Most real-world compromises walk in through stale admin credentials, not exotic exploits. The Peplink platform gives you the controls auditors expect to see on the management plane.
Credentials that don’t go stale
- Random admin password generation — devices can generate strong, random web-UI passwords instead of humans inventing them.
- Automatic rotation every 30 days — the platform rotates admin passwords on schedule, so a credential that leaks has a short life. Managed fleets get this across every device from InControl 2.
- Changeable admin username — retire
adminentirely. Attackers guessing at default usernames start with nothing.
Centralized authentication: TACACS+ and RADIUS
Router administration can authenticate against your existing TACACS+ or RADIUS infrastructure, so admin access follows your directory: joiners and leavers are handled centrally, access is logged where your SIEM already looks, and there are no local snowflake accounts to forget about. Firmware 8.6 adds RadSec (RADIUS over TLS) so even the authentication traffic is encrypted in transit.
802.1X on the LAN edge
802.1X port-based network access control is supported on router LAN ports and on Peplink PWS-series switches, so an open office jack authenticates the device plugged into it before granting network access. Support for the PLS switch line is on the roadmap — ask us about timing if PLS is in your build. Pair 802.1X with grouped MAC policies for defense in depth on the physical edge.
Hardening checklist
- Change the admin username; enable random password generation + 30-day auto-rotation.
- Point admin auth at TACACS+/RADIUS (RadSec on 8.6) so access follows your directory.
- Turn on 802.1X for user-facing ports on routers and PWS switches.
- Disable the console port unless engineering needs it (console & management ports guide).