🔐
Full-Featured RADIUS Server
Built-in RADIUS with the complete EAP stack — EAP-TLS, PEAP-MSCHAPv2, EAP-TTLS, EAP-FAST, and CHAP. Handles wired 802.1x, wireless, and VPN simultaneously with per-realm policy routing and real-time auth logs.
🏛️
Agent-Based PKI & Certificate Authority
NACIO ships with a complete internal CA. Issue and manage machine certificates and user certificates directly from the console. Deploy via agent to Windows and macOS — fully automates EAP-TLS without any third-party PKI.
☁️
Azure AD, SAML & Identity Federation
Connect Active Directory, Azure AD, Okta, Google Workspace, Entra ID, SAML 2.0, LDAP, RADIUS proxy, and NACIO's local user DB. Mix identity sources per realm — use cert auth for corporate, SAML for BYOD, local for guests.
🖥️
Device Profiling & Fingerprinting
Automatically classify endpoints by OS, vendor, and device type using DHCP fingerprinting, HTTP user-agent, and network behaviour analysis. Profiling runs entirely on your own infrastructure — or leverage NACIO's cloud-assisted profiling service to cross-reference a continuously updated device signature database without sending any sensitive data off-site.
📋
Remote Agent — Self-Hosted or Cloud
The NACIO agent runs on Windows and macOS to verify patch level, antivirus, disk encryption, firewall status, and custom rules before granting access. Deploy in fully self-hosted mode — agents phone home to your on-premise NACIO server — or connect to a NACIO cloud-hosted instance for organisations that prefer a managed control plane with no on-site server to maintain.
🌐
Captive Portal
Fully customisable guest portals with sponsor approval, SMS/email verification, social login, and time-limited access. Works with any CAPWAP-compatible access point.
🗺️
Remote Probes via Secure Tunnels
Deploy lightweight probe agents at remote sites over encrypted secure tunnels — no VPN or open firewall ports required. Install directly from the NACIO console and the probe establishes an outbound encrypted connection back, extending full NAC enforcement to branch offices, remote sites, and air-gapped segments.
🏢
Multi-Organisation
Segment policies, portals, and endpoints by organisation. Ideal for MSPs managing multiple clients from a single NACIO deployment.
⚡
Policy Engine & Dynamic VLAN
Assign users and devices to VLANs, ACLs, and bandwidth policies based on identity, device type, compliance posture, time-of-day, and location.
📡
DHCP Server Integration
Built-in DHCP server with scope management and lease tracking, or integrate with your existing infrastructure. DHCP fingerprinting feeds directly into device profiling.
🔍
Network Discovery & Scanner
Active and passive network scanning to discover every device on your subnets — including those that never authenticate. NACIO maps IP ranges, resolves hostnames, fingerprints open ports and services, and flags rogue or unmanaged devices before they become a threat. Discovery results feed directly into the endpoint inventory and profiling engine.
📊
Real-Time Dashboard
Live view of authentication activity, endpoint health, compliance status, and network events. Drill down from any metric to the individual endpoint or user.
🔄
High Availability
Active-passive HA with automatic failover so authentication is never a single point of failure. State is continuously synchronised across nodes — sessions, leases, and endpoint records persist through a failover. Deploy two NACIO nodes behind a load balancer or use built-in heartbeat-based promotion with no manual intervention required.
