Forward PPSK Accounting Information to Firewall?

[PeterK]

Hi @all,

is it possible to forward accounting information, like usernames, group-names or profile-names from endsystems authenticating via PPSK, to a Firewall?

I want to match firewall rules based on identities of endsystems.

With 802.1X it is possible via radius accounting. But with PPSK?

[Brent_Addis]

Couple of options:

A) The AP's can send information via syslog. I don't know what FW vendor you are using, however Palo Alto has a syslog listener that can receive this and use a filter to pickup usernames. You can also run the UserID agent on your servers to pickup this data and hold it for the firewall to pick up.

B) Radius accounting. Some firewall vendors (I believe fortinet used to do this, not sure if that's changed) will access radius accounting packets for use in identifying users. https://documentation.extremenetworks.com/XIQC/RADIUS_AUTH_XIQSE/GUID-413668A2-BD89-4FC3-AA7E-941790...