Jaze Access Manager
The firewall learns who is behind the address.
RADIUS Single Sign-On hands each logon from Jaze Access Manager to the firewall, so its rules and its logs carry the user rather than an IP.
End User Device
Userjohn
WLAN
SSIDjaze-campus
SecurityWPA2 · 802.1X
Jaze Access Manager
Firewall
How it works
From logon to a NAT record with a name.
Five steps between a laptop joining the Wi-Fi and the firewall writing its user's name into its logs.
Authenticated
The laptop joins the WLAN, which sends an Access-Request to Jaze Access Manager and gets an Access-Accept back.
Online
The laptop comes online and is given its IP address.
Accounting sent
The WLAN sends an accounting packet for the session to Jaze Access Manager.
Forwarded over RSSO
Jaze Access Manager forwards the accounting packet to the firewall over RADIUS Single Sign-On, with the user, their group and their IP.
Recognised and logged
The firewall recognises the IP by the user's campus group, and its logs and NAT records carry the username.
What the firewall gets
Rules and logs by user, not by address.
Policy at the gateway
Rules that name the user.
- Gateway policies applied by user identity
- And by the group the user belongs to
- In force as soon as the user logs on
NAT logs with a name
Every record says who it was.
- The username written into each NAT log record
- No matching addresses to people by hand
Put names in your firewall logs.
A walkthrough of RSSO against your firewall and the policies you enforce at the gateway.