Simgenet NAC Server — Industrial Network Access Control (802.1X, TACACS+, PKI)

Simgenet NAC Server — Industrial Network Access Control

Simgenet NAC Server is a network access control server that identifies every device joining the network and every person administering network devices, authorises them by role and records every decision. A Core defines the policy; Site nodes in the field run the same software and answer the requests of switches and access points locally. Designed for industrial networks: device identity by certificate, MAC-based for IEDs/PLCs, administrator access via TACACS+; when the centre is lost, the site keeps running. The software is developed entirely in-house at Simgenet; it is not an adaptation of an off-the-shelf package.

Built for Industrial Reality

Enterprise NAC products think like a city centre: user laptops, guest portals, a permanent link to the centre. In the field there are IEDs, PLCs, RTUs and cameras; the WAN goes down; the engineer logs into the switch from the console. Instead of guest portals and user agents, NAC Server is built on device identity, local continuity and device administration, and was developed together with our own switch (SMG-SW), time server (GNSS Server) and test platform (SVP).

Who May Connect: 802.1X, MAB and Dynamic Authorisation

• Authentication: IEEE 802.1X EAP-TLS (device certificate and chain validation; certificate–MAC match is part of the decision) · PEAP / EAP-TTLS (local user database) · MAB for IEDs, PLCs, cameras and sensors without certificates; MAC-spoofing suspicion detection · unregistered device: reject or monitoring VLAN.
• Authorisation and enforcement: role → VLAN (RFC 3580), Filter-Id → access list and vendor attributes for dynamic ACLs · port class (timing / protection / general): ports carrying timing are recognised · CoA / Disconnect (RFC 5176) for session teardown, VLAN change and re-authorisation from the centre · quarantine and time-limited, audited break-glass exceptions.
• Monitor mode → enforce mode: every deployment starts in monitor mode — decisions are produced, reported but not enforced; the inventory fills and profiles are verified; switching to enforcement is an administrator decision, reversible with one click.
• Device profiling and inventory: passive collector (OUI, DHCP, SNMP), OT device library (relays, RTUs, PLCs, IEDs, GNSS/PTP), bulk import and API; Simgenet devices are recognised instantly.
• "Why was it rejected?" on one screen: the live authentication log lists every attempt with time, MAC, identity, profile, switch/port, policy, rejection reason and continuity state.

The Centre Goes Down, the Site Keeps Running: Core, Site Node and Standby Core

One software, two roles. Policy, inventory, PKI and reporting live in the core; authentication requests are answered in the field, at the nearest node, within milliseconds. Everything between core and site is signed and versioned.

• Site node on its own: the last approved policy and the local decision table live on the node; 802.1X/MAB and dynamic-VLAN decisions continue when the WAN is down — up to 30 days without the centre (configurable). Continuity modes (normal → restricted → continuity) are visible in the panel and the event log; when the link returns, events are forwarded and the policy gap closes automatically.
• Standby core and load sharing: the second core stays in sync; it takes over when the primary fails and hands back when it returns; single-writer principle. Site nodes are spread across the two cores by "home core" selection — no idle capacity. The switch knows several nodes as RADIUS/TACACS+ servers.
• Change safety: policy and device records are distributed as signed, generation-numbered packages; validated → applied → confirmed stages; a faulty generation is rolled back in one step. Software updates follow the same path: signed package, A/B installation, rollback.

Who May Administer: RADIUS and TACACS+ Device Administration

• RADIUS: administrator login with privilege level (admin / operator / viewer), RFC 2865/2866/2869; Message-Authenticator mandatory in both directions (closed to BlastRADIUS-class attacks); accounting; RadSec (RADIUS/TLS, RFC 6614) server; Status-Server.
• TACACS+ (RFC 8907): authentication, session privilege level 0–15, command authorisation — administrator-defined command sets (permit/deny patterns) and ready-made classes (view / no-config / full); every command decision in the audit log; TACACS+ over TLS 1.3 (RFC 9887).
• Identity sources: local user and device database; LDAP/AD; external RADIUS and TACACS+. Time trust (GNSS/NTP source, certificate validity window) is part of the decision.

Built-in PKI: Certificates Are Never Carried by Hand

Internal certificate authority (CA) with profile-based issuance; SCEP (RFC 8894) and EST (RFC 7030) for automatic device enrolment and renewal (the old certificate is revoked automatically on re-enrolment); OCSP responder and CRL (signed distribution to sites); revocation checking in EAP-TLS — a revoked certificate is rejected immediately; certificate-lifetime alarms (90/60/30 days).

Management, Monitoring and Integration

HTTPS web panel (TR/EN/FR, role-aware): status dashboard (continuity mode, accept/reject/monitor, policy generation, decision rate), live authentication log, devices, switches, sites, distribution, core HA, continuity readiness, certificate diagnostics, switch recipes. SNMPv3 (authPriv) + SIMGENET-NAC-MIB + notifications; syslog CEF over TLS straight to the SIEM; X.733 alarm management; daily report (JSON/CSV/API, 730-day retention); REST API; one-click support bundle (secret-free). Backup/restore, signed updates, A/B rollback.

Simgenet Ecosystem and Third-Party Devices

Simgenet SMG-SW switches and SMGOS routers: 802.1X authenticator, MAB, dynamic VLAN, Filter-Id, CoA, device-administration RADIUS/TACACS+, common CA — the enforcing side and the deciding side from one vendor. Simgenet GNSS Server: time trust and timing-port awareness. Simgenet SVP: deployment acceptance is measured — 802.1X/MAB/CoA vectors, capacity and takeover time delivered as a report. Standard RADIUS/TACACS+/CoA with third-party switches and access points; ready-made switch recipes for common vendors.

Scale and Acceptance (measured with SVP)

• 400,000+ decisions per day on a single site node; decisions in the field, millisecond class.
• Core takeover < 5 min, failback < 6 min — measured across a 9-site fleet in 3 scenarios; policy distribution to 9 sites < 2 min.
• Operation without the centre for up to 30 days; acceptance test with SVP: 802.1X/MAB/dynamic-VLAN/CoA vectors (known-PASS / known-FAIL), RADIUS security (Message-Authenticator, malformed packets, replay), TACACS+ command authorisation, capacity scale test, takeover/failback — lockable report.

Application Areas

• Power / substation: enrolment of IEDs, PLCs, RTUs and recorders via MAB/EAP-TLS; policy by class of timing and protection ports; regional core + standby core; switch/router administration via TACACS+; IEC 62443-aligned records.
• Rail / industrial plant / government: rejection of non-inventory devices in station and plant networks, gradual transition from monitoring to enforcement, local continuity with the site node, one policy from the centre; central records of administrator access in government networks.

Hardware: the NAC Core runs on Simgenet SMG-NAC104 hardware (1U 19" rack) (Intel® Xeon®, up to 64 GB DDR4, 4 × PCIe Gen3 expansion); the NAC Site node is installed on Simgenet hardware or a virtual machine. Core and site node share one image, the role is selected at installation. The full feature list and reference standards are in the product brochure (EN) under the Documents tab.