The IPSec client can be used in any VPN environment. The client communicates on the basis of the IPsec standard with the gateways provided by a wide variety of vendors* and is the alternative to the uniform IPsec client technology offered on the market. The client software emulates an ethernet LAN adapter. The client has additional features that introduce the user into a holistic remote access VPN solution.
The IPSec client offers:
- Support of all major operating systems
- Dial-in over all transmission networks
- Compatibility with VPN gateways from a wide variety of vendors*
- Integrated personal firewall for more security
- Dialer protection (no misuse by third parties)
- Higher speed in the ISDN (channel-bundling)
- Saving telephone charges (charges and connection management)
- Convenient operation (graphic interface)
- Central management**
*) Compatibility list available on the NCP website www.ncp-e.com
**) optional
The IPSec client supports all major 32/64 bits operating systems (Windows 2000, XP, Vista). Connecting to the corporate network is media-type independent, e.g. in addition to ISDN, PSTN analog telephone network, GSM, GPRS, and xDSL, LAN technologies such as WLAN (on the corporate campus and hotspots) or local area networks (branch office network) are also supported. A possible scenario: an employee must access the corporate network from various locations with one and the same end device:
- in the branch office via WLAN
- in the corporate headquarters via LAN
- on the road at hotspots and at customer sites via WLAN or GPRS
- in the home office via xDSL, cable, or ISDN
A Setup program performs the installation of the Client Software quickly and smoothly. The installation procedures for all versions of NCP Client Software are the same. The following text describes the procedures for installing the Client Software under Windows 2000/XP and Vista.
Prior to executing setup be sure that the following prerequisites are fulfilled.
Starting with version 8.31 the Client will be installed in the program directory of the operating system (programs\NCP\SecureClient) for a new installation.
Old path: %Windows%\ncple
New path: %Programs%\NCP\SecureClient
For an update in addition the path is used that was entered for the last installation.
UninstallIf you uninstalled the client, then you have the option to keep the configuration and profile settings in the client directory. If at a later date, a newer client version is installed in the same directory, then all personal data can be used again. If you want to delete the personal data in the client then you will have to confirm this specifically. In such a case all data and directories of the client are removed irretrievably.
Registry repair (RegRep)The setup program checks the registry entries for each new installation of the client, i.e. even when an older version was uninstalled. If problematic entries are found then they will be adjusted. The setup programme will generate a message to request a restart of the PC.
In order to be able to communicate with the Client Software it is essential to have either Microsoft Windows 2000, Windows XP or Windows Vista installed on your PC (min. 128 MB RAM). During the installation you are asked to have your or disks ready, as these will be needed for updating your PC's driver database files. Please insert these when prompted to do so.
Remote DestinationIn order to communicate with the remote destination it must support one of the following media types: ISDN, PSTN (analog modem), GSM, GPRS/UMTS, LAN over IP, WLAN or PPP over Ethernet (PPPoE).
Local SystemOne of the following communication devices must be properly installed:
ISDN adapter (ISDN)The secure client can be used in public key infrastructures as of X.509. V.3 standard and supports the following interfaces/formats:
- Smartcards, USB-Tokens: PKCS#11, TCOS 1.2 and 2.0, CSP
- Soft Certificates: PKCS#12-file
- PC/SC conform chip card reader: The client software supports all chip card readers which conform with PC/SC. The chip card readers are included in a list of the client once the reader is connected and the corresponding driver software has been installed.
- Automatic recognition of connected PC/SC readers: If the use of a PC/SC chip card reader is configured on the client for the PKI environment, the client recognizes and automatically uses the connected one.
This feature can only be used in connection with smartcards which can be addressed directly without interface software such as NetKey chip cards (Telesec).
- PKCS#11 module: Drivers in form of a PKCS#11 library (DLL) are supplied with the software for smartcards or tokens. This driver software has to be installed initially. Then the relevant PKSC#11 module can be selected via an assistant.
The administrator of the company network determines which certificate issuers can be trusted. This happens by applying the CA certificate of his choice into the installation directory under
Retrospectively, issuer certificates can be distributed automatically via the Secure Management Server (only to Enterprise Clients) or the user can save them himself as long as he has the relevant write permissions in the relevant directory.
Currently the formats *.pem and *.crt are supported for issuer certificates. They can be viewed in the monitor under the main menu item "Connection / Certificates / Display CA certificates".
If the secure client receives the certificate of a remote station, then the NCP client will determine the issuer by searching the issuer certificate initially on smartcard or USB token or in the PKCS#12 file and finally in the installation directory under
If Soft Certificates are created with the PKI plug-in of the management server then the issuer certificate is saved in the PKCS#12 file.
