Access Control

Every admin login, one set of rules

Shared "admin" passwords on every switch are the first thing an auditor asks about. With Access Control your switches, routers and firewalls ask Uplivra who may log in. Each person uses their own name: either a login you create in Uplivra, or their Active Directory or LDAP account through the groups you pick.

Rules say who may log in where:

• by group, device type, tag, site, time of day or maintenance window;
• with which privilege level or device role.

The first rule that fits decides. Try a rule shows what would happen, rule by rule, before anyone depends on it.

Commands, checked one by one

With TACACS+ the device asks Uplivra before every command. Command sets list what each group may run:

• allow or deny a command start or a pattern;
• approve: a second person approves it first.

Risky commands such as reload, write erase or no aaa wait for that approval and then run once. Every command is recorded with who ran it, where and when.

Temporary admin access

For a change window or an incident, ask for higher rights on chosen devices for a set time, with a reason and a ticket number. A second person approves it, the clock starts, and the access ends by itself. Uplivra records everything done under it against the ticket.

The device commands, written for you

Pick a network device and its maker. Uplivra writes the commands that point it at the Access Control service:

• a check before you start;
• a local fallback login;
• a test from a new session;
• the way back.

Port access (MAB)

Devices that can't log in (printers, cameras, phones) are let onto access ports by MAC address, maker or the type Uplivra already found. Each kind can be put in its own VLAN. Start in monitor mode: nothing is blocked, and the log shows what would have been, so you can switch to enforcing with confidence. Laptops and phones can use 802.1X with certificates (EAP-TLS) instead, with the VLAN from your rules and Wi-Fi keys handed to the access point. RadSec carries RADIUS over TLS, port sessions let you disconnect or recheck a device (change of authorization), and you can import your devices from ISE, ClearPass or NPS keeping their shared secrets.

Keeps working when a link is down

Put an Access Control node at each site: a small Linux or Windows machine that answers your devices from a signed copy of the rules. Logins keep working when the main Uplivra server, or the link to it, is down. Two nodes make a pair that share everything (the log, the newest rules, each other's health) over mutual TLS: HTTPS across sites, a direct encrypted link in the same site. Each node keeps its own encrypted store, and the main server stays the one place you change rules and read the log. Nodes are included at no extra cost. How nodes work

One node answers about 20,000 TACACS+ command checks or 400 full 802.1X certificate logins a second on 2 CPU cores, far more than a small or mid-size business needs. The second node is for staying up. Sizing

See it, prove it

• Dashboard: success rate, response times, failures by reason, person and device, and devices sending with the wrong key.
• Findings: failed logins followed by an admin login, admin logins from a new address, logins from two sites at once, unusual hours. Each is marked informational, suspicious or high risk; findings alert people and never block anyone by themselves.
• Records for audits: the log is kept for a year by default (PCI DSS 10.5.1), searchable and exportable. Admin sessions through Uplivra's browser terminal are recorded command by command, and can be flagged, blocked or ended live.

Built in, not bolted on

Uplivra's TACACS+ and RADIUS servers are Uplivra's own code, written from the standards (RFC 8907, 2865 and 2866). RADIUS requires Message-Authenticator by default, so it's protected against the Blast-RADIUS attack. Shared keys are random and different for every device, and stored encrypted. Device passwords can live in the Secrets vault and change on a schedule.

Pricing

$5 per network device per month: each switch, router, firewall or controller that asks Uplivra. People, endpoints and ports don't count. See pricing · Read the guide