VPN - Connection Methods


This article shares information about each of the connection methods available to you when using the UA VPN.

A VPN, or Virtual Private Network, provides a secure way for your off-campus device to connect to the UA's network. This is an especially valuable tool when you are on an unsecured wireless network (for example, coffee shops, and airports).

UA VPN requires you to log in with Two-Factor Authentication (2FA). To set up 2FA, visit Two-Factor Authentication (Duo).

______________

Department VPN
The 2FA sign-in process for departmental VPNs is different than the standard VPN that is covered in this article. Please refer to VPN - Connect Using Department Profile for relevant instructions.

About VPN

A VPN, or Virtual Private Network, provides a secure way for your off-campus device to connect to the UA's network. This is an especially valuable tool when you are on an unsecured wireless network (for example, coffee shops, and airports).

UA VPN requires you to log in with Two-Factor Authentication (2FA). To set up 2FA, visit Two-Factor Authentication (Duo).

Note: The 2FA sign-in process for departmental VPNs is different than the standard VPN that is covered in this article. Please refer to VPN - Connect Using Department Profile for relevant instructions.

Using Push (Duo)

This method sends a push notification to your phone to verify the login.

  1. Open the Cisco Secure Client.
  2. If the field next to the connect button is blank, enter vpn.arizona.edu.

    Cisco Secure Client 
  3. Select Connect.
  4. Once you have selected the Connect button, a WebAuth login window will open up:
    1.  Enter your NetID
    2.  Enter your Password 
    3.  Once you select Login, the Duo Universal Prompt will use your default 2FA log in option. The default option is the option that you last used with 2FA. Most users choose the Push option so this will be the most common default option.

        
  5. Approving the request on your phone is all it takes to utilize the Push feature when signing in.
    1. If you wish to use a different 2FA log in, select Other options.  
  6. Select Accept on the Cisco Secure Client. 
  7. You are now connected to the VPN.
Passcode (Duo)

This method lets you retrieve the passcode directly from the DUO Mobile app.

  1. Open the Cisco Secure Client.
  2. If the field next to the connect button is blank, enter vpn.arizona.edu.

    Cisco Secure Client 
  3. Select Connect.
  4. Once you have selected the Connect button, a WebAuth login window will open up:
    1.  Enter your NetID
    2.  Enter your Password 
    3. Upon selecting Login, the Duo Universal Prompt will use your default 2FA log in option. The default option is the option that you last used with 2FA. If you opted for Bypass codes during your last sign-in, the system will remember this preference. 
  5. Open the DUO Mobile app on your device.
  6. Tap on Show under 'The University of Arizona' account to reveal a 6-digit passcode.

     


  7. Enter the passcode you see on your device in the Bypass code field.
  8. Select OK and the VPN will try to connect.
  9. Select Accept on the Cisco Secure Client.

     
  10. You are now connected to the VPN.
Text Messaging (SMS)

This method lets you use one of the passcodes you receive via text messages on your phone.

    1. Open the Cisco Secure Client.
    2. If the field next to the connect button is blank, enter vpn.arizona.edu.

      Cisco Secure Client 
    3. Select Connect.
    4. Once you have selected the Connect button, a WebAuth login window will open up:
      1.  Enter your NetID
      2.  Enter your Password 
      3. Upon selecting Login, the Duo Universal Prompt will use your default 2FA log in option. The default option is the option that you last used with 2FA. If you opted for SMS passcodes during your last sign-in, the system will remember this preference.
    5. In the Text Message Passcode field, enter the passcode you received via text message. 
      1. Select Send a new passcode if you do not receive a text message. 

    6. Select OK and the VPN will try to connect.
    7. Select Accept on the Cisco Secure Client.

       
    8. You are now connected to the VPN.
Yubikey (Hardware Token)

This procedure allows you to utilize your Yubikey (Hardware Token) for the sign-in process.

  1. Open Cisco AnyConnect Secure Mobility Client.
  2. If the field next to the Connect button is blank, enter vpn.arizona.edu. You only have to do this the first time you connect to the VPN.
  3. Select Connect.

    Cisco Secure Client 
  4. Enter your NetID and Password in the WebAuth login window and select LOGIN.
  5. The Duo Universal Prompt will use your default 2FA login option. The default option is the one you last used with 2FA. To use a different method, click the Other Options button and select the correct method from the list. In this case, the YubiKey passcode.
  6. Your computer screen directs you to enter a passcode.

     
  7. Plug your Yubikey into one of your USB ports.
  8. Press the touch-sensitive circle on the Yubikey to generate a code that appears in the Passcode field on the 2FA webpage.
  9. Select Accept once the screen refreshes.


 Note: Some Yubikey models may have a button instead of the touch sensitive circle.

Feitian (Hardware Token)

This method lets you use a passcode you generate using your Feitian hardware token.

  1. Open Cisco AnyConnect Secure Mobility Client.
  2. If the field next to the Connect button is blank, enter vpn.arizona.edu. You only have to do this the first time you connect to the VPN.
  3. Select Connect.

    Cisco Secure Client 
  4. Enter your NetID and Password in the WebAuth login window and select LOGIN.
  5. The Duo Universal Prompt will use your default 2FA login option. The default option is the one you last used with 2FA. To use a different method, click the Other Options button and select the correct method from the list. In this case, the Hardware Token.
  6.  Your computer screen directs you to enter a passcode.

     
  7. Press the refresh button (looks like a power button) on your Feitian hardware token to generate a new passcode.

     
  8. Enter the passcode into the empty Passcode field on your computer screen.
  9. Select Verify. The VPN window closes once the connection is established.
Bypass Codes (Generated from 2FA Portal)

With this method, you can sign in with a Bypass code generated online from your 2FA account.

Bypass codes are generated in batches of 10 on the 2FA Portal page, and each can only be used once, but they can be used in any order.
  1. Open Cisco AnyConnect Secure Mobility Client.
  2. If the field next to the Connect button is blank, enter vpn.arizona.edu. You only have to do this the first time you connect to the VPN.
  3. Select Connect.

    Cisco Secure Client 
  4. Enter your NetID and Password in the WebAuth login window and select LOGIN.
  5. The Duo Universal Prompt will use your default 2FA login option. The default option is the one you last used with 2FA. To use a different method, click the Other Options button and select the correct method from the list. In this case, Bypass Code.
  6.  Your computer screen directs you to enter a Bypass code.

     
  7. Enter one of your unused Bypass Codes and select Verify. The VPN window closes once the connection is established.
Using the "noSSO" Profile

For certain use cases that do not support SSO, please use the vpn.arizona.edu/nosso profile. When signing in, ensure that "nosso" is typed in lowercase to avoid receiving errors. 

Examples of such use cases include:

These use cases are the same as the login process for departmental VPNs where the legacy web auth/Duo is retained. For example, this will require you to designate the 2FA Method during log in.