Control exactly what each operator may do on your switches and routers. Per-command authorization, privilege levels, enable passwords and console rules — with full command accounting, so every configure and every reload is authorized and logged against a real identity.

Every endpoint gets a name — Computer › Windows › Laptop, Mobile › iOS — with its confidence in words and one sentence saying why the name stops where it does. The evidence comes from wherever a device speaks: a passive DHCP Probe that never sends a byte; a scanner on a site collector that listens, sweeps, identifies and — where you allow it — runs nmap, chosen per zone with the consent audited; SNMP inventory of your switches — model, serial, software, ports, LLDP/CDP neighbours and forwarding tables, down to which switch port a device is plugged into; Web Probe to your own scripts; and what browsers and your directory already say. What no rule explains lands on an honest “not identified” worklist you can hand to an AI assistant and preview before anything changes. Endpoint groups and policy then act on the name — one VLAN for everything under Windows. Read the discovery guide →

Do certificate-based 802.1X the way your network already works. Trust EAP-TLS clients from Taranac’s built-in CA, from AD CS, or from any third-party CA — add as many trusted and AD CAs as you need. Stand up more than one internal root too — say a separate CA for contractors — so revoking a whole group is one move. EST (RFC 7030) enrollment and CRL publication are built in — no separate PKI product.

Back up, version and diff every device’s running config — captured over SSH, Telnet, SCP/SFTP or HTTPS on a schedule or on demand, deduped and pinned to a baseline so drift stands out at a glance. Because Taranac is already your AAA server, each change arrives with who logged in and which commands they ran — the diff and the culprit, side by side. And it can authenticate with a just-in-time password nobody ever sees: minted per collection, 32 random characters, rotated the moment the job is done. Read the config tracking guide →

Run Taranac as a 2–4 node cluster on replicated PostgreSQL, managed for you by Patroni and etcd — one read-write primary, the rest streaming replicas. Because every node answers TACACS+, RADIUS and 802.1X from its own local replica and cache, the authentication data plane never depends on the primary: point your devices at every node, and when one fails failover is automatic — only configuration writes pause for a few seconds. A Pro feature, unlocked by an HA license. Read the HA guide →