Autonomous policy enforcement point configuration for role based access control

A profiler device comprising one or more processors implemented in circuitry and configured to:

• monitor network traffic passing through network access controller (NAC) to enter and exit a protected network zone;
• generate a database including known network traffic characteristics corresponding to identified endpoint of the protected network zone and known device types of the identified endpoints;
• while monitoring the network traffic, detect an access request to the protected network zone;
• determine first endpoint-identifying information from the monitored network traffic including the detected access request, the determined endpoint-identifying information including one or more of a source media access control (MAC) address, a destination MAC, a communication protocol, an authentication protocol, or a Network Basic Input/output System (NetBIOS) address;
• in response to the first endpoint-identifying information not being associated with previously determined endpoint-identifying information of the identified endpoint devices, determine that either a source device or a destination device of the monitored network traffic including the detected access request is a previously undetected endpoint;
• compare first network traffic characteristics of the monitored network traffic including the detected access request to the known network traffic characteristics of the database;
• responsive to the first network traffic characteristics matching first known network traffic characteristics of the known network traffic characteristics, determine a device type of the previously undetected endpoint device is a first known device type of a first identified device corresponding to the first known network traffic characteristics;
• assign a network policy to the previously undetected endpoint device according to the determined device type;
• and
• distribute to the NAC data representing the assigned network policy to a policy enforcement point (PEP) device to cause the PEP device to enforce the network policy on the network traffic flowing to and from the previously undetected endpoint device.

A non-transitory computer-readable storage medium comprising instructions that, when executed, cause a processor to:

• monitor network traffic passing through network access controller (NAC) to enter and exit a protected network zone;
• generate a database including known network traffic characteristics corresponding to identified endpoint of the protected network zone and known device types of the identified endpoints;
• while monitoring the network traffic, detect an access request to the protected network zone;
• determine first endpoint-identifying information from the monitored network traffic including the detected access request, the determined endpoint-identifying information including one or more of a source media access control (MAC) address, a destination MAC, a communication protocol, an authentication protocol, or a Network Basic Input/output System (NetBIOS) address;
• in response to the first endpoint-identifying information not being associated with previously determined endpoint-identifying information of the identified endpoint devices, determine that either a source device or a destination device of the monitored network traffic including the detected access request is a previously undetected endpoint;
• compare first network traffic characteristics of the monitored network traffic including the detected access request to the known network traffic characteristics of the database;
• responsive to the first network traffic characteristics matching first known network traffic characteristics of the known network traffic characteristics, determine a device type of the previously undetected endpoint device is a first known device type of a first identified device corresponding to the first known network traffic characteristics;
• assign a network policy to the previously undetected endpoint device according to the determined device type;
• and
• distribute to the NAC data representing the assigned network policy to a policy enforcement point (PEP) device to cause the PEP device to enforce the network policy on the network traffic flowing to and from the previously undetected endpoint device.