Changelog

Current release: 1.1.15. Download the current trial installer. Existing appliances can install eligible signed updates through Application Updates.

v1.1.15 — current release current stable release

• HA RADIUS trust — the secondary activates the replicated EAP certificate and trust bundle in FreeRADIUS. A repeated in-sync snapshot also rechecks activation. The two appliances keep separate hostnames and management identities.
• Appliance console — the fixed English menu appears at first boot and after reboot, showing the management IP and service state. It provides network settings, diagnostics, a shared password reset and a one-time recovery code.
• First sign-in — new installations start with admin/admin, require MFA enrolment and a mandatory password change, then use that password for dashboard and SSH. Change the default immediately.
• Delivery — The current trial installer includes these changes, and eligible existing appliances receive signed cumulative updates. See the HA certificate guide and console guide.

1.1.15-hf45 application hotfix

• HA visibility and control — corrected pair identity and license status, added authenticated standby disconnection, and clarified active and standby roles.
• Operations — respected the disabled idle-logout setting and exposed HA health through the supported SNMP and metrics integrations. Console improvements continued in hf46.

1.1.15-hf44 application hotfix

• HA entitlement — corrected support for legacy MSP licenses that include HA and aligned the dashboard, control service and restricted console checks.
• Sessions and packaging — fixed the admin idle-logout setting, recorded session-limit closures in the audit log, excluded development tests from customer update packages and corrected the revision recorded on new installations.

1.1.15-hf38–hf43 maintenance sequence

• hf38–hf39: introduced the supervised two-node HA pilot, signed configuration replication, appliance-bound pair licensing and a possible MAC reuse advisory. hf39 also included the scoped signed offline-update upload limit in dashboard updates.
• hf40–hf42: enforced Enterprise HA entitlement across dashboard, control and console paths; added an authenticated shared dashboard/SSH password change and secret-safe FreeRADIUS diagnostics. Professional licenses no longer list HA as an effective feature.
• hf43: corrected installation of offline hotfixes across revisions while retaining the HA entitlement and console safeguards.

1.1.15-hf37 application hotfix and trial ISO — 18 October 2026

• Per-device Wi-Fi keys — assign an individual pre-shared key and VLAN to a known device on a dedicated SSID. The access point must support RADIUS-assigned PSKs through Tunnel-Password; verify compatibility with your AP model before rollout.
• Key lifecycle — create, rotate and revoke device keys in NAC > Wireless Keys. Keys appear once when issued, and administrative changes are audited. Unknown or revoked devices are rejected on the protected SSID.
• Delivery — hf37 was a cumulative signed application update for installed appliances. The portguardnac-1.1.15-hf37-trial.iso installer included this release; the download page now serves the current installer.

1.1.15-hf36 application hotfix — 16 October 2026

• IoT/OT incident closure — NOC operators can resolve an investigated signed-sensor incident that did not enter quarantine. A detailed note is required and the decision is audited.
• Quarantine safeguard — incidents with a quarantine VLAN still require the explicit release action. A CoA acknowledgement alone does not prove traffic isolation.
• Cumulative update — hf36 includes earlier 1.1.15 application hotfixes and is distributed as a signed, checksum-verified package. At the time of this release, the trial installer was hf33; hf36 was delivered through Application Updates.

1.1.15-hf35 application hotfix — 16 October 2026

• Visible installed version — Product Version and the dashboard header now include the installed hotfix number, for example 1.1.15-hf35.
• Cumulative release — hf35 includes earlier application hotfixes for 1.1.15. Install hf35 directly; earlier hotfixes do not need to be installed in order. Downgrades to an older hotfix are blocked.
• Verified installation — the stable release is signed and checksum-verified. Installation runs through the privileged maintenance service where that service is available. Older appliances that still show the TET maintenance error need a one-time root-controlled update; the web process cannot install a release itself.

Existing 1.1.15 appliances can install the newest eligible signed update through Application Updates. See HA setup for the supervised pair procedure and its limits.

