1. A system, comprising: an interface configured to: receive a first identity notification from a network device at a first time, and receive a second identity notification from the network device at a second time that is after the first time, wherein the first and second identity notifications are different; a processor configured to: determine, in response to the receipt of the second identity notification from the network device, that an IP address associated with the network device has changed from a first IP address to a second IP address; update a mapping between an identifier associated with the device and the first IP address to a mapping between the identifier and the second IP address; and in response to a notification that a mapping between the identifier associated with the device and an IP address has been updated, update a policy using the updated mapping; and enforce the updated policy; and a memory coupled to the processor and configured to provide the processor with instructions.