TotalHealNetworkGateNetwork Access Control (NAC)
Decides which devices join your wired and wireless network and in which VLAN — by device certificate, health and policy — and moves a compromised device to quarantine the moment the SOC acts.
Trial: 30 days, up to 50 endpoints. You sign in to the TotalHeal console with a Sttiz account and activate NetworkGate NAC. No card.
Anyone who plugs into a meeting-room port or learns the Wi-Fi password is on the same network as finance and the plant. Laptops that have stopped patching, printers and cameras that can never run an agent, contractors and guests all share it, and when a laptop is compromised the network keeps carrying its traffic until someone walks to the switch.
NetworkGate runs a RADIUS server of its own at each site in the TotalHeal server agent. Switches and wireless controllers ask it about every device: managed laptops sign in with certificates and are admitted by their UEM compliance, printers and cameras are admitted by registration, guests by sponsored accounts, and everything else is refused — with each decision, port and VLAN visible in the console. Quarantine from an incident moves the device at once.
NetworkGate NAC, feature by feature.
802.1X with device certificates
EAP-TLS over RADIUS: the device presents a certificate from your enterprise authority or the TotalHeal NetworkGate authority; revoked serials are refused; the certificate names identify the managed device. MS-MPPE keys are returned for WPA2 / WPA3-Enterprise Wi-Fi.
Devices TotalHeal already knows
Managed laptops and desktops are recognised from TotalHeal UEM inventory (every Ethernet and Wi-Fi MAC address) and admitted by their compliance with your device policy: compliant, in grace, not compliant.
MAC authentication for what cannot do 802.1X
Printers, cameras, phones and IoT are admitted by registration (name, group, VLAN); an unknown MAC is refused and raises an alert (MITRE ATT&CK T1200 Hardware Additions).
Guests
Sponsored guest accounts with an expiry for the controller’s guest sign-in page (PAP); the password is shown once and stored only as a salted hash.
VLANs by policy
Ordered rules over how the device signed in, what it is (managed, registered, guest, unknown), its compliance, quarantine, registered group, MAC vendor, site and SSID — allow, quarantine VLAN, guest VLAN or refuse — sent to the switch as RFC 3580 VLAN attributes. Rules are edited in the console, never as JSON.
Monitor before you enforce
Monitor mode admits every device unchanged and records what enforcement would do, so refused devices can be registered before anyone is locked out.
Quarantine that takes effect now
Quarantining a device from the console or a playbook sends a RADIUS change of authorisation (RFC 5176) to the switch it is on; it re-authenticates straight into the quarantine VLAN. A device isolated by an EDR response, and optionally one with an open critical alert, is quarantined too.
Who is where
Every device that asked: managed device or registration, switch, port, SSID, IP address from accounting, VLAN, rule and reason, online or offline, with its history of decisions and sessions.
Runs at your site
The RADIUS server runs in the TotalHeal server agent on a Linux server at each site, keeps its last policy on disk and keeps answering if the internet link to the cloud is down. Its EAP-TLS key never leaves it; its certificate is issued from its own signing request.
Switch secrets handled carefully
Each switch or controller gets a generated shared secret, shown once, sealed at rest, delivered only to your NetworkGate servers and rotated in one click; requests from unknown addresses or with a wrong secret are dropped.
Alerts in the same incident queue
Unknown devices and quarantines join endpoint, identity and cloud alerts, and go on to your SIEM, ticketing and playbooks.
How NetworkGate NAC works.
NetworkGate runs a RADIUS server of its own at each site. Switches and wireless controllers ask it about every device; it admits managed devices by certificate and UEM compliance, registered printers and cameras by MAC, guests by sponsored account, refuses the rest, and moves a device to the quarantine VLAN the moment the SOC acts.
- ConnectTurn on NetworkGate in the server agent at the site and add your switches and controllers.
- MonitorEvery device is admitted unchanged while NetworkGate records what enforcement would do.
- RegisterRegister the printers, cameras and IoT it found; give guests sponsored accounts.
- EnforceDevices land in their VLANs by certificate, compliance and policy; unknown devices are refused.
- ContainQuarantine from an incident disconnects the device at its switch into the quarantine VLAN.
Platforms and deployment
Platforms
| Platform | How it is covered |
|---|---|
| NetworkGate server | TotalHeal server agent on Ubuntu, Debian, RHEL, Rocky Linux or AlmaLinux at each site (networkgate.enabled); UDP 1812 / 1813 |
| Switches and wireless controllers | Any with RADIUS (RFC 2865 / 2866), 802.1X, MAC authentication and VLAN assignment (RFC 3580); change of authorisation needs RFC 5176 (UDP 3799) |
| Devices | EAP-TLS supplicants (Windows, macOS, Linux, iOS, Android) with a device certificate; MAC authentication for printers, cameras and IoT |
| Console | TotalHeal web console |
Deployment
| Profile | Status |
|---|---|
| SaaS (India region) | AvailablePolicy and visibility in the cloud; the RADIUS server at your site. |
| On-premises control plane | AvailableDelivered with our team from the on-premises kit. |
| Air-gapped | AvailableOffline kit, offline licence file and offline update bundles. |
Essential, Professional or Elite.
Priced per endpoint per year. Counted: devices admitted to the network in the billing period.
| Feature | EssentialUS$15per endpoint per year | ProfessionalUS$24per endpoint per year | EliteUS$36per endpoint per year |
|---|---|---|---|
| RADIUS at each site in the TotalHeal server agent; managed devices recognised from UEM inventory; MAC authentication by registration | |||
| VLAN policy rules, monitor mode, who-is-where sessions and events, alerts in the incident queue | |||
| 802.1X EAP-TLS with device certificates from your authority or the NetworkGate CA | |||
| Sponsored guest access with expiry | |||
| Quarantine that takes effect now (RADIUS change of authorisation): by hand, on EDR isolation, on open critical alerts |
List prices per endpoint per year; minimum 100 endpoints. Each tier includes everything in the tier before it. Volume, multi-product and partner pricing on request.
NetworkGate is sold on its own, outside the editions.
Government profile. Government is a profile, not a separate tier or price list: the Elite tier with Government defaults switched on — data residency in India, four-eyes approval of policy changes, a distinct approver for every approval-level action, retention of at least 180 days, and the CERT-In and DPDP reporting clocks.
What you need
- A Linux server at each site running the TotalHeal server agent with networkgate.enabled, reachable from the switches on UDP 1812 / 1813
- Switches and controllers configured with NetworkGate as their RADIUS server (802.1X and / or MAC authentication), and change of authorisation allowed from it
- For 802.1X: device certificates from your enterprise authority or the NetworkGate authority (UEM can deliver profiles)
Procurement documents for NetworkGate NAC
The datasheet is public. The full dossier is sent on request, so we can match it to your tender.
- Datasheet. What the product does, platforms, deployment profiles, tiers and honest limits.
- Compliance matrix. Each requirement marked comply, partial or no, with an evidence reference — CERT-In directions, DPDP, ISO 27001 controls touched, accessibility of the console, data residency.
- Bill of materials. SKUs per sizing, the unit and quantity formula, customer-side components and services.
- Architecture and hardening. How the product is deployed and the hardening guidance for each component.
- SLA. Support tiers, response targets the team can meet, update cadence and end-of-life policy.
- OEM authorisation letter. A MAF template for resellers and system integrators, with product names exactly as on the SKU.
Works well with
Get a quote for NetworkGate NAC.
Tell us how many endpoints you need and how you want to deploy. We reply with a quote and the procurement documents you ask for.
Or email business@totalhealsecurity.com.