Quick Start Guide

System requirements

The customer ISO installs PortGuardNAC on Ubuntu Server 24.04 LTS in an x86-64 virtual machine or on compatible dedicated hardware. Allocate a dedicated SSD-backed disk:

• Installation baseline: 2 vCPU, 4 GB RAM and a 40 GB disk. The ISO has been exercised with 2 vCPU and 4 GB RAM.
• Recommended production allocation: 4 vCPU, at least 4 GB RAM and a 100 GB disk. Allow more storage for longer audit-log retention, local backups and high authentication volume.
• One network interface with a reachable management address and connectivity to the switches or access points. A stable IP address is recommended; DHCP can be used for initial setup.
• UEFI boot is recommended. The ISO also includes a legacy BIOS boot path; validate it on the chosen hypervisor before customer rollout.

Network access

• 443/TCP inbound from administrators and, if the captive portal is enabled, its clients. The portal is served under /portal on HTTPS; it does not require a separate port 8080.
• 1812/UDP and 1813/UDP inbound from authorised switches and access points for RADIUS authentication and accounting.
• 3799/UDP from PortGuardNAC to a switch or access point only when Change of Authorization (CoA) is enabled on that device.
• 22/TCP inbound only from the restricted administration network for the diagnostic console and maintenance access.

The initial installation and local NAC operation can run offline. Allow outbound access only for the features you enable: for example, update services, Microsoft Entra ID, an LDAP directory or an NTP source. Plan reliable time synchronisation for certificate-based 802.1X.

Installation from ISO

1. Download the ISO from the trial download page (Download section) and verify its published SHA-256 checksum
2. Create a VM with the requirements listed above
3. Boot from the ISO and wait for automated installation and first-boot provisioning to finish
4. Read the assigned IP address and dashboard URL from the persistent appliance console

First login

1. Open your browser at https://[IP]
2. Accept the self-signed certificate (or configure your own)
3. Sign in with admin / admin and change the password when prompted. The new password must have at least five characters, including an uppercase letter. The change updates the dashboard and console/SSH account together.
4. Scan the MFA QR code with a TOTP authenticator (or enter the setup key manually), then enter its current six-digit code. No administrative session starts before verification.
5. The PoC trial starts offline. Enter a purchased license in Settings → License when applicable.

Appliance console

The VM console remains on a numbered PortGuardNAC menu showing the current IP address and service status. It provides network settings, a shared password reset, a restricted maintenance CLI, service status and controlled restart or shutdown actions. At first boot, choose option 9 and record the one-time appliance recovery code in a secure location. Keep it private; support will not ask you to send it. See the console guide.

Basic 802.1X configuration

1. Define the RADIUS shared secret and add your switches as NAS clients
2. Configure the EAP method (EAP-TLS / PEAP / TTLS) based on your infrastructure
3. Connect the identity source (local, AD/LDAP or Entra ID — see the dedicated guide)
4. Define the Dynamic VLAN policies and, if needed, MAC Authentication Bypass
5. Enable the policy on a test port and verify authentication of an endpoint

Entra ID integration

For integration with Microsoft Entra ID, see the dedicated guide.

Support

[email protected]