Guys, calm down! This has been applied for ages and it's networking 101. Heck, it's the freaking 'hello world' :-) And actually a user can tag his packets, but

Guys, calm down! This has been applied for ages and it's networking 101. Heck, it's the freaking 'hello world' :-) And actually a user can tag his packets, but the security is applied at the switch level, where you can just strip it and add yours. Too bad that means it is not per user, but per switch port... although you may leverage 802.1x... ok, this is getting complex :-) Easier: Block all outgoing traffic, except for an authenticated proxy where every user/app has to go through in order to reach the internet.