Frequently asked questions¶
What is Zero Trust Network Access?¶
Zero Trust Network Access (ZTNA) is a security model where no user or device is trusted by default, even inside the network perimeter. Rather than placing users onto a shared network, access is granted per-connection and only when policy allows it. Enclave implements ZTNA by building direct, encrypted tunnels between systems that policy explicitly permits, with no lateral movement between peers.
For a deeper look at how ZTNA applies to managed service providers, see An MSP's guide to ZTNA.
How does Enclave relate to SASE and SSE?¶
SASE (Secure Access Service Edge) and SSE (Security Service Edge) are broad security frameworks that bundle multiple capabilities together, including Secure Web Gateways (SWG), Cloud Access Security Brokers (CASB), and ZTNA. Enclave provides the ZTNA component: private, peer-to-peer access to internal resources. SWG and CASB tools handle internet-bound and SaaS traffic. If your customers use a SWG or CASB for web filtering and SaaS controls, Enclave sits alongside them to handle secure access to private infrastructure.
For a detailed comparison, see SSE vs SASE: a practical guide for MSPs.
Does Enclave need a VPN server?¶
No. Enclave is a peer-to-peer, agent-based solution. There is no central server, VPN concentrator, or appliance to deploy. Each system runs a lightweight agent that builds direct tunnels to the peers it needs to communicate with.
For more detail, see What is Enclave?.
What ports does Enclave need?¶
Enclave does not require any inbound ports. Systems running Enclave initiate all connections outbound using TCP port 443 and UDP. No static IP addresses or firewall rules are needed for inbound traffic.
See Ports and firewalls for an overview, and the detailed firewall requirements for specifics.
Can Enclave work alongside an existing VPN?¶
Yes. Enclave creates its own virtual network adapter and treats other VPN adapters as valid connection candidates. Both can run side-by-side without conflict, so you can run both side-by-side during a migration.
What happens if a direct connection can't be established?¶
When a direct peer-to-peer connection is not possible - typically due to restrictive NAT or firewall configurations - traffic is routed through geographically distributed relay servers. Relayed connections are still end-to-end encrypted; relay servers cannot decrypt or inspect the traffic.
See NAT traversal and connectivity for how direct connections are established, and What are relayed connections? for more on how relaying works.
Is traffic end-to-end encrypted?¶
Yes. Enclave establishes per-session encryption keys using Curve25519 ECDHE key exchange. Tunnel traffic is encrypted with AES256-GCM or ChaCha20-Poly1305. No third party - including Enclave's own infrastructure - can decrypt traffic in transit, even when connections are relayed.
See Identity and cryptography for a full description.
Can Enclave connect to devices that can't run the agent?¶
Yes. Enclave Gateway allows a system running the Enclave agent to route traffic to devices on its local network - such as printers, network equipment, or servers that cannot run the agent themselves. Other enrolled systems access those devices through the gateway without needing an agent on the target device.
See Gateways for configuration details.
What are the 100.64.x.x IP addresses?¶
Enclave assigns each enrolled system a static IP address from the 100.64.0.0/10 range. This range is reserved for carrier-grade NAT by RFC 6598 and is guaranteed not to conflict with existing public or private IP address allocations.
The IP address stays fixed for the lifetime of the enrolment. See Virtual networking for more detail, and the KB article on 100.64.x.x addresses for common questions.
How do I manage Enclave across multiple customers?¶
The Enclave Partner Portal provides multi-tenant management, centralised billing, and cross-tenant visibility. Each customer gets their own isolated tenant, and partner users can be granted access to individual customer tenants as needed.
See the Partner Programme section for more information.
Does Enclave support DNS?¶
Yes. Every Enclave agent includes a built-in DNS resolver. DNS names are configured in the Enclave Portal and resolve automatically on any connected system. There is no need to modify existing DNS infrastructure.
See DNS for details on zones and record configuration.
What platforms does Enclave support?¶
Enclave is available for Windows, macOS, Linux, Docker, Kubernetes, Android, iOS, and Synology NAS. See the Install Enclave section for platform-specific installation instructions.
Last updated August 1, 2026