The secure client can have access to the corresponding CRL (certificate revocation list) for each issuer certificate. It is applied to the installation directory under
Enablecrlinfo = 0
This means that no notifications are displayed if, on the client at the remote station, no black list was found for the certificate. If a notification has to be displayed, then this setting has to be changed to:
Enablecrlinfo = 1
First the NCP Secure Entry Client is installed as a test version. If you posess a license, you can enter the license data after a reboot of the software by selecting the monitor menu option "License Info and Activation". The test version is valid for 30 days. Without software activation or licensing it will no longer be possible to setup a connection after this 30-day period expires. When 10-days validity remain, a message box will be displayed to remind you that the software has not yet been licensed. For licensing the software please refer to the chapter "Licensing" in the handbook.
Installing the client software first you copy the ZIP file you have got with a download or with the CD onto the hard disk of your PC. The filename of the ZIP file displays the number of the verion and build number of the software, e. g.:
NCP_EntryCl_Win32_9_10_048.ZIP
Copy the directory
Once you have installed the Client Software and rebooted your PC, the Client Monitor will be automatically displayed on your PC. The "Assistant for first Configuration" will also be displayed, provided that you have installed the Client Software for the first time on your PC and that no previous Phonebook exists from an earlier Client Software. It is located in the installation directory.
If you do not use the assistant for creating such test destinations, then no entries will be added to the phonebook. In this case you will have to create your own phonebook entries, as described in the chapter "Client Monitor" under "New Entry / Destination". If you use the assistant, click on "Next". If selected then an IPSec test destination will be added to the client's phonebook and the assistant will guide you through the definition of generic parameters. The following access data are created automatically: VPN protocol is IPSec, the Tunnel Endpoint of the VPN gateway is: vpntest.ncp-e.com, XAUTH userID and Password is "ncpipsecnative". The IP address of the DNS server is 172.16.12.100. The link type is LAN. If a connection via an ISP should be established, the parameters for dial-up must be configured in the profil settings. Setting up the variant with strong security you can use a test certificate. The PIN of the test certificate is "1234" and must be entered wenn establishing the connection. Once you have saved the test configuration, you can set up immediately a test connection (in LAN mode) by clicking the "Test" button. For further configuration of a profil refer the description under "Client Monitor, Profil settings" and "Configuration Parameters, IPSec settings".After the test connection and the tunnel to the VPN gateway has been established you can execute the following tests.
In the "Help" Monitor menu, under the menu option "License Data and Activation", the software version implemented, and possibly the licensed version with serial number, are shown.
The client software is always installed as a test version. If the client software has not yet been installed, or if there is a previously installed older version, then the software has not yet been activated. This also applies if anolder version has already been licensed - then this older version will be reset to the status of a test version, and the license data must be re-entered within 30 days using the activation dialog. The time remaining until software activation, i.e. the validity period of the test version, is displayed in the message bar of the monitor next to the activation button. In order to use a full version with no time limitations the software must be released in the activation dialog with the license key and the serial number that you have received. With activation you accept the license conditions that you can view in the activation dialog after clicking on the appropriate button. The activation dialog can be opened using the activation button in the message bar of the monitor, as well as using the the monitor menu "Help / License Data and Activation". The license data can be entered either online or offline using a wizard. In the offline variant, a file that is generated after entering the license key and serial number must be sent to the NCP authentication server, and the activation key that will be displayed on the website must be noted. This activation key can be entered in the licensing window of the Monitor menu at a later point in time. In the online variant, an assistant forwards the licensing data to the web server immediately after entry and thus allowing the software to immediately be released.The test version is valid for 30 days. Without software activation or licensing it will no longer be possible to setup a connection after this 30-day period expires.
After installation, each time the software is started the validity period will be shown in the popup window. Moreover in a footer of the Monitor the system will display how long the test version can still be used, and when 10-days validity remain, a message box will be displayed to remind you that the software has not yet been licensed. This message box will appear once a day. When the trial period has expired, then only those connections to destination systems can be setup with the Entry Client software that are used for software activation/licensing. Thus one of the profiles of the Entry Client can be used to set-up an Internet connection for licensing purposes. Or a connection to the NCP Secure Enterprise Management can be established in order to download a licensed version of the software. Important:You must have at least a version 9.0 to activate the Client software under Windows Vista. This is the prerequisite. If a no-charge update to version 9.0 is available to you, then you will receive the associated license key when the software is activated. Otherwise, updates to version 9.0 can be purchased in the NCP e-store or purchased from your NCP dealer.
When the test phase has expired the software must be either activated or de-installed. To activate, select the menu option "License data and activation" in the monitor menu "Help".
