Abstract: In general, techniques are described for providing an isolation virtual local area network (VLAN) for layer two access networks. A server comprising an interface and a control unit may implement the techniques. The interface receives a message that initiates a request for a layer three (L3) network address for use by a client device via an isolation virtual local area network (VLAN) that supports transmitting data from a network device to the server, where the network device is intermediately positioned between the client device and the server. The message includes a layer two (L2) address associated with the client device. The control unit determines whether to allow the client device to access the network and assigns the L3 network address to the client device based on the determination.