A network device to provide per-user firewall capabilities. The network device identifies a user associated with a received frame and a role of the user. The network device determines the firewall actions to be taken for the frame based on the role of the associated user. The user role may be dynamically changed by an administrator or automatically. A user role may be altered based on the authentication level of the user. The network device provides a system where a customized authentication experience may be provided for each user and services and permissions may be managed on a per-user basis.