NCP Secure VPN Enterprise Client for Windows 32/64 bit
Universal, Centrally Administrable VPN Client Suite for Windows

Features:

Secure

Rely on high-quality IT security software made in Germany

• IPv6 supported dynamic personal firewall
• data encryption
• strong authentication
• multi-certificate support
• parameter locks
• FIPS Inside
• automatic adaption of firewall rules

Efficient

Mindful of one of the biggest challenges organizations face – cost savings

• Budget Manager for full cost control
• support for 3G/4G hardware (LTE)
• Custom Branding Option
• Central Management

Ease of use

Reduced IT complexity

• a single and easy-to-use user interface (one click) for the connection setup
• integrated support for 3G/4G hardware
• a reliable, uninterrupted VPN connection
• automatic, location-aware adaption of firewall rules through the NCP VPN Client
• automatic media recognition
• seamless Roaming
• easy domain registration

Mobile

The best mobile device user experience

• Working without dropped connections or interruptions even when switching between networks, i.e. seamless roaming
• auto-connect to your corporate network
• reliable and uninterrupted VPN connections
• quick and secure hotspot logon
• Remote Access even behind firewalls, whose port settings typically deny IPsec based communication, i.e. NCP Path Finder® Technology

Technical Data:

Secure VPN Enterprise Client for Windows 32/64 bit: Technical Data
Operating Systems	Microsoft Windows (32 and 64 bit): Windows 10, Windows 8.x, Windows 7, Windows Vista
Security Features	The Enterprise Client supports all major IPsec standards in accordance with RFC
Personal Firewall Firewall Configuration*	Stateful Packet Inspection; IP-NAT (Network Address Translation); Friendly Net Detection (Firewall rules adapted automatically if connected network recognized based on its IP subnet address, the DHCP server’s MAC address or an NCP FND Server); Start FND dependent action; Secure hotspot logon; Differentiated filter rules relative to: protocols, ports, applications and addresses, LAN adapter protection, IPv4 and IPv6 support, Central administration
Virtual Private Networking	IPsec (Layer 3 Tunneling), RFC-conformant; IPsec proposals can be determined through the IPsec gateway (IKEv1/IKEv2, IPsec Phase 2); Event log; communication only in the tunnel; MTU size fragmentation and reassembly, DPD, NAT-Traversal (NAT-T); IPsec tunnel mode
Encryption	Symmetric processes: AES 128,192,256 bits; Blowfish 128,448 bits; Triple-DES 112,168 bits; Dynamic processes for key exchange: RSA to 2048 bits; seamless rekeying (PFS); Hash algorithms: SHA-1, SHA-256,SHA384, SHA-512, MD5, DH group 1,2,5,14-21, 25, 26
FIPS Inside	The IPsec Client incorporates cryptographic algorithms conformant with the FIPS standard. The embedded cryptographic module incorporating these algorithms has been validated as conformant to FIPS 140-2 (certificate #1051). FIPS conformance will always be maintained when any of the following algorithms are used for establishment and encryption of the IPsec connection: DH Group: Group 2 or higher (DH starting from a length of 1024 Bit) Hash Algorithms: SHA1, SHA 256, SHA 384, or SHA 512 Bit Encryption Algorithms: AES with 128, 192 and 256 Bit or Triple DES
Authentication Processes	IKE (Aggressive Mode and Main Mode, Quick Mode); XAUTH for extended user authentication; IKE config. mode for dynamic assignment of a virtual address from the internal address pool (private IP); PFS; PAP, CHAP, MS CHAP V.2; IEEE 802.1x: EAP-MD5 (Extensible Authentication Protocol): Extended authentication relative to switches and access points (Layer 2); EAP-TLS (Extensible Authentication Protocol - Transport Layer Security): Extended authentication relative to switches and access points on the basis of certificates (Layer 2); support of certificates in a PKI: Soft certificates, smart cards, and USB tokens: Pre-shared secrets, one-time passwords, and challenge response systems; RSA SecurID ready
