Every access request — TACACS+, RADIUS or 802.1X — is evaluated against one ordered rule set. Match on who, where, when and source; the first rule that fits wins and returns the result. No per-box config, no drift between protocols — one source of truth, and a built-in tester to prove a request before you ship it.

Authenticate every device at the edge — EAP-TLS, PEAP, EAP-TTLS/TEAP, or MAB for what can’t speak 802.1X. Taranac returns the VLAN, dACL or redirect each endpoint should get, and can bounce a live session with CoA the moment policy changes.

Do certificate-based 802.1X the way your network already works. Trust EAP-TLS clients from Taranac’s built-in CA, from AD CS, or from any third-party CA — add as many trusted and AD CAs as you need. Stand up more than one internal root too — say a separate CA for contractors — so revoking a whole group is one move. EST (RFC 7030) enrollment and CRL publication are built in — no separate PKI product.

Back up, version and diff every device’s running config — captured over SSH, Telnet, SCP/SFTP or HTTPS on a schedule or on demand, deduped and pinned to a baseline so drift stands out at a glance. Because Taranac is already your AAA server, each change arrives with who logged in and which commands they ran — the diff and the culprit, side by side. And it can authenticate with a just-in-time password nobody ever sees: minted per collection, 32 random characters, rotated the moment the job is done. Read the config tracking guide →

Run Taranac as a 2–4 node cluster on replicated PostgreSQL, managed for you by Patroni and etcd — one read-write primary, the rest streaming replicas. Because every node answers TACACS+, RADIUS and 802.1X from its own local replica and cache, the authentication data plane never depends on the primary: point your devices at every node, and when one fails failover is automatic — only configuration writes pause for a few seconds. A Pro feature, unlocked by an HA license. Read the HA guide →