Verified vendor support
Every capability below is labeled with the trust it has actually earned. Verified on hardware means the exact behavior was exercised end to end on lab equipment. Templated means the implementation is written from the vendor’s own documentation, with command wrapping and rejection detection, but has not yet run against that platform here — treat the first use as a supervised pilot, and tell us: templated families are promoted by exactly one successful supervised run.
Network enforcement & AAA — proven end to end
| Capability | Status | Proof |
|---|---|---|
| 802.1X EAP-TLS with dynamic VLAN assignment | Verified on hardware | Catalyst 3850 (IOS-XE 16.12.9), machine certificates via Active Directory auto-enrollment. |
| MAC Authentication Bypass (MAB) with profiling | Verified on hardware | Catalyst 3850; DHCP/OUI/LLDP and device-sensor signals feed the endpoint profile. |
| Downloadable ACLs (dACL) | Verified on hardware | Catalyst 3850: per-user ACL installed on both the CoA push and the Access-Accept path. |
| Change of Authorization (CoA): reauth, quarantine, port bounce | Verified on hardware | Cisco IOS-XE and Juniper EX4300 (Junos 21.4R3). |
| Juniper dACL (filter via RADIUS) | Templated | Rendered and unit-tested; not yet exercised on an EX in this lab. |
| Device-admin TACACS+ (authentication, per-command authorization, accounting) | Verified on hardware | Cisco ISR4321 (IOS-XE 17.12); per-host secrets, command grants, full auth log. |
| RADIUS survivability fail mode (Do‑Not‑Respond) | Verified on hardware | With the appliance down or its decision service stopped, FreeRADIUS answers nothing rather than rejecting — switch-side critical-auth keeps ports working. See RADIUS survivability & standby. |
Credential rotation, by platform
The Credential Vault rotates device logins, SNMP users and TACACS/RADIUS shared secrets in lockstep (device, servers and vault change together, or not at all). Platform coverage:
| Platform | Status | Notes |
|---|---|---|
| Allied Telesis AlliedWare Plus (IOS-like) | Verified on hardware | Exercised end to end on lab hardware (device login, SNMP and TACACS/RADIUS secret rotation). |
| Arista EOS | Templated | Full templates, wrap and rejection detection written from vendor documentation — not yet exercised on hardware here. |
| Aruba AOS-CX | Templated | Full templates, wrap and rejection detection written from vendor documentation — not yet exercised on hardware here. |
| Aruba AOS-Switch (IOS-like) | Verified on hardware | Exercised end to end on lab hardware (device login, SNMP and TACACS/RADIUS secret rotation). |
| Brocade/Ruckus ICX | Templated | Full templates, wrap and rejection detection written from vendor documentation — not yet exercised on hardware here. |
| Cisco IOS (classic — legacy tacacs-server host grammar) | Verified on hardware | Exercised end to end on lab hardware (device login, SNMP and TACACS/RADIUS secret rotation). |
| Cisco IOS-XE (named tacacs server block) | Verified on hardware | Exercised end to end on lab hardware (device login, SNMP and TACACS/RADIUS secret rotation). |
| Cisco IOS-XR | Templated | Full templates, wrap and rejection detection written from vendor documentation — not yet exercised on hardware here. |
| Cisco Meraki | Not supported | Meraki is dashboard/API managed — there is no device CLI to push credentials to |
| Cisco NX-OS | Templated | Full templates, wrap and rejection detection written from vendor documentation — not yet exercised on hardware here. |
| Cumulus Linux | Not supported | Cumulus Linux uses Linux accounts/sudo; not a network-CLI credential model |
| Dell OS10 | Templated | Full templates, wrap and rejection detection written from vendor documentation — not yet exercised on hardware here. |
| Extreme EXOS | Templated | Full templates, wrap and rejection detection written from vendor documentation — not yet exercised on hardware here. |
| Fortinet FortiOS | Templated | Full templates, wrap and rejection detection written from vendor documentation — not yet exercised on hardware here. |
