Table of Contents
| Table of Contents | |
|---|---|
|
...
Why are we changing over to a new VPN system
There are a number of desired and required features that are not provided by the Windows VPN servers. Some of those features include:
- Fine grained group-based access controls, which allow us to assign different access levels to members of various groups
- Anti-keylogging technology, and automated Internet browser cache clearing
- High availability (clustering and less frequent patching required, meaning fewer reboots)
- Clientless access using only a browser
- Access from remote sites which block PPTP VPNs (such as many hotels and cafés)
- Support for Linux clients
- There are also several critical security requirements
|
Which connection string should I use?
Please use vpn.slac.stanford.edu , this is the address of a redundant cluster so you won't be impacted by scheduled maintenance.
How to map network drives of the Windows central file servers when connected to the VPN?
Documentation from the windows team is here: http://www2.slac.stanford.edu/comp/windows/docs/VPN/VPN.aspx
You can also type in the address bar:
U drive-> \\win.slac.stanford.edu\my_storage\users
V drive -> \\win.slac.stanford.edu\my_storage\groups
Z drive -> \\win.slac.stanford.edu\my_storage\users\$first_letter_winusername\$winusername , for instance if your windows username is jdoe this would be \\win.slac.stanford.edu\my_storage\users\j\jdoe
Why can't I see my network drives (V:, K:, etc.)?
If you are using a SLAC-issued centrally-managed Windows laptop, and you don't see your network drives after connecting to the VPN, you can connect to all these drives by running this script: the script which can be found under \\slac.stanford.edu\netlogon\domainlogon.vbs (type this address into an Explorer window once connected to VPN). It should be possible to create a shortcut or bookmark to this script to make it easier to connect to network drives.
If you are using a personal machine not in the SLAC domain, then domainlogon.vbs does not work. You will need to map your drive manually using http://www2.slac.stanford.edu/comp/net/dialup/faq-dialup.htm#map.
For more information on drive mapping, please see the windows infrastructure page regarding this matter/
What are the timeouts on the VPN connection?
There is a fixed timeout of 8 12 hours after which your VPN connection is disconnected. There is also a non-activity timeout of 20 minutes which takes effect if no network traffic passes for 20 minutes. If you have a legitimate requirement for a VPN connection which is not subject to these timeouts, please contact account-services@slac.stanford.edu to request an exception. Your VPN will also be disconnected if your system goes to sleep. IT Department Support can assist you if you need to adjust the sleep settings of your system, they can be contacted at ithelp@slac.stanford.edu .
Is there an automatic re-connect feature?
An auto reconnect feature is enabled, but it is only in effect within a session with a duration < session timeout (12 hours). So you can't be connected more than 12 hours without manually re-connecting and re-entering your credentials. This is by design and was explicitly asked by security.
Can I connect to the SLAC VPN using my mobile device
...
, e.g. smartphone?
You need to download the "Cisco Anyconnect secure mobility client" from the app store. This has been reported working from main platforms (android, ios, windows).
You will need to set the server address "There is an app for the iPhone and iPad which some users have had success with. There are also Android apps but often they require the phone to be rooted. SLAC does not provide support for personal devices or such apps at this time, but you are free to make your own attempts to connect using them. For the iPhone app, search the app stores for "Cisco AnyConnect Client". Within the app, select "Add VPN Connection...". Enter vpn.slac.stanford.edu as the server address, this will be replaced with a list of the VPN servers that is automatically updated each time you connect. Other mobile devices may be able to connect when Cisco releases AnyConnect Secure Mobility clients for those platforms". We use SSL vpn (not IPSec).
I'm getting periodically disconnected while I work, and I know I wasn't idle for 20 minutes
We have received reports of some users getting disconnected when their wireless signal is not strong. Try moving to a location with a better wireless signal.
I'm using Mac OSX, can I use SLAC's VPN Service?
Yes, please follow the instructions on this page:
Connecting to SLAC's VPN Using Mac OS X
Can I connect to SLAC's VPN from a host running Linux?
Yes, please follow these instructions:
Connecting to SLAC's VPN Using Linux
Can I connect my smart phone to SLAC's VPN?
