IronWiFi Solutions for Government and Public Sector

Overview

Government agencies and public sector organizations face stringent security requirements for network access, combined with the need to provide public WiFi services in civic buildings, libraries, transit systems, and public spaces. IronWiFi provides cloud RADIUS authentication and captive portal solutions that meet compliance requirements while enabling secure, scalable WiFi deployments.

This guide covers network architecture for government environments, compliance alignment, secure employee WiFi, and public-facing WiFi services.

Government WiFi Challenges

Challenge	Impact	IronWiFi Solution
Security compliance (NIST, FedRAMP)	Must meet framework requirements	Strong authentication, encryption, audit logging
Network separation	Classified and public networks must be isolated	VLAN assignment via RADIUS attributes
Public WiFi demand	Citizens expect WiFi in government buildings	Captive portal with terms of service
Multi-site deployments	Agencies span many buildings and regions	Cloud-based management, regional RADIUS servers
Legacy device support	Older systems may lack modern auth	MAC authentication, flexible EAP methods
Audit and accountability	Every access must be traceable	RADIUS accounting, authentication logs

Network Architecture

Recommended Segmentation

VLAN Strategy

VLAN	Name	Purpose	Authentication	Security Level
100	Employee	Staff accessing internal systems	WPA2/WPA3-Enterprise (EAP-TLS)	High
200	SecureIoT	Building systems, security cameras, OT	MAC auth or certificates	High
300	Public	Citizen WiFi in public areas	Captive portal	Standard
400	Contractor	Third-party access with limited scope	WPA2-Enterprise (PEAP)	Medium
500	Management	Network infrastructure management	WPA3-Enterprise (EAP-TLS only)	Critical

Configure VLAN assignment with RADIUS reply attributes:

See Attributes for the full list of available RADIUS attributes.

Compliance Alignment

NIST 800-53 Controls

IronWiFi helps implement the following NIST 800-53 security controls:

Control Family	Control	IronWiFi Implementation
Access Control (AC)	AC-2: Account Management	User creation, group assignment, account disabling
	AC-3: Access Enforcement	RADIUS authentication with policy-based VLAN assignment
	AC-7: Unsuccessful Logon Attempts	Authentication failure logging and lockout policies
	AC-11: Session Lock	Idle-Timeout attribute disconnects inactive sessions
	AC-12: Session Termination	Session-Timeout attribute enforces maximum session duration
Audit (AU)	AU-2: Audit Events	RADIUS authentication and accounting event logging
	AU-3: Content of Audit Records	Logs include user, timestamp, source IP, MAC, result
	AU-6: Audit Review	Log export for SIEM integration
	AU-9: Protection of Audit Information	Encrypted log storage with access controls
Identification (IA)	IA-2: Identification and Authentication	Unique user credentials (passwords, certificates)
	IA-5: Authenticator Management	Certificate lifecycle, password policies
	IA-8: Identification (Non-Organizational)	Captive portal for public/guest users
System Protection (SC)	SC-8: Transmission Confidentiality	EAP-TLS tunnels, RadSec, HTTPS
	SC-13: Cryptographic Protection	AES-256 encryption, TLS 1.2+

CJIS Security Policy

For law enforcement agencies subject to CJIS requirements:

1. Advanced Authentication -- Use EAP-TLS with client certificates for networks accessing CJIS data
2. Encryption -- WPA2/WPA3-Enterprise with EAP-TLS provides AES encryption on the wireless link
3. Audit -- RADIUS accounting tracks all access to CJIS-scoped networks
4. Session Management -- Configure session timeouts to require periodic re-authentication
5. Personnel Security -- Map network access to personnel through unique user accounts

FedRAMP Considerations

Organizations requiring FedRAMP-compliant services should note:

• IronWiFi operates as a cloud service for RADIUS authentication
• Data processed includes authentication credentials and session metadata
• Evaluate IronWiFi against your agency's FedRAMP requirements
• Contact IronWiFi for current security documentation and compliance status

note

Government agencies should evaluate IronWiFi against their specific compliance framework and obtain necessary approvals from their Authorizing Official before deployment.

