Endpoints

An endpoint is a single network device tracked by Taranac, keyed on its MAC address. Endpoints are the central objects of network access control: they are discovered (or added by hand), classified into one or more endpoint groups, and those groups become the conditions your NAC policies match on. A printer that lands in the Printers group can be put on the printer VLAN; a personal phone in BYOD can be given restricted access; an unrecognised device in Unclassified can be denied or quarantined.

This page covers how endpoints appear in Taranac, how classification rules sort them into groups, the OUI vendor database that powers vendor matching, and the day-to-day admin actions — manual import, block, and reassign.

status reflects where the endpoint sits in its lifecycle:

• known — recognised and classified into at least one group.
• unknown — seen on the network but not yet matched by any rule; waiting in Unclassified.
• blocked — denied by an administrator (authentication is rejected).
• inactive — not seen for a long time; hidden from lists by default.

persistence_type decides whether automatic cleanup may ever remove the endpoint:

• static — added manually, via CSV, or by LDAP computer sync. Never auto-deleted.
• dynamic — discovered automatically (RADIUS, certificate). Eligible for cleanup once inactive.
• guest — created through a guest captive portal. Cleaned up after the guest session expires.

Taranac populates the endpoint table from several built-in sources. Each source it has seen the device through is recorded as a separate discovery record under the endpoint, so you can tell why and how a device is known.

The vendor and OUI prefix are filled in automatically whenever an endpoint is created or its MAC changes: Taranac takes the first three bytes of the MAC and looks them up in the OUI database.

The endpoints list — each row carries MAC, vendor, status and the groups the device belongs to.

Groups are how you organise endpoints into policy-relevant buckets. Taranac ships with a set of seed groups so the system is useful on day one.

Two groups are system groups and cannot be deleted:

• Unclassified — where every new endpoint lands until a rule matches it.
• Blocked — blocked endpoints.

The rest are ordinary, editable seed groups: Corporate Devices, BYOD, Printers, IP Phones, IoT / Sensors, Security Cameras, and Guest Devices. Each carries a colour and icon for the UI, and you can create your own (for example, a per-location Building A group).

Because an endpoint can belong to multiple groups at once, you can classify along several independent axes — device type and location and access tier — without the groups fighting each other.

Endpoint groups — system groups (Unclassified, Blocked) plus editable seed groups, each with a member count.

A classification rule lives on a group and says: any endpoint matching this condition belongs in this group. Taranac evaluates rules with all-matches semantics — there is no priority and no “first match wins”. Every enabled rule that matches fires, and the endpoint joins every group whose rule matched. If nothing matches, the endpoint stays in Unclassified.

This is deliberate: you never have to reason about a global ordering of all rules across all groups to predict where a device lands. Rules are independent.

For vendor_name and oui_prefix, the rule form offers a searchable picker backed by the OUI database, so you can find a manufacturer or prefix without typing it from memory and see how many MAC prefixes a vendor owns. For cert_issuer, you pick a CA from a list rather than typing a DN.

When a device authenticates with EAP-TLS, Taranac extracts the certificate issuer and identity from the RADIUS exchange and runs classification immediately — the device is sorted into the right group as an in-memory decision on its very first authentication, without waiting on any database write. The resulting endpoint and certificate record are then persisted off the authentication path: the write is enqueued to an async writer and lands on the next cache refresh, so the auth reply is never held up by a database write (this also keeps authentication answering from cache during an HA failover). Classification is therefore effective at authentication time, even though the stored row appears a moment later. On later, non-TLS authentications, the stored certificate data is reused.

For cert_issuer rules, the CA you selected is resolved to its subject DN and compared to the endpoint’s issuer using DN normalisation, so both OpenSSL one-line form (/DC=pro/DC=taranac/CN=Root CA) and RFC 2253 form (CN=Root CA,DC=taranac,DC=pro) compare equal. If the CA is later disabled or deleted, the rule stops matching.

Out of the box Taranac seeds vendor-based rules so common devices classify themselves:

Taranac includes a classification tester: enter a MAC (optionally a vendor override, certificate identity, certificate issuer, or hostname) and it shows exactly which groups the device would join and which rules fired — grouped by target group, with no side effects. Use it to validate a new rule against a real or hypothetical device before relying on it in policy.

MAC:           80:5E:C0:11:22:33
Vendor:        (auto-resolved from OUI, or override here)
Cert identity: PC-LAB1.taranac.pro
Hostname:      PC-LAB1

The OUI database is a local copy of the IEEE MA-L registry — roughly 35,000 MAC-prefix-to-manufacturer mappings. It does two jobs: it fills in the vendor name on every endpoint, and it powers vendor_name and oui_prefix classification rules and their search pickers.

• First start — Taranac tries to download the registry from IEEE, and falls back to a bundled snapshot if IEEE is unreachable, so vendor lookups work even offline.
• Weekly refresh — an automatic weekly sync from IEEE keeps it current (controlled by the nac.oui_auto_update setting).
• Manual refresh — you can trigger an update from IEEE on demand. If IEEE is temporarily unavailable the request fails cleanly and the existing data is left intact.

Auto-VLAN printers. Leave the seed Printers rules in place (HP, Canon, Epson, Xerox, Brother). Any printer from those vendors classifies into Printers on first sight; point your NAC policy for the Printers group at the printer VLAN. New printers from a vendor not yet covered: add one vendor_name rule.

Corporate machines by certificate. Issue machine certificates from your internal CA and add a cert_issuer rule on Corporate Devices selecting that CA. Every domain machine that authenticates with EAP-TLS lands in Corporate Devices on its first authentication — far stronger than matching by MAC, which can be spoofed.

BYOD by certificate identity or hostname. A cert_identity_pattern of *.byod.corp.local, or a hostname_pattern like IPHONE-*, can funnel personal devices into BYOD for a restricted access profile.

Cameras and IoT segmentation. The seed Security Cameras (Hikvision, Dahua) and IoT / Sensors (Raspberry Pi, Espressif) rules give you ready-made groups to drop onto isolated segments.

Location plus type. Create a Building A group with an oui_prefix or mac_pattern rule, and keep the type-based groups too. A camera in Building A ends up in both Security Cameras and Building A — match either or both in policy. This is exactly what all-matches semantics enables.

You can create an endpoint manually by entering its MAC, an optional name and description, and the groups it should join. Manually created endpoints are static, so they are never cleaned up automatically. Manual creation assigns only the groups you choose — it does not run classification rules — so pick the groups explicitly.

Each endpoint offers one-click actions:

Reassign is a replace-set operation: the list you submit becomes the complete membership. The server works out which memberships to add and which to drop, and records the change in the audit log. All quick actions are idempotent.

The same operations are available in bulk over a selection of endpoints — bulk delete, bulk block, bulk pin, and bulk reassign.

• NAC overview — where endpoints fit in the access-control flow.
• Policy — using endpoint groups as authorisation conditions.
• Authentication — the 802.1X / MAB / EAP-TLS flows that discover endpoints.
• Captive portal — guest and BYOD registration that creates endpoints.
• PKI — the CAs referenced by cert_issuer classification rules.
• Deployment bundle & docs: github.com/TaranacLabs/taranac