For the iPhone and iPad running iOS 4.1 or later (multitasking) you need to download the free Cisco AnyConnect client. This is available from the Apple App Store. Enter the server as vpn.slac.stanford.edu. The iPhone/iPad client is not officially supported, but many users have reported success.
Can I Connect to the SLAC VPN From a virtual machine?
Connecting to the SLAC VPN from a virtual machine is not officially supported, but it may work providing the following requirements are satisfied:
- The virtual machine must be configured for "Bridged Networking", as explained by these information pages:
- The operating system on the physical host must not be connected to the SLAC VPN simultaneously
- The virtual machine must be able to access https://vpn.slac.stanford.edu using a browser (to install the client and ensure proper connectivity)
- The virtual machine must be running a compatible version of an operating system which is supported by the Cisco AnyConnect client.
Can I access PeopleSoft?
Yes, you can access PeopleSoft just as you would from your desk while connected to the SLAC VPN.
Can I access internal AFS servers?
Internal AFS servers should be accessible.
In some cases, you will need to renew your Kerberos credentials and establish the connection with the internal AFS servers. Under Mac OS X or Linux, you can enter at
- on the command line
...
- , enter
kinit <username>@SLAC.STANFORD.EDU
...
- (where <username> with your SLAC UNIX account name)
aklog
This will update your tokens for AFS.
, and make sure the domain is all upper-case, as shown here), folowed by the command "aklog" to connect to the AFS infrastructure. Initial access may incur a delay as the local cache is built.
If you experience an inability to access AFS, please email net-admin@slac.stanford.edu and describe your problem.
Can I access the license server?
The license server may not function well over VPN. There are many failure modes, and most vendors have not upgraded to more recent flexlm versions that are more reliable, nor to support alternative license servers when one fails or needs to be restarted due to upgrades/patching/failure. Also serving a license across a VPN may be a license violation (e.g. if the licenses is limited to a site). At the moment it appears to work, however there are no guarantees.
Can I access SLAC computers using windows terminal services with the new VPN?
You should be able to access SLAC computers via RDP. If not please report this with details as a problem to net-admin@slac.stanford.edu .the IT helpdesk.
Can I access confluence?
You should be able to fully access Confluence. If not please report this with details as a problem to net-admin@slac.stanford.edu .the IT helpdesk.
Is all network traffic routed through SLAC when connected to VPN? Is traffic logged?
When connected to our VPN service, policy states that all traffic will must go through SLAC. We do not use split tunneling.: Security policies dicate that split tunneling is not allowed.
This also means that all the VPN traffic is going through the same set of security appliances (including webproxy, logging, malicious code checking, spam filters etc.) as those used when you are connecting from SLAC.
After connecting to the VPN, I could not access my local network resources (such as my printer at home)
This is a security feature of the new VPN. Once connected to SLAC, your system is isolated from your local network for your protection. In order to do things like access a home network-shared printer, local network file shares etc., you will need to temporarily disconnect from the SLAC VPN. USB device will still work.
After connecting to the VPN, can I print directly to the printer in my office at SLAC?
This is supported for most models of printers. If your particular printer is not accessible, please work with IT Department Support to assess the problem.
I could not ping vpn.slac.stanford.edu
From the internet, you should be able to ping vpn.slac.stanford.edu. However, after you have connected to the VPN servers, you will no longer be able to ping the vpn servers.
In order to test VPN connectivity, you should ping an internal SLAC only server; an example would be www-lanmon.slac.stanford.edu
Why don't you support Mac OSX 10.5 on a G5?
Regardless of getting VPN to work, note that Apple is about to release Lion (10.7), and will likely drop support for 10.5 (while they have not stated that officially, that has always been the way Apple does things; two versions are supported, otherwise you need to upgrade). And, as you know, the PPC/G5 is not supported in 10.6/10.7, so you really need to plan to replace that system. When Apple releases security fixes for 10.6/10.7 and not for 10.5 (figure August-ish, but that is a WAG), 10.5 will no longer be in compliance to connect to the internal SLAC network.
