Accessing a policy server from multiple layer two networks

A network device comprising:

• an address store configured to store a plurality of layer three (L3) network addresses, wherein each of the plurality of L3 network addresses provides a destination address of the network device for use as the destination address of the network device when communicating with the network device, and wherein each of the plurality of L3 network addresses is associated with one or more of a plurality of layer two (L2) networks;
• a negotiation module configured to receive a request to initiate a communication session from an endpoint device, in response to receiving the request from the endpoint device, to authenticate and authorize the endpoint device, to select, after authenticating and authorizing the endpoint device, an L2 network from among the plurality of L2 networks to which to assign the endpoint device, to send a communication to an access device to assign the endpoint device to the selected L2 network, to select one of the plurality of L3 network addresses as the destination address for the network device based on which one of the plurality of the L2 networks the endpoint device is assigned, and to send a communication in accordance with an Authentication, Authorization, and Accounting (AAA) protocol that includes a message as an attribute of the communication, wherein the message identifies the selected L3 address to the endpoint device;
• a monitoring module configured to monitor activities of the endpoint device, wherein the monitoring module is configured to receive configuration information and activity information from the endpoint device sent to the selected L3 network address, to monitor the configuration information and the activity information of the endpoint device for the duration of the communication session, and to modify access privileges of the endpoint device after determining that a policy for the endpoint device has changed or that the endpoint device violates the policy for the endpoint device;
• and
• a plurality of L2 network interfaces, wherein each of the L2 network interfaces is associated with at least one of the L2 networks.

A non-transitory computer-readable medium comprising instructions for causing a programmable processor of a policy server to:

• maintain a plurality of layer three (L3) network addresses, wherein each of the plurality of L3 network addresses provides a destination address of the policy server for use as the destination address of the policy server when communicating with the policy server, and wherein each of the plurality of L3 network addresses is associated with one or more of a plurality of virtual local area networks (VLANs);
• receive a request to initiate a communication session from an endpoint device;
• in response to receiving the request from the endpoint device, authenticate and authorize the endpoint device;
• after authenticating and authorizing the endpoint device, select one of the plurality of VLANs to which to assign the endpoint device;
• send a communication to an access device to assign the endpoint device to the selected VLAN;
• select one of the plurality of L3 addresses as the destination address of the policy server based on which one of the plurality of the VLANs the endpoint device is assigned;
• send a communication in accordance with an Authentication, Authorization, and Accounting (AAA) protocol that includes a message as an attribute of the communication, wherein the message identifies the selected L3 address to the endpoint device;
• receive configuration information and activity information from the endpoint device sent to the selected L3 network address;
• monitor the configuration information and the activity information of the endpoint device for the duration of the communication session;
• and
• after determining that a policy for the endpoint device has changed or that the endpoint device violates the policy for the endpoint device, modify access privileges of the endpoint device.