1.1.15-hf3 PoC ISO — October 2026

• TET PoC baseline — hardened administrative MFA, privilege separation, protected backup and audit controls; production acceptance still requires customer-specific testing and sign-off.
• MFA enrolment — scan a QR code or enter the setup key manually; a six-digit TOTP code is required before an administrative session is created.
• Customer media — removes internal audit reports and stale engineering notes, and includes an English customer PoC security and operations guide.
• Application maintenance at this release — the TET PoC blocked web-process installation. Later builds introduced a signed, privileged release procedure.

v1.1.14 — September 2026

• Sign-in reliability — fixed a session-cookie parsing issue that caused roughly one in eight logins to fail immediately after succeeding, with nothing in the log.
• Diagnostics accuracy — the service list now reflects the real running processes; system health reports Critical when a core service (including FreeRADIUS) is not running, instead of reporting Healthy from stale data.
• Identity Federation reorganised — LDAP/LDAPS, Microsoft Entra ID, SAML 2.0 and Diagnostics are now separate entries under a single menu root. Settings are still saved together, so switching between entries never loses unsaved changes.
• LDAPS CA upload — the TLS certificate authority for LDAPS can now be uploaded from the dashboard (PEM or DER); the interface shows issuer and expiry and rejects files containing private keys.
• Directory group to role mapping — editable from both LDAP and SAML pages; required for dashboard sign-in with directory credentials.
• Security hardening — RADIUS shared secrets no longer allow FreeRADIUS config injection; SNMP service account no longer reaches the privileged control plane; TOTP codes cannot be reused.
• Atomic configuration writes — a save interrupted by restart or power loss no longer leaves a truncated config file or causes a silent fallback to factory defaults.

v1.1.13 — August 2026

• Directory sign-in (LDAP / LDAPS) — administrators can sign in to the dashboard with their directory credentials. A directory group must be mapped to an appliance role, so a valid account is never an administrator by accident; accounts can be created on first sign-in or required to exist beforehand. Connection, TLS, service account, directory search and a real user login can be tested from the page.
• Single sign-on (SAML 2.0) — the appliance now has an Assertion Consumer Service. It accepts only assertions signed by the configured identity provider, addressed to this service provider, inside their validity window, answering a sign-in request it issued, and never reused. SHA-1 signatures and responses carrying more than one assertion are refused.
• Network Settings applies the configuration — management interface, static address, gateway, DNS, MTU, VLAN and routes are written to the appliance instead of being recorded only. The result is verified after it is applied, and the previous configuration is restored automatically if the appliance does not come back with the expected address, a route out and a DNS server that answers.
• Authentication policies are enforced at sign-in — restrictions by source network and time window, and the lockout thresholds, now apply to the administrators each policy targets. A policy that would lock you out from your current network is refused when saved.
• Network policies reach the switch — a policy that denies access now produces an authentication reject, and the role and access profile it assigns are sent to the network device as Class and Filter-Id.
• SSH source-address restriction — the list of allowed networks in SSH Management now really blocks everything outside it, and an address typed incorrectly is refused instead of producing a restriction that silently allows everyone.
• Automatic disk maintenance, digitally signed update packages, and a duplicate network-device address refused at save time instead of blocking every later RADIUS change.

v1.1.12 — August 2026

• Package Operations Guard — system updates can no longer fail halfway. Every package operation runs in a pristine environment, a preflight check refuses an update that cannot complete (free space on /, /boot and /var, package-manager lock, dpkg state) with an explicit cause and remedy, and dpkg state is repaired and re-verified around each install
• Kernel updates no longer fail with “Read-only file system” — an Ubuntu kernel update could abort mid-install and leave the package manager blocked until manual recovery over SSH
• Repair Package State — recover a half-finished package manager from Updates → System Updates without SSH, or from the console with portguardnac-cli packages. An automatic check every 6 hours repairs it on its own when safe, and notifies when it cannot
• Fixes that live in /etc (systemd drop-ins, sudo delegations) are now delivered by over-the-air updates instead of requiring an ISO reinstall; they become active at the next reboot

v1.1.11 — July 2026

• HTTPS — the certificate uploaded in the dashboard is now really served by nginx. The apply checks that certificate and key match, reloads nginx and rolls back automatically if the new pair is rejected, so a wrong key can never leave the web UI unreachable
• RADIUS — a newly added switch is active immediately, with no manual restart: the apply now performs a real service restart (FreeRADIUS does not reload its client list on reload), validated before and health-checked with auto-rollback after
• RADIUS — the automatic rollback of a configuration apply now has a real snapshot to restore (snapshots were silently empty)
• Updates — a leftover Python cache no longer aborts an installation, and an outdated cached package is no longer installed silently (SHA-256 re-checked against the live manifest before installing)

