Quick instruction guide
On a SLAC built windows device the vpn client is pre-installed, so you can just go on start menu -> launch Cisco Anyconnect Secure mobility client. Then ensure the connection string is "vpn.slac.stanford.edu" and click on connect. Enter your SLAC's windows credentials, enter the DUO prompt, then accept the banner and you are connected as indicated in the taskbar.
On personal computers, MACs or linux you will need to install the vpn client available at https://vpn.slac.stanford.edu/ . If you are using a mobile device the client to look for in the app store is "Cisco Anyconnect Secure Mobility Client".
1- 
2- 
3-
4- 
5- 
Table of Contents
| Table of Contents |
|---|
- Introduction
- Requirements
- Posture Assessment of Systems Entering SLAC VPN
- Frequently Asked Questions (FAQs)
Introduction
This page documents the use of the SLAC VPN service.
...
Virtual Private Network (VPN) provides a secure connection between your computer and the resources available at your home institution. In the case of SLAC, we offer a VPN service that permits authorized users to gain visibility of SLAC network resources from outside of SLAC. This includes the SLAC Visitor Wireless network.
This page documents the use of the SLAC VPN service.
Implementation
...
Assistance with installation and usage of this system is available. Contact our IT helpdesk via the details below.
Requirements
- You must have a valid SLAC Windows account
- Your account must be given SLAC VPN account access, and you must agree to the usage policies outlined.
- You must be enrolled in two-factor authentication (visit https://www-internal
...
...
In order to connect to SLAC's VPN, a user must install the AnyConnect client. This allows SLAC to enforce certain access restrictions and checks that the user's computer is not running a keylogger, that the user is not running an unsupported version of Windows (95, 98, ME), and enforces an access control list (ACL) to limit access.
Requirements
- You must have a SLAC VPN account, and agree to the usage policies outlined
- The following operating systems are currently supported:
- Windows XP SP3
- Windows Vista
- Windows 7 SP1
- Mac OSX 10.6.7
- Linux
This guide uses Windows Internet Explorer; however, the steps are the same for Mac and Linux with other internet browsers such as Safari, Firefox and Chrome.
Connecting to SLAC's VPN
Open a Web Browser to our VPN Gateway
In order to connect to SLAV's VPN, you must have the AnyConnect software installed. By going to the following webpage, we can check to make sure you have the correct software installed and configured (and up to date), and provide an automated install if it is not.
- Goto:
https://vpn.slac.stanford.edu - Please note the http*s*
Your web browser should come up with the following series of screens
Allow Cisco Secure Desktop to Check Your System
The web page will instantiate a java applet so that it may check your system for the presence of the AnyConnect software.
This may bring up a dialog box which will prompt you to run the application or not.
- If you do not wish to see this dialog again in the future, select 'Always trust content from this publisher'
- Click on 'Run' to allow the applet to scan your system
Log In
The following web page will be presented upon the initial system scan:
- Enter your provided VPN credentials.
- For an account, goto SLAC VPN Accounts
Agree to the Banner
Upon successful login, a banner will be shown on the webpage.
- Click Continue
Initiate the AnyConnect Client
A webpage that offers various methods to access the SLAC VPN services will be presented.
- Click on 'Start AnyConnect'
Install the AnyConnect Software (if required)
If you have problems installing the AnyConnect Client, please refer to the Troubleshooting section of this document.
If necessary (either because it is your first time accessing SLAC's VPN, or if there is a new version of the AnyConnect client), the web page will present that the AnyConnect software needs to be installed.
- If you do not wish to see this dialog again in the future, select 'Always trust content from this publish'
- Click on 'Run' to install the AnyConnect Client onto your system.
Editing the hostname within the VPN client.
- If the hostname does not appear in the VPN client, you can manually enter the following hostname:
Number
Hostname
Description
1
vpn.slac.stanford.edu
load-balanced main hostname
You have connected to SLAC's VPN Service
Upon successful VPN negotiation, you should get the following popup from AnyConnect showing that you have connected to SLAC's VPN service
- you may close this webpage.
Disconnecting from the SLAC VPN
The AnyConnect client exists as a tray icon; you can get to it from the System tray next to the clock in the bottom right of your screen.
- To disconnect click on 'Disconnect'
...
I Get a 'AnyConnect client install failed' Error
Depending on which operating system version you are using, a manual install of the AnyConnect client may be required. If you get the following error, you must manually install the AnyConnect client.
To manually install the client, do the following:
- Download the binary from the webpage
- Locate the binary file that has been downloaded; you can do this from the 'Open Folder' button on the download dialog.
- The AnyConnect client binary install will have a file in the format of
anyconnect-win-*.exe. - Right click on the binary file to get the contextual menu up, and select 'Run as Administrator' (if you do not have administrative rights to your host, you will have to have your Departmental Admin install the software on your behalf.
- Follow the installation prompts, agreeing where ever it asks
- Refresh the webpage and the AnyConnect Client should automatically instantiate and connect you to SLAC's VPN.
I'm using Internet Explorer and I get a 'AnyConnect client install failed'
Under Windows 7, ActiveX controls enable Trusted Sites to assume Administrative access. If you get the following page upon logging into SLAC's VPN, then you need to do the following:
- Under IE's Tools menu, select
Options -> Security -> Trusted Sites - Add the following to the list
Refresh the webpage and the AnyConnect Client should automatically instantiate and connect you to SLAC's VPN.
I'm using Mac OSX and I get a 'System Extension /System/Library/Extensions/tun.kext' Error - what do I do?
