Everything you need to
control network access

Password-based 802.1X for configured local or compatible directory credentials. Microsoft Entra OIDC/SAML sign-in is a separate dashboard flow, not a PEAP password check.

Mutual certificate authentication — the strongest EAP method. Both client and server present certificates. Ideal for managed corporate devices.

Tunneled TLS with PAP inner auth. Useful for Linux clients and legacy devices that don't support PEAP natively.

Multiple EAP methods are supported. PortGuard selects the method based on client capability; if the preferred method fails, it falls back to the next configured option gracefully.

Each registered Wi-Fi device receives its own WPA2 passphrase instead of a shared network password. Keys are tied to a specific device MAC address and managed from NAC → Wireless Keys.

Each device key carries its own VLAN. When the device connects, PortGuardNAC returns the correct VLAN via RADIUS — no additional policy rules required.

Keys are shown once at creation; copy and store them before closing the dialog. Rotate a key instantly from the device entry; revoke it to block the device on its next connection. All actions are audited.

UPSK covers legacy hardware, IoT devices and equipment with no 802.1X supplicant. It does not replace 802.1X — for any device that supports EAP-TLS or PEAP, certificate or credential authentication remains the stronger choice. Device identity is MAC-based and can be spoofed; the access point must support RADIUS-assigned PSKs via Tunnel-Password and dynamic VLAN (RFC 3580) — verify compatibility with your AP model before rollout.

Use configured Microsoft Entra sync or LDAP / Active Directory data in network policies. OIDC and SAML are administrator sign-in methods, not EAP methods.

One Microsoft Entra tenant can be configured for Graph sync per appliance. EAP-TLS certificates from other organizations may be accepted when their CAs are trusted, but realm matching alone does not verify tenant membership. Cross-tenant 802.1X policy enforcement requires certificate-to-identity validation and a site-specific test; it is not a ready-made multi-tenant feature.

Directory groups sync to PortGuard continuously. Map a group to a VLAN and its members land on the right segment automatically on their next authentication.

Machine authentications (host/PCNAME) are matched to the synced Entra ID device — the Devices page shows domain/PCNAME instead of a raw MAC or hostname.

Choose which source wins when a user exists in several (local, LDAP, SAML, Entra). If one directory is unreachable, the next configured source takes over — reducing the impact of a single directory outage.

Map AD groups or LDAP OUs directly to VLANs. A user in "Finance" always lands on VLAN 20, regardless of which switch port they connect to.

Assign VLANs by profiled device group (printer, CCTV, IP phone, IoT) resolved from IEEE OUI vendor data — one rule per group, no per-MAC work, manual override supported.

A policy can match the domain in a RADIUS identity (for example, company.it) and assign a VLAN. Domain matching alone is not proof of Entra tenant membership or a customer isolation boundary.

When a user's group changes mid-session, PortGuard sends a RFC 3576 CoA request to the switch. When the NAS/switch supports CoA, the VLAN change takes effect without requiring the device to reauthenticate. CoA support varies by switch model and firmware.

Every MAC is matched against the official IEEE registry (~53,000 vendor prefixes, bundled offline) to identify the manufacturer of each connected device — no cloud lookup, works fully air-gapped.

Devices are classified into Computer, Phone/Tablet, Printer, CCTV, VoIP, IoT and Switch using a confidence engine that combines vendor rules, auth/EAP method, hostname & user patterns, MAC randomization and VLAN — real signals only, no fabricated fingerprints. Manual override always wins.

A dedicated Devices page lists every endpoint seen (vendor, group, VLAN, last identity, last-seen), and the SOC/NOC "Live Network State" view shows live endpoints in real time beside a device-profiling summary. Randomized / private MACs are flagged on sight.

Turn profiling into control: one policy sends every CCTV camera to an isolated VLAN and every printer to the print segment — no per-device configuration.

Review classified CCTV, IoT and industrial assets with their available identity, IP address, VLAN, switch and recent network activity in one operational view.

Select an asset to inspect its own network and authentication details without losing the wider inventory.

The incident workflow can accept signed alerts from a separately deployed, registered sensor. No IDS appliance is bundled with PortGuardNAC.

CoA-based quarantine is a separate pilot workflow. It requires a supported switch, current RADIUS accounting, an isolated VLAN and witnessed traffic verification before customer use.

Separate portal profiles per SSID / NAS — each with its own VLAN, session duration, bandwidth cap, idle timeout and concurrent-session limit.

Reception staff generate time-limited, usage-capped vouchers for visitors. Batch generation and print/export for the front desk.

A terms-acceptance splash page for open guest networks — no code required, while VLAN, session and bandwidth limits are still enforced.

Per-profile bandwidth limits (up/down). Guests get limited bandwidth, employees get full speed — enforced via RADIUS attributes.

The appliance's own software components are checked against CVE feeds on a schedule. Findings carry CVSS severity and a remediation plan, exportable as PDF or CVE JSON for your security team.

Every endpoint that reaches the RADIUS auth layer without a known identity is surfaced as a security event and counted on the dashboard — unauthenticated access attempts stay visible, not buried in switch logs.

Every RADIUS reject is logged with identity, MAC, NAS and reason. Failure trends and EAP errors surface on the dashboard so credential problems and misconfigured supplicants are caught early.

All issued certificates (server TLS, EAP CA, client certs) are tracked in a certificate inventory, and the dashboard flags those approaching expiry or already expired.

All dashboard widgets update via WebSocket push — no polling. Auth events appear within 2 seconds of occurrence.

Tested with read-only SNMPv3 and a downloadable sensor template. Monitor RADIUS, authentication outcomes, connected endpoints, VLANs and IoT/OT incidents.

Tested with Zabbix 7 using a downloadable SNMPv3 template for core NAC health. A Prometheus bridge for CoA and resilience metrics is being qualified for customer release.

Aggregate, read-only metrics use a dedicated HTTPS endpoint with a bearer token and source-IP allowlist. Reference Grafana dashboards for NAC operations and IoT/OT response have been validated in the lab.

Standard SNMPv3 metrics can be polled with generic checks. Dedicated templates and end-to-end validation for these products are not yet available.

All security events and auth decisions can be forwarded to a remote syslog server — compatible with Splunk, Graylog, and any SIEM.