Introduction

Taranac is a free, self-hosted network access control (NAC) and device-administration platform. It unifies TACACS+, RADIUS and 802.1X behind a single admin UI, a single identity store and a single set of access policies — covering the same ground as commercial products like Cisco ISE, without the licensing.

Where a typical network stacks a separate TACACS+ server, a RADIUS server, a guest-portal appliance and a certificate authority, Taranac runs them as one product. You define users, network devices and policy once; the platform compiles that into live TACACS+ and RADIUS service configuration and keeps the two engines in sync. The Community core is free and has no usage caps; Pro features (today, high availability) are unlocked with an offline license. See Licensing & editions for the split.

The dashboard gives a read-only operational overview: entity counts, live TACACS+/RADIUS service health, authentication activity and pending alerts — plus license/edition and, on an HA deployment, cluster-health widgets.

taranac · one platform

AAA device administration admins → devices

TACACS+ RADIUS

NAC network access control endpoints → network

802.1X / RADIUS

one shared core

Identity Network devices Logging PKI

Taranac is organised around two products that share one core:

Product	Purpose	Protocols
AAA	Control administrative access to network devices (who can log into a switch, what commands they may run, session accounting)	TACACS+, RADIUS
NAC	Control device access to the network (port-level authentication, endpoint identity, VLAN/ACL assignment, guest onboarding)	802.1X over RADIUS

Both products draw on the same identity, network-device inventory, logging and PKI subsystems, so an operator configures one platform rather than wiring several appliances together.

Taranac is built for the network or security engineer who operates the infrastructure — the person who today runs tac_plus, a FreeRADIUS instance, an LDAP bind and a guest portal as separate moving parts. If you administer switches, routers, firewalls and wireless controllers, and you need centralised AAA plus standards-based port control, Taranac is the single control plane for that work.

This documentation is written for that operator/administrator audience. It explains how to configure and reason about Taranac through its admin UI, not how the internals are implemented.

These are the terms as the admin UI uses them. Each maps to a section in the sidebar of the Taranac console.

Term	What it means
Device administration (AAA)	Authenticating and authorising humans who log into network devices, and accounting their sessions, over TACACS+ and RADIUS.
Network access control (NAC)	Authenticating endpoints (laptops, phones, IoT) at the switch port via 802.1X, then assigning network access (VLAN, ACL).
Identity	The people and machines Taranac authenticates: local Users and Groups, plus directory identities synced from an LDAP directory — Active Directory, OpenLDAP, FreeIPA or another LDAP server.
Network device	A switch, router, firewall or controller that talks TACACS+/RADIUS to Taranac. Each device carries its shared secret and which protocols it uses.
Profile	The reusable authorisation result Taranac returns — a TACACS+/RADIUS profile (privilege level, attributes) or a NAC authorization profile (VLAN, ACL).
Policy	An ordered, top-down rule table that maps a request (who, from where, under what conditions) to a profile. AAA and NAC each have their own policy table.
Endpoint	A device seen on the network, identified by MAC/OUI and classified into endpoint groups for NAC policy.
PKI	The internal certificate authority and trusted CAs used for EAP-TLS and the platform’s own certificates.
RBAC	Role-based access control governing what each Taranac admin may see and change in the console.

The admin console groups everything into a fixed set of sections. The documentation mirrors that structure, so what you see in the sidebar maps directly to a docs section.

Console section	What lives there	Docs
Dashboard	Operational overview: entity counts, TACACS+/RADIUS health, auth activity, alerts	This page
Infrastructure → Identity	Users, Groups, RBAC	Identity & access
Infrastructure → Network	Devices, Device Groups, Network Objects, Time Ranges	Device administration
AAA	TACACS+ Profiles/Command Sets/Templates, RADIUS Profiles/Templates, Policies, Settings	Device administration
NAC	Endpoints, Endpoint Groups, Captive Portals, Authorization Profiles, Policy, PKI, OUI	Network access control
Logging & Reports	AAA logs (authentication/authorization/accounting), NAC sessions & auth log, Activity log, Alerts	Operations
Settings	System (incl. Licensing, and Cluster on HA), Integrations (LDAP, Email, MFA, Syslog), Security (Authentication, Crypto)	Reference

A new deployment is usually brought up in roughly this order:

1. Sign in and meet the dashboard. It confirms the TACACS+ and RADIUS engines are reachable and shows whether any configuration changes are pending deployment.
2. Add identity. Create local users and groups, or connect a directory under Settings → Integrations → LDAP. Optionally enable MFA.
3. Register network devices. Under Infrastructure → Network → Devices, add each switch/router with its shared secret and the protocols it will use.
4. Build authorization profiles for the access you want to grant — TACACS+ privilege levels and command sets for device admins, or NAC profiles (VLAN/ACL) for endpoints.
5. Write a policy. Order rules top-down so that a request resolves to the right profile. Use the Policy Tester to dry-run a request before relying on it.
6. Watch the logs. Authentication, authorization and accounting logs (and NAC sessions) show exactly what each rule decided and why.

Taranac’s two products solve different problems. Use this to decide which part of the console a given task belongs to.

You want to…	Use	Section
Let engineers log into switches with role-based command control	AAA (TACACS+)	AAA → TACACS+
Authenticate admins to devices via RADIUS (e.g. firewalls, WLCs)	AAA (RADIUS)	AAA → RADIUS
Authenticate laptops/phones at the switch port and assign a VLAN	NAC (802.1X)	NAC → Policies
Allow unmanaged devices by MAC address (printers, IoT)	NAC (MAB)	NAC → Endpoints
Issue client certificates for certificate-based 802.1X	NAC (EAP-TLS + PKI)	NAC → PKI
Onboard guests through a web portal	NAC (Captive Portal)	NAC → Captive Portals
Decide who can administer Taranac itself	Identity (RBAC)	Infrastructure → Identity

• Architecture — how the components fit together
• Installation — deploying Taranac
• Quick start — first configuration end to end
• Device administration overview — TACACS+, RADIUS and AAA policy
• Network access control overview — 802.1X, endpoints and NAC policy
• Identity & access — users, groups, LDAP directories, RBAC and MFA
• Project on GitHub