The case for Packetfense

For use in Canadian Sovereign public institutions

What PacketFence Provides

PacketFence is an open-source network access control (NAC) platform that delivers enterprise-grade access management without commercial licensing lock-in. It provides full lifecycle management of wired, wireless, and VPN network access through 802.1X authentication, captive portals, MAC-authentication, and device profiling.

It integrates with RADIUS and directory back-ends (LDAP, AD), enforces VLAN-based or inline network segmentation, and can isolate non-compliant devices for remediation. PacketFence’s captive-portal design simplifies onboarding for BYOD, guests, and institutional devices, while its flexible architecture supports multi-site, multi-tenant deployments—ideal for large, decentralized institutions such as universities or regional public bodies.

Beyond enforcement, PacketFence includes monitoring, reporting, and posture-validation functions that help security teams meet compliance requirements for acceptable-use and network-segmentation policies.

The Value Provided by the Company Behind It

PacketFence is maintained by Inverse, now part of Akamai Technologies. Inverse built PacketFence as an enterprise-ready, GPL-licensed system and continues to provide professional support, clustering expertise, and integration services.

The vendor’s core value is the combination of open-source transparency and enterprise-grade reliability. Through Akamai, institutions can purchase professional support, consulting, and managed services for PacketFence while retaining full control of source code and deployment. This dual model—open-source flexibility with optional vendor-backed assurance—lowers risk and long-term operating costs compared to closed commercial NAC products.

How PacketFence Remains Sovereign

For Canadian public institutions governed by FIPPA or equivalent legislation, sovereignty and residency are key. PacketFence excels here because it can be deployed entirely on-premises, with no mandatory cloud dependency.

All RADIUS, policy, and authentication data can stay within Canadian-controlled infrastructure. Fingerbank, the device-fingerprinting component, can operate in local-only mode, keeping hardware identifiers and device fingerprints within the local database.

This means a university, municipality, or agency can meet privacy and data-sovereignty obligations while retaining full control of authentication logs, certificates, and network policies. The result is a sovereign NAC platform that aligns naturally with the “trusted network” and “sovereign infrastructure” mandates emerging across provincial and federal sectors.

Integration with Cambium and Aruba

PacketFence integrates cleanly with major Canadian-market access vendors such as Cambium Networks and Aruba.

These integrations allow institutions to modernize access control without changing their switching or wireless ecosystems, reducing capital overhead while maintaining secure segmentation.

Large-Scale and Public Deployments

Public evidence of PacketFence adoption continues to grow, particularly in the education sector where transparency and sovereignty matter most. Below is a verified list of active deployments and references across Canada, the United States, and Europe.

Delta School District (BC)

Help page referencing PacketFence portals

https://www.deltasd.bc.ca/resources/district-wifi/

Keyano College (AB)

Active PacketFence portal

https://packetfence.keyano.ca/access

Seattle Pacific University

Vendor testimonial—“over 8 000 registered devices, 200+ switches, 400 APs”

https://www.inverse.ca/

Albany State University

User guide and live status portal

https://packetfence.asurams.edu/status

FX Plus (Falmouth & Exeter Campuses)

Live PacketFence portal

https://packetfence.fxplus.ac.uk/status

Queen’s College Oxford

IT blog documenting PacketFence rollout

https://it.queens.ox.ac.uk/2011/11/04/mt2011-4th-week-packetfence/

Why It Fits Canadian Public Institutions

Canadian universities, colleges, and municipalities face unique constraints: compliance under FIPPA, financial transparency, mixed-vendor environments, and the need for sovereign data governance. PacketFence’s open architecture, self-hosted control plane, and native integration with widely deployed access hardware make it an ideal choice.

It avoids the CLOUD Act exposure inherent in U.S.-hosted NAC offerings and aligns with provincial mandates for on-premises or Canadian-hosted data. Its open-source licensing also simplifies procurement under public-sector software guidelines, removing per-endpoint licensing costs and ensuring full audibility of code and data handling.

Closing Thoughts

PacketFence delivers a proven, scalable, and sovereign alternative to commercial NAC systems. For public institutions balancing compliance, budget, and independence, it provides both control and confidence. Backed by Inverse and Akamai’s professional expertise, and built on open standards that integrate cleanly with Cambium and Aruba ecosystems, it stands out as the pragmatic choice for Canadian sovereign infrastructure.

Sources and Documentation