The Cisco AnyConnect client for PPC is stuck at version 2.5. Although Cisco has been releasing security patches for that version, it is one major release behind the current software for all other platforms, which is at 3.0.
We performed significant testing of the 2.5 client, including on PPC systems, but eventually we made the decision to support only 3.0+ client versions due to the small number of users who would be affected, and the assumption that Apple will not continue to support PPC systems with OS updates for very long (we don't know for sure, but are making an educated guess based on Apple's past behavior).
Are you doing your own testing with a Mac? Or a Windows box?
Testing is being performed with all those, and others, but there are many different OS versions, system configuration options and user use cases. And the SLAC community often has found individual ways of doing things that have simply not been (well) tested.
Any success/failure information adds to the knowledge base.
Can I use my mail client with an external provider such as GMail or Apple MobileMe?
Most email providers supply a web-based interface for reading and sending mail, and in most cases those will work through the SLAC VPN.
You may connect to external mail providers from your mail client via IMAP or POP protocols to receive mail, but when using VPN you must send mail through our SLAC's authenticated SMTP server (or temporarily shut down the VPN connection)
. The SLAC authenticated SMTP server does not look at the From: line, so the email will still appear to be from xxx.xxx@gmail.com. .. and In addition, the SLAC authenticated SMTP server is Internet accessible so you should be able to use it from anywhere.
...
Please note that most email clients allow you to configure multiple outgoing servers, and will attempt to connect to the default outbound mail server first. If the SLAC server is not the default, you may have to select it when sending mail or wait for the default server connection to time out before mail is sent.
Every time I start a VPN, I have to pick a certificate in below dialog. Any way I can make it default so I don't have to pick?
You can remove certificates using the "Credential Manager":
- Open the Windows menu (formerly the Start menu)
- Type "certmgr.msc" in the Search/Run field at the bottom of the menu
- From the application that launches, delete the certificates in the
"Personal" folder
You may also be able to connect which will load a new client and next time you connect the certificates will not be displayed.
Please see mail-admins page for futher details.
I was disconnected with the message "Administrator Reset", what does this mean and how do I reconnect?
Please ensure you are using the connection string vpn.slac.stanford.edu
It is occasionally necessary to reboot the VPN servers in order to install patched software, or to enable new features. This sometimes required to perform some maintenance on VPN gateways, and this message indicates that the network administrator has had to disconnected your session so that the configuration on VPN server can servers could be rebooted. Click "OK" when you receive this message, and you should be able to connect again after approximately 1 minute. If you want to reconnect immediately, select an alternate server name from the AnyConnect connection window before reconnecting (e.g. change fwvpn1changed.
Thanks to a redundant system, users using vpn.slac.stanford.edu to fwvpn2.slac.stanford.edu)as connection string won't be impacted by our scheduled maintenance.
If I connect to SLAC's VPN will I
...
lose all my active ssh sessions?
Yes, as all your traffic will be then routed through the VPN tunnel making you appearing from a different IP address to the server.
Only persistent connections are affected (ssh, remote desktop...) all other traffic (web surfing,...) will be transparently rerouted through the VPN.
Which login should I use to connect to the
...
VPN system?
You must use the login of your SLAC window windows account, and this account should be enabled for "dialup services".VPN enabled. From a computer on the SLAC network you can check whether an account is VPN capable by doing a query on https://www-internal.slac.stanford.edu/comp/windows/search/usersearch.aspx (VPN status will indicate "Active" or not)
When putting your login into Cisco anyconnect client's interface please do not prefix it with "SLAC\", only put your login name in the field.
I can't get IPv6 working through the VPN.
IPv6 is currently not enabled for the SLAC VPN and is actively blocked.
Can I connect to Stanford university using SLAC VPN?
Yes, Stanford supports the SSL protocol. Instead of connecting to "vpn.slac.stanford.edu", connect to "su-vpn.stanford.edu". You should use your SUNetID and password rather than the SLAC Windows password.
When connected to the SLAC VPN, you can reach Stanford ressources as if you were in your office at SLAC.