PortGuard NAC gives IT teams, MSPs and system integrators a simpler way to control network access, segment devices and detect unauthorized endpoints — without complex appliances or long deployment projects.
Staff, contractors and visitors connect from personal devices you've never seen. You have no way to know if they meet your security standards — or where they go once connected.
A single misconfigured access point is all it takes for a guest device to reach systems it should never see. Shared infrastructure is a compliance risk most teams underestimate.
Bring Your Own Device policies without technical enforcement are wishful thinking. Personal devices with no security baseline are on your network right now.
Cisco ISE and ForeScout are powerful platforms built for organisations with dedicated network security teams. If your IT team is fewer than ten people, those tools aren't the right fit.
PortGuard is a network access control appliance designed for companies that need real security outcomes without the complexity of enterprise platforms. It authenticates every device before it reaches the network, assigns it to the right segment automatically and gives your IT team a clear, real-time picture of everything connected.
It integrates with Microsoft Entra ID, Active Directory and LDAP. It works with the switches and Wi-Fi infrastructure you already have. And it can be running in your environment today.
Core network access runs on your premises. Optional licensing, updates, telemetry and integrations can use outbound connections when enabled.
Blocks every unauthenticated device at the switch port or Wi-Fi access point. Staff, guests and contractors all have to prove who they are before they get network access.
Access ControlUsers and devices land on the right VLAN automatically — staff, BYOD, guests and contractors, each on their own segment. No manual switch configuration needed.
Dynamic VLANNative integration with Microsoft Entra ID, Active Directory and LDAP. Your existing user directory drives network access — no duplicate identity management.
Entra ID / LDAPBranded captive portal with time-limited vouchers for visitors. When configured correctly, guest and personal devices land on isolated VLANs, separated from internal systems.
Guest Portal · VoucherAutomatic inventory identifies every endpoint by vendor (IEEE OUI, offline) and classifies it — computer, phone, printer, CCTV, VoIP, IoT — with unmanaged and randomized MACs flagged on sight.
Device ProfilingA dedicated dashboard brings classified CCTV, IoT and industrial devices together with their identity, network location and recent access activity. The incident response workflow is being qualified separately for customer deployments.
IoT / OT · PreviewSee connected devices, their identities, network locations and policy status. Export appliance checks and audit events for review in supported releases.
Live DashboardHigh-assurance device authentication with no passwords to steal or rotate. Managed devices get certificate-based identity — a strong, phishing-resistant form of network access control.
EAP-TLS · PKINative SNMP support for your existing managed switches and Wi-Fi hardware. No new infrastructure required — PortGuard sits alongside what you already have.
SNMP · PRTGEach Wi-Fi device gets its own unique WPA2 passphrase and VLAN, managed from NAC → Wireless Keys. Built for legacy hardware and IoT devices that cannot run 802.1X. Keys can be rotated or revoked individually; all actions are audited.
UPSK · Wireless Keys · New in v1.1.15Deploy a separate PortGuardNAC appliance for each customer. The partner portal supports partner account and licensing workflows; a shared multi-tenant NAC dashboard is not available in this release.
MSP · Per-client applianceThe IoT / OT dashboard is in supervised preview. External sensors and automatic switch response are separate integrations that require site qualification; they are not bundled with the customer ISO. See preview scope.
You need to pass a security audit, control what personal devices can reach, and stop guests from seeing internal systems. PortGuard gives you the tools to do it — no consultancy engagement required.
See what's included →Deploy and manage PortGuardNAC separately for each customer. A shared dashboard with isolated customer tenants is not available in this release.
Become a partner →Your clients need network access control as part of a Zero Trust or compliance programme. PortGuard deploys quickly, integrates with their existing identity stack, and produces the evidence their auditor needs.
Why PortGuard? →Cisco ISE and PacketFence are powerful tools — designed for organisations with dedicated security teams. If you need access control working by the end of the month, PortGuard is the right tool.
| PortGuardNAC | Cisco ISE | PacketFence | |
|---|---|---|---|
| Deployment timeline | < 1 day | Enterprise project | Weeks to months |
| Expertise required | Network admin | Cisco-certified eng. | Linux administration |
| Entra ID integration | Built-in (SAML / OIDC) | LDAP connector / NPS | Manual LDAP sync |
| Appliance / VM deployment | ISO — any hardware/VM | SNS3800 or OVA (extra) | ZEN OVF (community) |
| On-premises enforcement | ✓ | ✓ | ✓ |
| Appliance evidence export | ✓ | Enterprise add-on | Partial |
Your existing network infrastructure stays in place. No forklift upgrade, no months of configuration, no professional services contract.
Install PortGuard from ISO onto any server, VM or bare-metal hardware (20 GB SSD minimum; 40 GB recommended). Physical or virtual — your choice.
Change the unique first-boot password and enrol MFA, then connect Microsoft Entra ID, Active Directory or LDAP if required.
Set who gets access to what, which devices qualify, and how guests connect — through a web interface built for network administrators.
Verify authentication, segmentation and monitoring on your network. Export technical evidence after reviewing its scope and the installed release.
Evaluate the available PortGuardNAC features for 30 days. No credit card.
Deployment scope: each listed annual price covers one deployed appliance, not one physical location. A qualified central appliance may serve several sites; local appliances can be deployed where resilience or isolation requires them. One multi-site commercial order can list all covered locations and appliance activations, with one agreed total and support package. Independent MSP customers require separate orders and licenses. A shared multi-tenant NAC dashboard is not available in this release. Enterprise HA is included in the hf45 customer ISO for supervised pilot deployments; physical switch failover remains to be qualified before production use. An HA pair uses one commercial pair entitlement bound to exactly two named appliance IDs; each node needs its own technical activation. Pricing and support for the HA pair are quoted separately and are not included in the displayed single-appliance price. See the architecture and pilot boundaries.
🤝 Are you an MSP or reseller? Join the Partner Programme →