Logical network abstraction for network access control

A network access control (NAC) device comprising:

• a processing resource;
• and
• a non-transitory computer-readable medium, coupled to the processing resource, having stored therein instructions that when executed by the processing resource cause the processing resource to:
• decouple a plurality of access policies from underlying implementation details of a plurality of access points associated with a private network by:
• maintaining an access point model that maps a plurality of logical networks to a corresponding enforcement action implementation for each of the plurality of access points, wherein each logical network of the plurality of logical networks represents an abstraction that facilitates a process of creating one or more of the plurality of access policies without requiring knowledge of the underlying implementation details of the plurality of access points that are encapsulated within the access point model;
• and
• representing the plurality of access policies in a form of a current state of a particular endpoint device and an enforcement action specified with reference to a logical network of the plurality of logical networks;
• responsive to an event relating to an endpoint device connected to an access point of the plurality of access points, receive one or more attributes of the endpoint device;
• identify a matching access policy of the plurality of access policies based on the one or more attributes of the endpoint device;
• retrieve the corresponding enforcement action implementation for the access point from the access point model based on the logical network specified in the matching access policy;
• and
• reconfigure the access point to perform the enforcement action based on the retrieved corresponding enforcement action implementation.

A non-transitory computer-readable storage medium embodying a set of instructions, which when executed by one or more processors of a network access control (NAC) device protecting a private network, causes the one or more processors to perform a method comprising:

• decoupling a plurality of access policies from underlying implementation details of a plurality of access points associated with the private network by:
• maintaining an access point model that maps a plurality of logical networks to a corresponding enforcement action implementation for each of the plurality of access points, wherein each logical network of the plurality of logical networks represents an abstraction that facilitates a process of creating one or more of the plurality of access policies without requiring knowledge of the underlying implementation details of the plurality of access points that are encapsulated within the access point model;
• and
• representing the plurality of access policies in a form of a current state of a particular endpoint device and an enforcement action specified with reference to a logical network of the plurality of logical networks;
• responsive to an event relating to an endpoint device connected to an access point of the plurality of access points, receiving one or more attributes of the endpoint device;
• identifying a matching access policy of the plurality of access policies based on the one or more attributes of the endpoint device;
• retrieving the corresponding enforcement action implementation for the access point from the access point model based on the logical network specified in the matching access policy;
• and
• reconfiguring the access point to perform the enforcement action based on the retrieved corresponding enforcement action implementation.