Network devices

A network device in Taranac represents a single network access server (NAS) — a switch, router, firewall, VPN concentrator, or access point — that sends TACACS+ or RADIUS requests to the platform. A device record tells Taranac three things: where the NAS lives on the network (its IP), which secret to use when talking to it, and which protocols it participates in (TACACS+, RADIUS, NAC, or any combination).

Devices are also one half of the WHERE dimension in AAA and NAC policy: a policy rule can match on an individual device or on a device group, so you decide which administrators can do what on which equipment. This page covers registering devices, organising them into groups, the network objects that anchor their addresses, and — most importantly — how shared secrets are inherited along the device → group → global chain.

You manage all of this under Infrastructure → Network in the admin UI.

Open Network → Devices and click New. The form is split into an identity column and a protocol/secrets column.

The Devices list: name, network object, vendor/platform, enabled protocols, location, status, and group count.

Identity fields

Protocol support. Three toggles — TACACS+, RADIUS, and NAC — declare which protocols this device speaks. All three are on by default. They gate which secret fields appear:

• TACACS+ on → shows the TACACS+ Key field and the Single Connection toggle.
• RADIUS or NAC on → shows the RADIUS Secret field (NAC rides on the RADIUS protocol, so it reuses the RADIUS secret).
• NAC on → shows a CoA Settings block with CoA Secret, CoA Port, and an optional Vendor Dictionary selector.

A device with a protocol disabled is left out of that protocol’s generated daemon config entirely.

Single Connection (TACACS+ only): when enabled, the device reuses one TCP session for all authentication, authorization, and accounting exchanges.

Enabled toggle: a disabled device is excluded from all AAA/NAC processing — no config is generated for it and no daemon reload references it.

The TACACS+ Key, RADIUS Secret, and CoA Secret fields all behave the same way and are stored encrypted at rest:

• Leaving a secret empty means “inherit” — the device falls back to its group, then to the global default (see below). The form shows the inherited source as help text.
• On an existing device, a stored secret displays as a placeholder (••••••••). Submitting it unchanged keeps the current value; clearing it to empty removes the override (falling back to inheritance); typing a new value replaces it.
• The reveal (eye) action decrypts and shows a secret in plain text. This is audit-logged — every reveal records who looked and when.
• The generate action opens a generator to create a strong random secret.
• Secrets may contain letters, digits, and most punctuation, but not spaces, single/double quotes, backticks, backslashes, ?, or $.

When NAC is enabled, the CoA block configures how Taranac pushes Change-of-Authorization or disconnect packets to the device:

• CoA Secret — encrypted; inherits like any other secret if left empty.
• CoA Port — an integer 1–65535. Typical values are 3799 (RFC 5176) or 1700 (Cisco legacy). Leaving it empty inherits the group/global value, and if nothing is set anywhere Taranac uses 3799 as the built-in default.
• Vendor Dictionary (CoA) — selects how CoA attributes are encoded. Leave it empty to auto-detect from the device’s vendor.

Open Network → Device Groups to create a group, then attach devices to it. A group has a name, optional description, its own TACACS+ Key / RADIUS Secret / CoA Secret / CoA Port, and tags. Members are managed on the group’s edit page (add or remove devices); membership changes are saved together with the rest of the form.

Groups serve two purposes:

1. Shared defaults. Set a secret once on the group and every member device that has no per-device override inherits it.
2. Policy granularity. A policy rule can reference a whole group instead of listing devices one by one.

A device can belong to multiple groups. Deleting a group does not delete its member devices — it only removes the membership links.

Every secret (TACACS+ key, RADIUS secret, CoA secret, and CoA port) resolves along a fixed three-level chain. The first level that has a value wins:

Device  →  Device group  →  Global default

• Device level — a value set directly on the device always takes precedence.
• Group level — if the device has no own value, Taranac walks the device’s groups oldest group first (ordered deterministically by creation time) and uses the first group that has a value.
• Global level — if neither the device nor any group supplies a value, the global system setting is used.

The global defaults live in system settings:

CoA port and CoA secret are resolved independently along the same chain — a device can pick up its secret from a group while still taking the global (or default 3799) port if no level sets one.

AAA and NAC policy rules use devices to answer “on which equipment does this rule apply?” — the WHERE dimension. A rule can target:

• Specific devices — pick individual NAS records, or
• Device groups — match every member of a group.

Pairing this with the source dimension (network objects = the client’s IP) and the when dimension (time ranges) lets you write rules such as “network engineers may run show/config commands on the core-switches group, on weekdays, from the NOC subnet.” See AAA policy for how the WHERE dimension combines with identity, source, and time conditions.

One global key, a few exceptions. Set tacacs.global_key once. Every device inherits it. For the handful of legacy boxes that need a different key, set the key directly on those devices — they override the global value while everything else keeps inheriting.

Per-vendor CoA. Create groups aruba and cisco. Put CoA port 3799 on the first and 1700 on the second. Add each controller to the right group. CoA pushes now use the correct port per vendor with no per-device configuration.

Site-specific RADIUS secret. Create a group per site (site-emea, site-apac), set the RADIUS secret on each, and add the site’s devices. Devices inherit the site secret; a device that needs its own secret simply sets one and overrides the group.

Decommissioning. Disable a device (uncheck Enabled) to pull it out of all config generation without deleting its record or history. Delete it only when you no longer need the audit trail.

Devices, device groups, and network objects can all be exported and imported (XLSX, CSV, or JSON), with an explicit opt-in to include decrypted secrets in the export.

• AAA policy — how devices and device groups drive the WHERE dimension.
• Project repository