Device information method and apparatus for directing link-layer communication

A method comprising:

• obtaining, by a network device and in response to receiving a request for a device to access a computer network, machine-specific information relating to the device, wherein the request comprise an initial packet of a session for the device, and wherein the initial packet comprises a header for routing the initial packet to a destination address specified within header;
• selecting, by the network device and based on one or more features of the machine-specific information, a group routing policy for the device from a plurality of group routing policies;
• assigning, by the network device based on the group routing policy, one or more routes for which the device is permitted access within the computer network;
• and
• sending, by the network device, a modified packet comprising the header of the initial packet,
• wherein sending the modified packet comprises constructing the modified packet to include metadata inserted after the header and prior to an end of the initial packet, and wherein the metadata of the modified packet comprises:
• (i) a first portion of metadata specifying a session identifier for the session associated with the packet, and
• (ii) a second portion of metadata specifying information that controls forwarding of the modified packet and subsequent packets of the session by network devices of the computer network along the one or more routes on which the device is permitted access within the computer network, wherein the information specified by the second portion of metadata comprises tenant information associated with an organizational unit to which the device belongs.

A non-transitory computer-readable medium comprising instructions, that when executed by one or more processors of a network device, cause the one or more processors to:

• obtain, in response to receiving a request for a device to access a computer network, machine-specific information relating to the device, wherein the request comprise an initial packet of a session for the device, and wherein the initial packet comprises a header for routing the initial packet to a destination address specified within header;
• select, based on one or more features of the machine-specific information, a group routing policy for the device from a plurality of group routing policies;
• assign, based on the group routing policy, one or more routes for which the device is permitted access within the computer network;
• and
• send a modified packet comprising the header of the initial packet,
• wherein the instructions cause the one or more processors to construct the modified packet to include metadata inserted after the header and prior to an end of the initial packet, and wherein the metadata of the modified packet comprises:
• (i) a first portion of metadata specifying a session identifier for the session associated with the packet, and
• (ii) a second portion of metadata specifying information that controls forwarding of the modified packet and subsequent packets of the session by network devices of the computer network along the one or more routes on which the device is permitted access within the computer network, wherein the information specified by the second portion of metadata comprises tenant information associated with an organizational unit to which the device belongs.