Three-plane separation, mTLS 1.3, Redis event bus — native Ubuntu, no containers.
Each plane is a dedicated systemd service with its own user, isolated privileges, and a single well-defined responsibility.
All inter-plane communication is encrypted with mutual TLS 1.3. No plane can communicate without a valid certificate.
Each service runs as a dedicated system user with only the permissions it needs. The web process cannot touch RADIUS config.
Every configuration change and auth decision is logged with a SHA-256 chain. Any modification is immediately detectable.
Admin sessions use short-lived JWT tokens with rotating refresh tokens. Session invalidation is immediate on logout.
PortGuard operates fully offline. No cloud sync, no call-home, no telemetry. Suitable for air-gapped environments.
Licenses are signed with a private key that never leaves our infrastructure. Validation is local — no internet required.
| Type | Change |
|---|---|
| New | Complete license lifecycle — expiry email alerts (30/14/7/1 days), a two-stage grace period after expiry (read-only then blocked) and support-window enforcement on version updates; security updates always remain available |
| New | Two-factor authentication is now optional — enable or disable MFA per administrator, with a "Require MFA at login" policy toggle |
| New | In-place Factory Reset — return the appliance to a fresh state from Settings > Maintenance without reinstalling the ISO; optionally keep network settings and license |
| Fix | Reliability — RADIUS sessions auto-close when a device goes silent (no more endpoints stuck online); fixed a rare post-update login lockout; cleaner Recent Auth Events on a fresh install |
| New | Advanced Device Profiling — multi-signal confidence engine (IEEE OUI vendor, auth/EAP method, hostname & user patterns, MAC randomization, VLAN) ranks device types by new detections. Real signals only — no fabricated JA3/DHCP fingerprints |
| New | Live Network State — real-time Live Endpoints (one row per MAC: device type, OS, IP, VLAN, auth method, status) shown alongside device profiling in SOC/NOC |
| New | Accurate authentication-method reporting — EAP-TLS is now distinguished from PEAP and EAP-TTLS (reads the real EAP type and client-certificate CN) |
| New | Endpoint IP detection from RADIUS accounting (Framed-IP-Address) shown per endpoint where the switch supplies it |
| Change | "Policies" renamed to "Access Policies"; RADIUS client terminology aligned to Switch / Devices across the dashboard |
| Fix | More accurate "Unknown Devices" metric on flat L2 networks — counts only unidentified endpoints that actually reached the RADIUS auth layer, not every MAC seen in accounting |
| New | Device profiling with IEEE OUI — every device identified by vendor from the official IEEE registry (~53,000 prefixes, bundled offline) |
| New | Automatic device grouping — Computer, Phone/Tablet, Printer, CCTV, VoIP, IoT and Network, with manual override |
| New | Devices inventory page — live vendor, group, VLAN and last identity per endpoint, with randomized/BYOD MAC detection |
| New | Group-based VLAN enforcement — send every CCTV camera or printer to its own segment with a single policy, no per-MAC rules |
| New | Device-group and SSID policy conditions now enforced live, with dedicated cctv / printer / voip roles and access profiles |
| New | Update guard with automatic rollback — a failed update can no longer block appliance login |
| New | High-quality PDF reports — multi-page exports with proper fonts, pagination and aligned tables |
| Fix | Super admin account is protected — it can never be deleted |
| Fix | RADIUS config rollback — snapshots selectable by clear local date/time |
| New | Client Certificates for 802.1X EAP-TLS — issue and manage user and machine certificates from the dashboard |
| New | Secure update channel on downloads.portguardnac.com — SHA-256 verified packages, optional release signing |
| New | portguardnac-cli — status and diagnostics tool from the appliance console |
| New | SNMP extensions for PRTG / LibreNMS infrastructure monitoring |
| Perf | Component inventory refreshes automatically after system or application updates |
| Fix | SOC/NOC telemetry accuracy — connected devices, identities and top VLANs |
| Fix | Idle session timeout enforced as configured (0 = disabled) |
| Fix | Consistent dd/mm/yyyy HH:MM:SS timestamps across the dashboard |