Patent ID: 8627447

Claim:
A method comprising: receiving, by a device, a request for providing an endpoint access to a network; applying, by the device, one or more authentication rules to the endpoint seeking access to the network based on a layer two identification of the endpoint; determining, by the device, to grant the endpoint access to the network based on applying the one or more authentication rules; determining, by the device, a role to be afforded to the endpoint based on granting the endpoint access to the network, the role defining one or more permissions granted to the endpoint, the one or more permissions being associated with the endpoint accessing the network; sending, by the device, a response to the request, the response including information identifying the one or more permissions granted to the endpoint; receiving, by the device and based on sending the response, information identifying a layer three address of the endpoint from an external device, the external device being different than the endpoint, the external device assign the layer three address being assigned, from a pool of layer three addresses, to the endpoint after application of the one or more authentication rules, the layer three address being associated with the one or more permissions, the layer three address being valid only for a particular amount of time, the particular amount of time being assigned based on an estimated amount of time layer three access for the endpoint to the network is needed, the endpoint having the layer three access to the network for the particular amount of time, and after the particular amount of time, the endpoint being denied the layer three access to the network; and provisioning, by the device, the layer three access for the endpoint to the network based on the determined layer three address and the one or more permissions.