Centrally Managed Enterprise VPN Clients
The NCP Secure Enterprise Client is an IPsec client available for Windows, macOS, and Linux, designed for large deployments.
It features a built-in firewall, multi-factor authentication (MFA) with biometrics, and an internet connector, all within a single-click solution. Simply click to connect, secure, and protect your connection and data with zero configuration required from the end user.
NCP Enterprise Client features
Core connectivity & compatibility
- Standards-based IPsec
- Compatible with all major VPN gateways
- IKEv1 and IKEv2 support
- IPv4/IPv6 dual stack
Roaming & connection resilience
- Seamless Roaming
- VPN Path Finder Technology
- Wi-Fi roaming/handover
- Automatic media detection
- Support for 4G/5G mobile broadband hardware
Security architecture
- FIPS Inside
- Integrated, dynamic Personal Firewall
- Friendly Net Detection
- VPN Bypass
- Home Zone
Authentication
- Biometric (fingerprint/face ID)
- Smart cards, USB tokens & soft certs
- Multi-certificate support
- RSA SecurID ready
- Two-factor via OTP (NCP Authenticator App)
Endpoint & network access control
- Endpoint Policy Enforcement
- Network Access Control
- Windows pre-logon
Admin & usability
- Central management via NCP Secure Enterprise Management (SEM)
- Configuration parameter lock
- Budget Manager
- Multilingual GUI (English, Spanish, French, German)
FAQ's
Here you'll find answers to common questions about deploying and centrally managing NCP Secure Enterprise VPN Clients across Windows, macOS, and Linux.
Yes. The client supports certificate-based authentication (X.509 v3), one-time passwords, and biometric authentication such as fingerprint or face recognition on supported Windows hardware, with the connection only established once authentication completes. For certificate storage, it supports PKCS#11 for hardware tokens and smart cards and PKCS#12 for soft certificates, along with RSA SecurID compatibility. Multi-certificate support also lets one device hold and apply separate certificates for different connection profiles, useful for users who need distinct credentials for different parts of the organization.
Yes, this is a core client feature. The client provides Secure Hotspot Logon and seamless roaming, along with a personal firewall and endpoint protection, so users can authenticate through captive portals and switch networks while the VPN session and security posture stay intact.
Yes, through the VPN Bypass function. Administrators can define specific applications, domains, or target addresses that are allowed to route directly over the internet even when split tunneling is otherwise disabled. This is typically used for high-bandwidth traffic like video streaming, so it doesn't consume tunnel capacity or burden the gateway unnecessarily, while the rest of the user's traffic stays protected.
The client's VPN Path Finder Technology handles this automatically. If the standard IPsec port is blocked, the client falls back to an IPsec-over-HTTPS mode using port 443, which is rarely blocked by public or corporate firewalls. The switch happens without user intervention, so remote workers connecting from hotels, client sites, or other restrictive networks stay connected.
The client surfaces its own state directly. Every NCP Secure Client displays its connection and security status independently of the operating system, with cursor-sensitive tooltips that provide plain-language status information. The connection process can be automated with a clear visual indicator at each stage. That gives both the end user and support staff a quick, unambiguous read on whether the tunnel is healthy without digging into logs.