Patent ID: 8189600

Claim:
A method, comprising: in a network configured to support a plurality of virtual local area networks (VLANs) to provide access to at least a set of unprotected resources and a set of protected resources, wherein the set of unprotected resources includes an authentication service for accessing the set of protected resources: granting access to the set of protected resources to a user device having a VLAN Internet Protocol (IP) address for accessing the set of unprotected resources, without rendering the user device unreachable from the network, without changing the VLAN IP address of the user device, and without using network address translation (NAT), wherein the VLAN IP address comprises an IP address on a VLAN, and wherein the granting access to the set of protected resources comprises: prior to authenticating the user device by the authentication service: assigning a uni-directional downstream VLAN to a first switch port of a network device for communicating downstream network traffic to the user device; and assigning a uni-directional authentication upstream VLAN to the first switch port of the network device for communicating upstream network traffic from the user device, wherein the uni-directional authentication upstream VLAN is configured to provide access to the set of unprotected resources; and upon successful authentication of the user device by the authentication service via the uni-directional downstream VLAN and the uni-directional authentication upstream VLAN, changing from the uni-directional authentication upstream VLAN to a uni-directional access upstream VLAN on the first switch port of the network device, while maintaining the uni-directional downstream VLAN on the first switch port of the network device, wherein the uni-directional access upstream VLAN is configured to provide access to the set of protected resources; wherein the uni-directional downstream VLAN, the uni-directional authentication upstream VLAN, and the uni-directional access upstream VLAN are associated with separate Virtual Private Network (VPN) connections that send network traffic in only one direction.