Strong Authentication	X.509 v.3 Standard; Entrust Ready
Standards PKI Enrollment	PKCS#11 interface for encryption tokens (USB and smart cards); smart card operating systems: TCOS 1.2, 2.0 and 3.0; smart card reader interfaces: PC/SC, CT-API; PKCS#12 interface for private keys in soft certificates; CSP for the use of user certificates in the windows certificate store PIN policy; administrative specification for PIN entry in any level of complexity; revocation: EPRL (End-entity Public-key Certificate Revocation List, formerly CRL), CARL (Certification Authority Revocation List, formerly ARL), OCSP. CMP (Certificate Management Protocol)
Network Access Control	Endpoint Policy Enforcement*
Networking Features	LAN emulation: Ethernet adapter with NDIS interface, full WLAN (Wireless Local Area Network) and WWAN (Wireless Wide Area Network, Windows 7 Mobile Broadband) support
Network Protocol	IP
Dialers	NCP Internet Connector, Microsoft RAS Dialer (for ISP dial-in via dial-in script)
Seamless Roaming*	If a communications medium error occurs, automatic switchover of VPN tunnel to another Internet communication medium (LAN/WWAN/3G/4G) without altering IP address ensures that applications communicating over VPN tunnel are not disturbed and application session is not disconnected. (prerequisite: NCP Secure Enterprise VPN Server)
VPN Path Finder**	NCP Path Finder Technology: Fallback IPsec/ HTTPS (port 443) if port 500 respectively UDP encapsulation is not possible (prerequisite: NCP VPN Path Finder Technology on VPN gateway)
IP Address Allocation	DHCP (Dynamic Host Control Protocol), DNS: Dial-in to the central gateway with changing public IP addresses through IP address query via DNS server
Communication Media	Internet, LAN, Wi-Fi, GSM (incl. HSCSD), GPRS, 3G, LTE, HSDPA, PSTN, ISDN.
Line Management	DPD with configurable time interval; Short Hold Mode; Wi-Fi roaming (handover); Channel Bundling (dynamic in ISDN) with freely configurable threshold value; Timeout (controlled by time and charges); Budget Manager; Connection Modes: automatic, manual, variable (reconnection dependent on how previous disconnect invoked)
APN from SIM Card	APN (Access Point Name) defines access point of a mobile data connection at a provider. If user changes provider, system automatically uses APN data from SIM card to configure Secure Client.
Data Compression	IPCOMP (lzs), deflate
Additional Features	UDP encapsulation, WISPr-support, IPsec-Roaming, Wi-Fi roaming, Split Tunneling
Point-to-Point Protocols	PPP over ISDN, PPP over GSM, PPP over Ethernet; LCP, IPCP, MLP, CCP, PAP, CHAP, ECP
Internet Society RFCs and drafts	RFC 2401 –2409 (IPsec), RFC 3947 (NAT-T negotiations), RFC 3948 (UDP encapsulation), IP security architecture, ESP, ISAKMP/Oakley, IKE, XAUTH, IKECFG, DPD, NAT Traversal (NATT), UDP encapsulation, IPCOMP
Client Monitor Intuitive, Graphical User Interface	Multilingual (English, Spanish, French, German); Intuitive operation; Configuration, Connection Management and Monitoring, Connection Statistics, Log-files, Internet availability test, Trace Tool for error diagnosis; Traffic light icon for display of connection status; Integrated support of Mobile Connect Cards, embedded); Client Monitor can be tailored to include company name or support information; Password protected configuration management and profile management, configuration parameter lock

* Prerequisite: NCP Secure Enterprise Management
** Prerequisite: NCP Secure Enterprise VPN Server

Documentation:

Download the NCP Secure VPN Enterprise Client for Windows 32/64 bit Datasheet (PDF).

Download the Manual (PDF).