Network Management

We want to be able to keep history of our user flow data (example: datapath session table or NAT address traslation table) from our guest network.  Does anyone know a way of doing this?

Scenario: we have our guest network interface setup with "ip nat inside" on the controller which NATs all guest traffic from the controller's interface. Seurity team picks up malware signatures on the edge but all they see on the source IP is the controller's interface IP.  They want to be able to match destination traffic to the internal source behind the controller's NAT.

Any help would be appreciated.

Thank you

Airwave captures this information really well. Other than that you could setup a syslog server and send the controller logs to it, this might show you the IP to user mapping. This is probably worth investigating if Airwave isn't an option.

Thank you for the reply jrwhitehead.  Airwave is an option.  Could you please point me to how I would set this up on the controller and where in Airwave this infromation would be?

Details of adding a controller to Airwave will be in the Airwave userguide.

As for where to look on Airwave there are probably many places but the AppRF (destinations) dashboard is a good place to start....

Cheers

James