Patent ID: 8239929

Claim:
A network access device comprising: a memory for storing data packets received on a plurality of input ports; and control logic adapted to: examine a first data packet stored in the memory, the first data packet comprising: a first physical address identifying a user device coupled to one of the plurality of input ports; and a second physical address identifying a destination device to which a user of the user device is requesting access, for sending one or more data packets to the destination device via the network access device; authenticate the first physical address; if the authentication of the first physical address indicates the first physical address is valid, request one or more user credentials from a user of the user device; and authenticate the one or more user credentials provided by the user in a second data packet in response to the request, the second data unit comprising the first physical address and the second physical address; if the authentication of the one or more user credentials indicates the one or more user credentials are valid, dynamically assign the user policy to the one of the plurality of input ports; and restrict further traffic on the one of the plurality of input ports in accordance with the user policy; and if the authentication of the first physical address indicates the first physical address is invalid, block traffic on the one of the plurality of ports except for packets related to a user authentication protocol.