v1.1.10 — July 2026

• Complete license lifecycle — expiry email alerts at 30/14/7/1 days, a two-stage grace period after expiry (read-only, then blocked) and support-window enforcement on version updates. Security updates always remain available
• Two-factor authentication is now optional — enable or disable MFA per administrator, with a “Require MFA at login” policy toggle. The forced password-change screen no longer requires MFA enrollment (fixes a password-change loop)
• In-place Factory Reset — return the appliance to a fresh state from Settings → Maintenance without reinstalling the ISO; optionally keep network settings and license
• Reliability — RADIUS sessions now auto-close when a device goes silent (no more endpoints stuck online); fixed a rare post-update login lockout; cleaner Recent Auth Events on a fresh install

v1.1.9 — July 2026

• Advanced Device Profiling — a multi-signal confidence engine (IEEE OUI vendor, auth/EAP method, hostname & user patterns, MAC randomization, VLAN) classifies and ranks device types. Real signals only — no fabricated fingerprints
• Live Network State in SOC/NOC — real-time Live Endpoints (one row per MAC: device type, OS, IP, VLAN, auth method, status) shown beside a device-profiling summary
• Accurate authentication-method reporting — EAP-TLS is now distinguished from PEAP and EAP-TTLS
• Endpoint IP detection from RADIUS accounting (Framed-IP-Address), shown per endpoint where the switch supplies it
• "Policies" renamed to "Access Policies"; RADIUS client terminology aligned to Switch / Devices
• More accurate "Unknown Devices" metric on flat L2 networks — counts only unidentified endpoints that actually reached the RADIUS auth layer

v1.1.7 – v1.1.8 — July 2026

• Device profiling with IEEE OUI — every device identified by vendor from the official IEEE registry (~53,000 prefixes, bundled offline)
• Automatic device grouping — Computer, Phone/Tablet, Printer, CCTV, VoIP, IoT and Switch, with a manual override that always wins
• Devices inventory page — vendor, group, VLAN and last identity per endpoint, with randomized / private MAC detection
• Group-based VLAN enforcement — send every CCTV camera or printer to its own segment with a single policy, no per-MAC rules
• Device-group and SSID policy conditions enforced live, with dedicated cctv / printer / voip roles and access profiles

v1.1.6 — July 2026

• Emergency fix: update guard with automatic rollback — a failed update can no longer block appliance login
• Clear login error reporting instead of opaque internal errors
• Full pre-restart syntax check of the whole application during updates
• Fixed post-update automatic service restart
• Super admin account is protected and can never be deleted
• High-quality PDF reports — multi-page exports with proper fonts, pagination and aligned tables (logs, vulnerability, compliance, update reports)
• RADIUS config rollback — snapshots selectable by clear local date/time
• Inactivity logout verified: disabling it keeps the session active as configured

v1.1.5 — July 2026

• Client Certificates for 802.1X EAP-TLS — issue and manage user and machine certificates directly from the dashboard
• SNMP extensions for PRTG / LibreNMS infrastructure monitoring
• SOC/NOC telemetry accuracy improvements (connected devices, identities, top VLANs)
• Consistent dd/mm/yyyy HH:MM:SS date format across the dashboard

v1.1.1 – v1.1.4 — June 2026

• New secure update channel — SHA-256 verified packages, optional release signature, no token required
• Component inventory refreshes automatically after system and application updates
• portguardnac-cli — status and diagnostics tool from the appliance console
• Idle session timeout now enforced as configured (0 = disabled)
• Trial licenses unlock all features, including Entra ID integration
• "Select all" for system updates and update-installer reliability fixes

v1.1.0 — June 2026

• Native Microsoft Entra ID integration (SAML 2.0 / OIDC)
• Group-Based VLAN mapping from Entra ID groups
• Multi-profile Captive Portal with custom branding
• Real-time dashboard via WebSocket
• Prometheus metrics endpoint
• Audit log with SHA-256 chain
• MFA for admin dashboard access
• Complete REST API

v1.0.0 — March 2025

• First public release
• 802.1X EAP-TLS / PEAP / TTLS
• MAC Authentication Bypass
• Dynamic VLAN
• Integrated FreeRADIUS