Abstract: An example profiler device includes one or more processors implemented in circuitry and configured to monitor network traffic entering and exiting the protected network zone; identify one or more endpoints that interface with the protected network zone; compare network traffic characteristics of network traffic associated with the endpoints to network traffic characteristics of known device types to determine device types corresponding to the endpoints; assign one or more network policies to the identified endpoints according to the determined device types; and distribute data representing the assigned network policies to a policy enforcement point (PEP) device to cause the PEP device to enforce the network policies on network traffic, associated with the identified endpoints, entering and exiting the protected network zone.

Abstract: A network access control (NAC) device enforces one or more policies for accessing one or more remote network devices. The NAC device includes a processor configured to receive authentication credentials from the user device over an L2 connection including first identification information of the user device, authenticate the user device using the authentication credentials, receive compliance information from the user device over an L3 connection including second identification information of the user device, associate the L2 connection with the L3 connection using the first identification information and the second identification information, and in response to determining that the compliance information satisfies the one or more policies, authorize the user device to access the one or more remote network devices.