Cisco Secure VPN Operations Guide

Introduction

This document provides some guidelines for the operation of the Cisco Secure VPN client. The desktop client screenshots are from the Windows client, however the information should apply to all desktop operating systems.

Desktop: Starting a VPN session

1. Launch the Cisco Secure VPN application.
   On Windows it will be located under Start/All Programs/Cisco/Cisco Secure VPN Secure Mobility Client. Under MacOSX it is located in the Applications Folder. Under Ubuntu Linux, it will be located in the Internet folder.It may also be launched under windows by clicking on the globe icon in the lower right hand notification area.
   
   
2. If the client was manually installed, the "Ready to connect" area will be blank. The first time you start the client after manually installing it, you should type "vpn.ufl.edu" just to the rigt of the "Ready to connect" prompt and click "Connect."
3. The window will appear on the screen with the "Ready to connect" set to "Gatorlink VPN". Click the "Connect" button.
4. A username and password fields will appear. Use your gatorlink account in the form of "username@ufl.edu" and your gatorlink password. This will give you a Gatorlink full tunnel. For other tunnel types such as a departmental or campus-only VPN tunnels, please see the Tunnel Types section of this document. After you authenticate, you will need to complete multi-factor authentication.
   
   Most users will receive a multi-factor authentication prompt on your default device to complete login. If you use multi-factor methods other than the Duo app on your phone, please see information on how to use other Duo methods by going to the FAQ page.
   
   
5. Once the connection is made, the window will minimize into the icon notification area. For Windows 7 and Vista this is typically hidden and can be displayed by clicking the up arrow in the icon notification area (bottom right of screen).

Desktop: Monitoring a VPN session

1. To check on the status of the VPN connection, click on the icon in the notification area. A small window will appear. Click on the gear icon in the lower left corner.
2. A window will appear which initially shows the status of the VPN tunnel. From this window, you may also click on "Route Details" to understand what networks will take the Cisco Secure VPN and what networks will not. Non secured routes are routes which will not take the VPN client. Secured routes will take the VPN client. A 0.0.0.0/0 entry means that all traffic not the in "Non secured routes" section will take the tunnel.

Desktop: Shutting down a VPN session

1. Follow the instructions under Monitoring a VPN session to bring up the VPN status window.
2. Click on the "Disconnect" button.
   
   

Available VPN Tunnel Types

Different VPN tunnel configurations can be used to control what traffic will take the VPN tunnel. You can specify what kind of VPN tunnel you would like by simply changing the user ID that you use to log into the UF VPN service. Currently there are three tunnel configurations that are available:

1. Full VPN Tunnel. Using a full tunnel, all network traffic to and from the VPN client will be encrypted (including all private IP networks), with the exception of traffic to and from the "local network". The local network is based on the local IP address and subnet mask assigned to your computer's network interface. This is the default tunnel type, and is recommended in most instances. You will receive a full tunnel if you log into the UF VPN service with the username@ufl.edu style gatorlink ID.
2. Campus Only VPN Tunnel. Using a campus-only tunnel, only traffic sent to and from the UF network will be encrypted (including a select group of private IP networks). All other traffic will not take the tunnel. This is the recommended tunnel type for users working from home or traveling. Note that this tunnel type does not support access to library journals and other such off campus subscription services that require a UF IP address to access. The full tunnel does support this type of access. You will receive a campus-only tunnel configuration if you log into the UF VPN service with the username@ufl.edu/campus style gatorlink ID.
   
   
3. Departmental Tunnels. At the request of a campus department or college of reasonable size, a specific tunnel will be created for use by the members of that department or college. Members of that vpn tunnel will be placed in a known private IP subnet that is dedicated to that tunnel and will receive a custom tunnel policy. Authorization to a departmental VPN tunnel is accomplished using Active Directory objects (preferred) or a list of Gatorlink accounts. Those using AD object may manage the tunnel membership without interaction with ICT Network Infrastructure. Access to this tunnel is accomplished by using the username username@ufl.edu/[dept] where [dept] is the assigned name of the individual tunnel. This will result in a full tunnel as described above with a known private IP subnet assigned to the client. You may also use username@ufl.edu/[dept]-campus to get a Departmental Campus-Only tunnel. To request a departmental VPN tunnel, please go to my.it.ufl.edu/CherwellPortal/UFITServicePortal and fill out a request.