Features & Benefits of NCP’s secure remote access

Seamless Roaming switches automatically between LAN, Wi-Fi, and 4G/5G without dropping the VPN session. Using IKEv2, the client redirects the existing IPsec tunnel to the new network with no re-authentication to the gateway, so applications stay connected even as the client's IP address changes and IPsec security policy remains enforced throughout. It requires a current NCP Secure Enterprise VPN Server.

Before each connection, the NCP VPN Client checks which connection media are available and automatically selects one from a predefined sequence set in the configuration. Users can still choose a medium manually when needed. This removes guesswork for the user and works hand in hand with Seamless Roaming to keep sessions running as conditions change.

NCP Home Zone is a firewall profile built for working from home. Once an administrator configures it, the client recognizes the home network by its environment or network address and switches automatically to a dedicated rule set that applies only there. Users can reach local devices such as printers and scanners, and when they leave, the stricter firewall rules are reinstated without any action on their part. Returning home reactivates the profile automatically.

NCP's VPN Path Finder technology keeps remote access working behind firewalls that block standard IPsec traffic, such as those that filter port 500 or UDP encapsulation. When the usual ports are unavailable, the NCP Secure Client falls back to IPsec over HTTPS on port 443 and passes through the firewall. Because the traffic is still IPsec, the security policy is enforced as usual. It requires an updated NCP Secure Enterprise VPN Server.

The NCP VPN is IPsec-based and supports current encryption algorithms and key lengths, including elliptic curve cryptography (ECC). Cryptographic support is implemented in software, so algorithm and key-length updates ship as software updates downloaded over the internet, with no hardware changes. For authentication, the client supports ECC and X.509 v3 digital certificates (software-based or on a smart card) within a PKI, with multiple CAs supported.

Built into every NCP Secure Client, the personal firewall protects endpoints from internet, Wi-Fi, and LAN-based attacks. It operates independently of the underlying operating system and is centrally managed through NCP Secure Enterprise Management.

• Boot-time protection: Active during system startup and during hotspot login in the Windows Pre-Logon phase.
• Friendly Net Detection: Automatically distinguishes trusted from untrusted networks and enables or disables the matching rule set with no user action.
• Parameter lock: Centrally enforced settings the user cannot tamper with or accidentally disable.
• Filtering and inspection:
  • Stateful packet inspection
  • IP Network Address Translation (IP-NAT)
  • Application-based rules
  • Protocol/port/address-based rules
  • Connection-dependent rules
  • Automatic hotspot detection
  • Extensive logging
     

Endpoint Security assesses a device’s security posture before granting access to the corporate network. Centrally managed policies can verify antivirus protection, active services, digital certificates, and installed software versions. Users cannot alter or bypass these administrator-defined requirements. Compliant devices are granted network access, while noncompliant devices may be blocked or redirected to an isolated quarantine environment. NCP is also working to implement post-quantum cryptography (PQC) across its products, with completion currently planned by the end of 2027.

Multi-factor authentication (MFA) strengthens remote access security by requiring users to verify their identity through multiple authentication factors before connecting to the corporate network. These factors may include passwords, digital certificates, security tokens, smart cards, or one-time passcodes. Centrally managed authentication policies help prevent unauthorized access, even when a password or other credential has been compromised.

Parameter lock simplifies the client interface and helps prevent misconfiguration, tampering, and unwanted connection attempts by allowing administrators to define and restrict unwanted connection attempts. Administrators can centrally define and lock client settings to prevent security-relevant configuration parameters from being altered. Options users don't need can be hidden.

NCP High Availability Services improve the availability of NCP Secure Enterprise VPN Servers through load balancing and failover. Multiple gateways work together to distribute VPN connections and ensure continuous remote access if one gateway becomes unavailable. For details, see the NCP High Availability Services data sheet.

NCP Secure Enterprise Management provides an integrated, unlimited RADIUS server with comprehensive monitoring and control capabilities, enabling organizations to consolidate or replace existing RADIUS systems as needed.

NCP VPN solutions support SAML-based Single Sign-On (SSO). After the user authenticates through the SSO environment, the NCP Secure VPN Client establishes a secure IPsec tunnel for access to internal services. Traffic to external cloud applications can bypass the VPN through features such as NCP VPN Bypass or application-based tunneling.

NCP’s software-based VPN solutions integrate virtualized IT environments, enabling organizations to leverage their existing data center infrastructure. This approach supports flexible, scalable deployments while reducing the hardware, installation, and operating costs of large remote-access environments.

Each NCP Secure Client uses a configuration file that defines its connection parameters. Administrators can centrally configure settings and lock specific parameters to prevent unauthorized or accidental changes. NCP Secure Enterprise Management enables these configurations to be created, managed, and distributed across the entire remote-access environment.

NCP Secure Clients for Windows, macOS, and Linux feature an intuitive graphical interface that clearly displays connection and security information. Users can automatically connect to the corporate network, monitor connection progress, and view relevant status details. Context-sensitive tooltips explain key information in plain language, while clear error messages simplify troubleshooting and support. Integrated language options also enable seamless international deployment.

NCP offers VPN clients for Windows, macOS, and Linux, providing consistent remote access across diverse IT environments without the need for separate solutions for each operating system.

VPN Bypass enables administrators to exclude specific applications from the VPN tunnel, even when split tunneling is disabled. These applications connect directly to the internet rather than through the corporate VPN gateway. For example, routing video-streaming and cloud application traffic directly to external services reduces bandwidth usage and the load on VPN infrastructure.

Windows Pre-Logon allows users to establish a secure VPN tunnel before signing in to Windows, enabling authentication through the organization’s central Windows domain or Active Directory. Supported clients can also connect via a Wi-Fi hotspot, with the integrated dynamic firewall protecting the device throughout the authentication process.

NCP solutions support multiple operating systems, enabling organizations to integrate diverse devices into remote-access environments and implement BYOD policies where appropriate. Organizations can establish security requirements and specify which clients and devices may access corporate resources.

NCP Secure Enterprise Management centralizes administration across the remote-access environment. IT teams can manage rollouts, certificates, configurations, and software distribution from one place, while quickly adapting access as employees join, leave, or change roles. This reduces manual effort and simplifies the management of large, distributed environments.

NCP Secure Clients streamlines daily operations and reduces support costs. Centrally managed configurations and Parameter Lock protect settings from intentional or accidental changes, while clear error messages simplify troubleshooting. The Support Assistant also collects relevant diagnostic data directly from client systems, enabling support teams to identify and resolve issues more efficiently.

NCP Secure Enterprise Management enables multiple organizations to share a single VPN platform while maintaining separate structures and access permissions. Administrators can manage only their assigned tenants and users, making the solution ideal for managed security service providers (MSSPs) overseeing VPN environments for multiple customers.