Secure Employee WiFi

Certificate-Based Authentication

For the highest security on employee networks, deploy EAP-TLS:

1. Configure SCEP in IronWiFi for certificate issuance
2. Deploy via MDM (Intune, Workspace ONE, or your agency's MDM)
3. Benefits:
   • No passwords to phish or brute-force
   • Device-level authentication
   • Instant revocation when a device is lost or an employee departs
   • Mutual authentication (server and client verified)

See Certificate Lifecycle Management for implementation details.

Integration with Government Identity Providers

Connect IronWiFi to your existing identity systems:

• Azure AD / Entra ID -- SAML authentication for agencies using Microsoft 365 Government
• Okta for Government -- SAML authentication for agencies using Okta
• On-Premises Active Directory -- LDAP connector for agencies with on-premises AD
• PIV/CAC -- Map PIV/CAC certificate identities to IronWiFi user accounts

Configure connectors under Users > Connectors in the IronWiFi Console. See Connectors for setup guides.

Multi-Factor Authentication

Layer additional security on top of WiFi authentication:

1. Certificate + Password -- Require both a device certificate and user credentials
2. IdP-based MFA -- Use your identity provider's MFA for captive portal authentication
3. Time-based restrictions -- Limit authentication to working hours using the

   Login-Time

   attribute

Contractor and Vendor Access

Provide controlled access for third-party contractors:

1. Create a Contractor group in IronWiFi with limited access attributes:

2. Set account validity dates to match the contract period:

   • Navigate to Users > create the contractor user
   • Set Valid From and Valid To dates
   • The account automatically stops working when the contract expires

3. Use Sponsored Access for temporary contractor WiFi -- an employee sponsor approves the request

Public WiFi Services

Citizen WiFi in Government Buildings

Provide free WiFi in libraries, city halls, community centers, and other public buildings:

1. Create a dedicated Network in IronWiFi for public WiFi

2. Configure a Captive Portal with:

   • Accept Terms of Service authentication (no credentials needed)
   • Agency branding (logo, colors)
   • Acceptable use policy
   • Contact information for IT support

3. Apply appropriate limits:

Content Filtering and Acceptable Use

Government-provided public WiFi typically requires content filtering:

1. Assign public WiFi users to a VLAN routed through a content filter
2. Block categories required by agency policy (e.g., CIPA compliance for libraries)
3. Log access for legal compliance
4. Display acceptable use policy on the captive portal

tip

Content filtering is implemented at the network/firewall layer, not by IronWiFi directly. Use IronWiFi VLAN assignment to route public WiFi traffic through your content filtering appliance.

Library WiFi

Libraries have specific requirements under CIPA (Children's Internet Protection Act):

1. Content filtering -- Required for libraries receiving E-Rate funding
2. Privacy -- Minimize data collection (use terms-of-service auth without requiring personal data)
3. Accessibility -- Ensure the captive portal meets accessibility standards (WCAG 2.1)
4. Session management -- Time-limited sessions to ensure fair access to shared resources

Public Transit WiFi

For WiFi on buses, trains, and transit stations:

1. Use IronWiFi's closest regional RADIUS server to minimize latency
2. Configure short session timeouts appropriate for transit durations
3. Apply bandwidth limits to ensure fair sharing across riders
4. Use captive portal with minimal friction (terms of service only)

Multi-Site Government Deployments

Managing Multiple Locations

Government agencies often operate across many buildings and jurisdictions:

1. Single IronWiFi account for centralized management
2. One Network per region for optimal RADIUS latency
3. Consistent policies across all sites via shared groups
4. Site-specific portals with location-appropriate branding

Centralized Policy Management

Apply consistent policies across all government sites:

1. Create groups in IronWiFi that represent policy tiers (Employee, Contractor, Public)
2. Assign the same groups across all Networks
3. RADIUS attributes ensure users receive the same VLAN, bandwidth, and session limits regardless of location

Regional RADIUS Configuration

For agencies with sites across multiple regions:

1. Create Networks in the IronWiFi regions closest to each site
2. Configure access points at each site with the closest Network's RADIUS settings
3. Users authenticate against the nearest RADIUS server for low latency
4. User accounts are global -- the same credentials work at any site

See Networks for region selection guidance.

