Functional capabilities of Eltex NAICE version 1.2:

RADIUS-based access control provides the following capabilities:

• Operation with a local user account database;
• User authentication and authorization via the 802.1X protocol;
• Authentication and authorization of network equipment administrators;
• Support for EAP-TLS, EAP-PEAP, MS-CHAPv2 and PAP protocols for access control and protection against unauthorized network connections;
• Endpoint authentication and authorization using MAB (MAC Authentication Bypass), PAP, and EAP-MD5.

TACACS+-based access control provides the following capabilities:

• Authentication and authorization of equipment administrators via the TACACS+ protocol with a specified privilege level;
• Authorization of privilege escalation via TACACS+;
• Authorization of network equipment administrator commands using the TACACS+ protocol;
• Support for ASCII/PAP protocols when using TACACS+.

Integration with external identity sources:

• MS Active Directory (MS AD). Limitations: it is not possible to use Cyrillic characters in user login or password;
• Custom LDAP (e.g., Open LDAP).

External identity source authentication:

• Support for signing in to the NAICE web interface using accounts from external identity sources (MS AD, OpenLDAP);

• Automatic creation of a local copy of an external user account upon the first successful sign-in;

• Synchronization of user attributes (first name, last name, email, status) and role recalculation on each subsequent sign-in;

• Automatic calculation and assignment of a user role based on mapping the user's group membership in the external identity source to the groups configured for NAICE external roles;

• Flexible configuration of role mapping conditions based on groups from an external identity source: 
  

  • Logical AND — a role is assigned only if the user belongs to all specified groups;

  • Logical OR — a role is assigned if the user belongs to at least one of the specified groups. 
    

Portal-based authorization:

• Portal appearance management, support for configuring multiple portals, management of registration and authorization methods; 
• Guest user registration via SMS confirmation;
• User authorization on the portal using login/password with either the local user database or external identity sources.

Flexible security policy system:

• Multivendor solution — the system can operate with products from different vendors that support RADIUS and TACACS+;
• Configuring access rights based on static and dynamic parameters;
• Ability to use user attributes from an external identity source in security policies;
• Assigning privileges according to group membership of users and devices;
• Built-in library of RADIUS attributes. Currently, adding new RADIUS dictionaries and attributes manually is not supported (can be done through a development request);
• Assignment of VLAN, ACL, and other custom attributes over RADIUS;
• Auto-addition of endpoints when attempting to connect via RADIUS;
• Support for endpoint profiling based on MAC OUI and DHCP probes, with the option to use profiling results in security policy configuration.

Centralized management — user and endpoint authentication and authorization are managed via a web interface designed based on experience of developing international products. This enables a fast and easy transition with no need for lengthy training.

Role model:

• Administrator access to the system web interface and its sections based on a role-based access control model (RBAC);
• Creation of roles with precise configuration of access rights to system functions, using five access levels for system sections;
• Assignment of roles to administrators with different privilege levels;
• Predefined roles for typical use cases;
• Termination of active sessions upon role privilege changes to ensure security.

Two-factor authentication (2FA):

• Support for two-factor authentication for signing in to the NAICE web GUI;
• Supported verification methods: TOTP (authenticator application), Email OTP (one-time code sent by email), and backup codes (10 codes for account recovery);
• Self-service 2FA management in the Account settings section (activation, deactivation, and backup code regeneration);
• Protection against code guessing by limiting the number of verification attempts and temporarily locking the user account. 

User account management:

• Automatic account lockout after exceeding the maximum number of failed sign-in attempts (password or 2FA verification codes);
• Flexible configuration of lockout parameters: failed attempt threshold (N), observation window (M minutes), and lockout duration (T minutes);
• Automatic account unlock after the lockout period expires or manual unlock by an administrator;
• Support for scheduled account deactivation with the ability to specify the deactivation period and reason;
• Support for permanent account deactivation by an administrator.

Event logging and monitoring — information on user connections enables tracking of authentication and authorization results and identification of connection issues.

SIEM integration — sending information on connection attempts via RADIUS and TACACS+, as well as NAICE administrator activities, using the Syslog protocol in CEF format.

Built-in documentation — the system contains complete configuration documentation and provides the necessary information in the context of the page where the administrator is located.

Redundancy — ensures reliable operation in an Active-Active configuration and preserves system operability in case of failure.

System distribution

• The system is deployed as Docker containers;
• Installation is available both in environments with Internet access and in isolated environments;
• Ansible scripts are used to automate deployment.

System requirements are described in section: v1.2_2.1 System requirements.