Every brokered session is the result of an explicit grant — not network membership. This guide explains how Ixiea evaluates who can reach what, through which protocol, for how long.
Subject
IdP identity
Grant
Session-scoped
Target
Named asset
Account
Brokered
Window
JIT · standing
No grant, no connection. Evaluated at the gateway, not the subnet.
Authorization in Ixiea is session-scoped. A grant binds an identity (or group) to a target asset, optional account mapping, allowed protocols, and optional time window. Network firewalls may still exist, but the meaningful decision happens at the gateway: without a valid grant, the connection never starts.
Network ACL
Subnet reachability only
Session grant
Identity + target + protocol + window
No grant → connection never starts
Grant dimensions
All five must align at connect time
Subject — the user, service account, or vendor identity from your IdP. Target — the host, database, cluster, or application endpoint. Account — the local or federated account used on the target (often injected, never shown). Protocol — SSH, RDP, SQL, or Kubernetes exec. Window — standing entitlement, JIT elevation, or scheduled maintenance slot. All five must align at connect time.
Grants attach to IdP groups for scale — SRE, DBA, vendor-support — with optional per-user exceptions. Break-glass grants carry shorter TTLs, mandatory approvers, and enhanced recording. Deny rules take precedence: a explicit block on a target or command surface wins over broader allow policies.
IdP groups
Deny wins
block prod-db · DROP override
Break-glass grant
Shorter TTL · extra approvers · enhanced recording
Policy engine
Logged with policy v12 · approver id
When an operator initiates a session, the policy engine loads the grant, verifies the operator is authenticated (including MFA when policy requires it), checks approval status for JIT requests, and resolves secrets from your vault integration. The decision is logged with policy version and approver identity — producing evidence that auditors can reconcile without inferring intent from syslog.
Operational docs
Related guides
Ixiea control plane: core API, protocol connectors, recording pipeline, and audit store.
Standalone, active/standby, horizontal scale, and multi-region gateway, when each fits.
Fifteen-minute path from install to a brokered, recorded, identity-bound session.
Graduated enforcement for commands and connections, permit, block, approve, mask, or alert at the gateway.
Ready to evaluate?
Walk through gateway brokering, recording, and audit exports in a working session — or browse the illustrated product flow first.