Building Automation and IoT

Securing Government IoT

Government buildings increasingly rely on IoT devices:

Device Type	Authentication Method	VLAN
Security cameras	MAC authentication	SecureIoT (200)
HVAC controllers	MAC authentication	SecureIoT (200)
Badge readers	Certificate or MAC	SecureIoT (200)
Digital signage	MAC authentication	Public (300)
Environmental sensors	MAC authentication	SecureIoT (200)

Register IoT devices in IronWiFi using MAC authentication:

1. Navigate to Users > Create User
2. Set the username and password to the device's MAC address
3. Add to the appropriate device group
4. The device authenticates automatically when it connects

See Device Management for detailed device registration procedures.

Audit and Reporting

Authentication Audit Trail

Maintain a complete audit trail as required by government compliance frameworks:

1. RADIUS accounting is enabled by default for all IronWiFi Networks
2. Configure the interim interval for periodic session updates:

Reply Attribute: Acct-Interim-Interval := 300

3. Authentication logs capture:
   • Username / identity
   • Source IP and MAC address
   • Timestamp
   • Authentication result (accept/reject)
   • Rejection reason (if applicable)
   • Assigned attributes (VLAN, bandwidth, etc.)

Log Export and SIEM Integration

Export logs for integration with your SIEM or log management platform:

1. Navigate to Logs > Authentication Logs
2. Set the date range for the export
3. Click Export (CSV or JSON format)
4. Import into your SIEM (Splunk, ELK, etc.)

For automated log forwarding, use the IronWiFi API:

Compliance Reporting Checklist

Report	Frequency	Purpose
Authentication activity summary	Monthly	Review access patterns and anomalies
Failed authentication report	Weekly	Detect brute-force or unauthorized access attempts
User account audit	Quarterly	Verify active accounts match current employees
Network segmentation test	Quarterly	Confirm VLAN isolation is effective
Certificate expiration report	Monthly	Prevent authentication outages
Data retention compliance	Annually	Verify logs are retained per policy

Deployment Best Practices

Pre-Deployment

• Obtain approval from the agency's Authorizing Official or CISO
• Complete security assessment of IronWiFi for your compliance framework
• Define network segmentation (VLANs, security zones)
• Select authentication methods for each user population
• Plan certificate deployment strategy for employee devices

Implementation

• Create IronWiFi Networks in the closest regions
• Configure groups with RADIUS attributes for each user tier
• Deploy certificates to managed employee devices via MDM
• Configure captive portal for public WiFi
• Test authentication for all user types
• Verify VLAN isolation with network scans
• Configure audit logging and retention

Ongoing Operations

• Monitor authentication logs for anomalies
• Review and rotate shared secrets quarterly
• Audit user accounts against HR records quarterly
• Export and archive compliance logs monthly
• Test disaster recovery procedures annually
• Renew certificates before expiration

Related Topics

• Networks -- Creating and managing RADIUS networks
• Attributes -- RADIUS attributes for VLAN and bandwidth control
• Groups -- User group policies
• Certificate Lifecycle Management -- Certificate deployment and renewal
• Data Governance and Compliance -- Retention and compliance policies
• Captive Portals -- Public WiFi portal configuration
• Device Management -- IoT and device registration
• Bandwidth Management -- QoS policies for government networks
• Session Management -- Timeouts and concurrent session control
• MSP and Multi-Tenant Guide -- Multi-site management
• Configuration Guides -- AP vendor-specific setup