| HPE Comware | Templated | Full templates, wrap and rejection detection written from vendor documentation — not yet exercised on hardware here. |
| Huawei VRP | Templated | Full templates, wrap and rejection detection written from vendor documentation — not yet exercised on hardware here. |
| Juniper Junos | Templated | Full templates, wrap and rejection detection written from vendor documentation — not yet exercised on hardware here. |
| MikroTik RouterOS | Templated | Full templates, wrap and rejection detection written from vendor documentation — not yet exercised on hardware here. |
| Nokia SR OS | Templated | Full templates, wrap and rejection detection written from vendor documentation — not yet exercised on hardware here. |
| Palo Alto PAN-OS | Not supported | PAN-OS sets admin passwords interactively (or by hash); manage it through its API/Panorama |
NAC RADIUS secret rotation, by CLI family
Rotating the 802.1X shared secret a switch uses against this appliance (the NAS side of NAC) is a separate, per-family stanza:
| CLI family | Status | Notes |
|---|---|---|
| Juniper Junos | Verified on hardware | The exact stanza was committed on lab hardware (EX4300-48P, Junos 21.4R3). |
| Aruba AOS-CX | Templated | Written from the vendor’s documented 802.1X configuration — not yet exercised here. |
| HPE Comware | Templated | Written from the vendor’s documented 802.1X configuration — not yet exercised here. |
| Cumulus Linux | Not applicable | Not an 802.1X authenticator platform (no NAC RADIUS stanza to manage). |
| Arista EOS | Templated | Written from the vendor’s documented 802.1X configuration — not yet exercised here. |
| Extreme EXOS | Templated | Written from the vendor’s documented 802.1X configuration — not yet exercised here. |
| Fortinet FortiOS | Not applicable | Not an 802.1X authenticator platform (no NAC RADIUS stanza to manage). |
| generic | Not applicable | Not an 802.1X authenticator platform (no NAC RADIUS stanza to manage). |
| Huawei VRP | Templated | Written from the vendor’s documented 802.1X configuration — not yet exercised here. |
| Brocade/Ruckus ICX | Templated | Written from the vendor’s documented 802.1X configuration — not yet exercised here. |
| Allied Telesis AlliedWare Plus (IOS-like), Aruba AOS-Switch (IOS-like), Cisco IOS (classic — legacy tacacs-server host grammar), Cisco IOS-XE (named tacacs server block) | Templated | Written from the vendor’s documented 802.1X configuration — not yet exercised here. |
| Cisco IOS-XR | Not applicable | Not an 802.1X authenticator platform (no NAC RADIUS stanza to manage). |
| Cisco Meraki | Not applicable | Not an 802.1X authenticator platform (no NAC RADIUS stanza to manage). |
| Cisco NX-OS | Templated | Written from the vendor’s documented 802.1X configuration — not yet exercised here. |
| Dell OS10 | Templated | Written from the vendor’s documented 802.1X configuration — not yet exercised here. |
| Palo Alto PAN-OS | Not applicable | Not an 802.1X authenticator platform (no NAC RADIUS stanza to manage). |
| MikroTik RouterOS | Templated | Written from the vendor’s documented 802.1X configuration — not yet exercised here. |
| Nokia SR OS | Not applicable | Not an 802.1X authenticator platform (no NAC RADIUS stanza to manage). |
Known limits, stated plainly
- TACACS+ privilege mapping to vendor attributes is Cisco-only today
(
shell:priv-lvl); Juniper and Arista administrators authenticate and are command-authorized, but receive no pushed privilege level. - The Bridge Agent’s local vulnerability scan is Windows-only in this release; Linux and macOS agents report inventory, posture and remote support without it.
- ISC dhcpd integrations are read-only (the daemon has no runtime reservation API); Kea and Windows DHCP support reservation write-back.
- DHCPv6 scopes are not yet supported.
- Delta and indirect CRLs are rejected on import — import the full CRL.
- The appliance never rolls a device’s configuration back on its own: config pushes use device-side revert timers you confirm, and the rollback policy action is refused by design.