by the router, a message originated by the client device and that specifies the authenticated MAC address and a source IP address, the router implemented as a default gateway for enabling the client device to access the network, wherein any packet output by a given client device and having a corresponding MAC address that has not been authenticated for use by the given client device is contained from access to the network; the router responding to receiving the message originated by the client device by adding the source IP address to the cache entry specifying the authenticated MAC address based on parsing the message; and the router responding to adding the source IP address to the cache entry by outputting to an audit resource a record that specifies the source IP address and the authenticated MAC address. receiving, at the router in a message from a link authentication device, an authenticated client identifier and a corresponding authenticated Media Access Control, MAC, address for a client device attached to the network based on the authenticated MAC address, the link authentication device having established with the client device a link having the corresponding authenticated MAC address, the authenticated MAC address based on link layer authentication of a MAC address used by the client device relative to the authenticated client identifier and according to a prescribed link layer authentication protocol to authenticate use of the MAC address by the client device and to prevent spoofing of the authenticated MAC address; creating, by the router, a cache entry in the router specifying the authenticated client identifier and the corresponding authenticated MAC address; receiving, by the router, a message originated by the client device and that specifies the authenticated MAC address and a source IP address, the router implemented as a default gateway for enabling the client device to access the network, wherein any packet output by a given client device and having a corresponding MAC address that has not been authenticated for use by the given client device is contained from access to the network; the router responding to receiving the message originated by the client device by adding the source IP address to the cache entry specifying the authenticated MAC address based on parsing the message; and the router responding to adding the source IP address to the cache entry by outputting to an audit resource a record that specifies the source IP address and the authenticated MAC address.