Here you can see which software version you have and how the software is licensed, i.e. you can see that the test version has expired and that the software has not yet been activated/licensed. Click on the license conditions to display the license agreement text. By activating/ licensing the software you accept the license conditions. Click on the "Activation" button to license the software. In the window that appears, select wether you wish to activate the client online or offline by selecting "Online Activation" or "Offline Activation" respectively. In the offline variant, a file that is generated after entering the license key and serial number must be sent to the NCP activation server, and the activation key that is then displayed on the website must be noted. In the online variant, an assistant forwards the licensing data to the web server immediately after entry and thus the software is immediately released. After selecting the type of activation the license data is to be entered in the appropriate fields. Click on "Next"!With the online variant the license data will be transmitted to the NCP Activation Server via an Internet connection. This Internet connection can either be established via the Data Communications Dialer, via DSL, or via the Entry Client.
If the Internet connection is not set-up via the Entry Client, then the connection must first be established in order to then start the activation assistant via the Monitor menu option, "Help" / License data and activation". If the Entry Client is used to set-up the connection on the Internet, then a suitable profile must first be established for the Entry Client. Ensure that port 80 is released (for HTTP) if the firewall is activated. (If a proxy server has been configured in the operating system, then these settings can be transferred.) After the profile has been selected, click on "Next" to continue. The Internet connection via the Entry Client does not have to be set-up prior to activation. It is set-up automatically after the desired existing profile has been selected in the assistant for software activation, and after clicking on the "Next" button. The software is activated automatically in the specified sequence. As soon as the activation server detects that you are entitled to a newer software license and that the license key agrees with the installed software, then with online activation the new license key will be transferred automatically (license update), and thus the new features of the software will be released. Please see the section "Updates" at the end of this section for more information. After concluding the activation process, in the window for the license data you can see that you now have a correctly activated full version. The number of the software version and of the licensed version can differ if the licensing is only valid for an older version, otherwise the licenses must be updated with a newer license key. To do this click on the "Licensing" button. For more information see the description at the end of the offline variant.The offline variant is executed in two steps. In the first step a file is generated after entering the license key and serial number, and is sent to the NCP activation server. The URL is:
http://www.ncp-e.com/en/service-support/software-activation.html
An activation key will be shown on the web site, and you must note this number in order to enter the license key in the licensing window of the Monitor menu in a second step. (This can also be executed at a later point in time.)
Under the menu option "Check for updates" in the Monitor menu under "Help" you can check whether a version of the software that is newer than the version you have installed is available at NCP. This is also possible if a test installation has been installed. If a newer version is available at NCP, then a software update is always possible.
The software update always costs money if the newer version is a major release, which is indicated by the change on the first decimal place. For example: If a version 8.26 is installed and the next software version has the number 8.3 then a software update from 8.26 to 8.3, as well as use of the new features, will cost money. The new license key was activated as described above under software activation. The new license key is generated by entering the serial number and the update key that can be purchased locally from the reseller, on the following web site:After you have selected the menu option "Check for updates" you will see the adjacent window. In order to check for new updates you will need an Internet connection. If the Entry Client will be used to set-up the Internet connection, then ensure that port 80 (for HTTP) is released if the firewall is active.
If a proxy server will be configured in the operating system, then these settings can be transferred. If the proxy settings are correctly configured, then click on "OK". The Assistant will now search for newly available software updates via the Internet connection. If a software update is available then it is displayed as shown in the next window. (In this case the version is differentiated only via the build number.) Click on "Next" if you want to use the more current version. This downloads the installation package for the newest software. Click on "Finish" to end the Monitor and start the installation of the software update. After starting the Install Shield Wizard select the installation language (as you would for the standard installation), and then answer the update query with "Yes". Then the installation will be executed automatically. It is concluded when you reboot the computer.If you are already using a previous version of the Software it will be detected when attempting to install the new Client Software. If this is the case, then you will be asked if you wish to update your current Client Software to the newer version now in your possession. During the update the current profile settings, certificate data and call control manager statistics will be applied to the new client.
In order to uninstall the Client Software go to: "Start / Settings /Control Panel". Now click on "Add/Remove Software" and then select the client from the list of programs and then click on the "Add/Remove" button. The Uninstall Shield Program will now delete the client software from your PC. Important: After the removal of the software components, the profile and configuration settings are still saved and can be restored in the event a newer version of the client is installed. In order to completely delete everything; manually remove the installation directory.You upgrade from a Secure Entry Client to a Secure Enterprise Client by replacing the licensing and the software. This can be done manually on-site, or via an Update Server.
For a manual upgrade the software is reinstalled from the CD, and "NCP Secure Enterprise Client" is entered as the product to be installed. In this process the install program recognizes that a software version has previously been installed and executes an update after appropriate confirmation (see 2.5). Then the new activation key with serial number must be entered in the Pop-up menu. For an upgrade via an Update Server - the IP address of the Update Server is entered in the client's telephone book (see -> DNS / WINS). In this case the Secure Client software will be downloaded automatically the next time the client dials into the corporate network. At the next dial-in with this new software a CNF file (profile settings) with licensing key will be downloaded. This oncludes the update process.