We have had reports of issues with the kernel extensions when the AnyConnect Client installs; you may receive the following notice:
We believe this is related to a conflict with Mac OpenAFS.
The result may be that the AnyConnect Client connects you to VPN, but will not pass any traffic - as such, any network activity will fail (eg browsing the Internet, email etc). If this is the case, you should attempt a manual uninstall of the AnyConnect Client and try the install once again:
- You can uninstall the AnyConnect Client by using Finder and going to
- {{ /Applications/Cisco/ }} and running {{ Uninstall AnyConnect.app }}
- Go to
https://vpn.slac.stanford.eduand repeat the install proceedure.
I Still Can't Get Access to Resources Via VPN
- Without being connected to VPN, verify that you have 'normal' network connectivity using a web browser to verify that (e.g.) web pages and can be loaded.
- Restart the AnyConnect Client
- Windows: Quit the AnyConnect client (if it is running) by right-clicking on the icon in the system tray and selecting Quit. If the client doesn't quit the first time, you may need to right-click and select Quit a second time.
- Mac: Quit the AnyConnect client (if it is running) from the icon in the menu at the top of the screen.
- Windows: Quit the AnyConnect client (if it is running) by right-clicking on the icon in the system tray and selecting Quit. If the client doesn't quit the first time, you may need to right-click and select Quit a second time.
- Restart the AnyConnect client, by either running the Client directly, or by going to
https://vpn.slac.stanford.edu. - If you are having issues reconnecting, try restarting AnyConnect and selecting the other VPN server (if it says fwvpn1 then select fwvpn2 or vice versa).
- If none of these options work, some users have reported success rebooting then attempting to reconnect.
- Please submit any experieces to us at
net-admin@slac.stanford.edu
The Cisco Secure Desktop denies Access
I get the message:
We have seen this when using the Chrome browser. First try with Microsoft Internet Explorer. If this fails in a similar fashion contact your Departmental Support Administrator and request that they scan your host for security concerns.
Frequently Asked Questions (FAQs)
What are the timeouts on the VPN connection?
There is a fixed timeout of 8 hours after which your VPN connection is disconnected. There is also a non-activity timeout of 20 minutes.
I'm using Mac OSX, can I use SLAC's VPN Service?
Yes, please follow the instructions outlined above.
When installing the AnyConnect Client, the following prompt will come up asking for permission to install the software onto your mac:
- Enter your username and password for your Mac and click 'OK'
- After a while, the AnyConnect software will be automatically installed and you will be connected to SLAC's VPN.
Can I Connect to SLAC's VPN with my *nix Machine?
Yes, please follow the instructions as outlined above.
In order to install the AnyConnect Client, you must have sudo or root access to your Linux machine. You must also manually download the AnyConnect Client.
You may need to install a Java VM in order for some of the checks to work. You may bypass the use of Java by doing the following:
- twostep/ from a computer on the SLAC network).
- You must have SLAC supported operating system to get successful connection on SLAC Network. Please refer to the following KB articles:
We officially support Windows, Mac OS and Linux but VPN is available on several other platforms (android, ipads etc.).
Posture Assessment of Systems Entering SLAC VPN
- What is changing and why?
As an open laboratory, SLAC makes every effort to enable access to tools and systems needed for research purposes without compromising the security and integrity of our other information and systems. The security of the SLAC network, however, must be protected from the risk posed by the number and variety of devices that use it. Consequently, effective March 19, 2018, devices being used to log into the SLAC virtual private network (VPN) will be checked to ensure they do not pose a security risk to SLAC.
- What’s the impact?
If you use a SLAC-owned, centrally managed device to connect to VPN, you will most likely be granted access with no issues. If your SLAC-owned device is denied access, contact the IT Service Desk (see contact info below) for assistance.
If you use a personally owned device, and that device meets the minimum requirements for using the VPN, then you will be allowed in. If, however, your device does not meet the requirements for OS version, virus control, and other security measures, you will be denied access to the VPN. You are responsible for updating your personally owned device.
If you use a device provided by an institution other than SLAC or Stanford, contact that institution for assistance.
If you are denied access, the following options are available:
- Update the device software so that it is compliant (see Minimum System Requirements below).
- Use Citrix as an alternative method for gaining access to the SLAC systems you need. To request Citrix access, in Service Now, go to the Service Catalog, then select Accounts & Access > Citrix Account Request.
- If you are using a personal or other non-SLAC-owned device, use a SLAC-owned, centrally managed device instead.
- If the device is SLAC-owned, contact the IT Service Desk (see contact info below).
- Minimum System Requirements
The minimum requirements are:
- Antivirus with current signatures (<15 days old)
- A current OS version, such as:
- Windows 10
- macOS 10.11 and up
- Android 10 and up
- iOS 13 and up
- Specific Linux versions are being confirmed and will be updated here when available.
- Resources
If you are a SLAC employee and need antivirus software for your home computer, free software provided by SLAC can be downloaded from the Cyber Security Resources page.
- IT Service Desk Contact Information
Phone: (650) 926-4357; Extension: x4357 (xHELP)
Service Now: Submit a help request
Security
The SLAC VPN connects you directly to the SLAC network. All of your network traffic is sent across an encrypted link, including Internet traffic. You should adhere to the same SLAC computing policies that you do when using computers on-site. Remember to disconnect from the VPN before leaving any computer unattended.
Detailed steps to download the VPN client
...
The vpn clients is available upon authentication at the webpage
...
- You can use this to connect directly to the SLAC VPN service in the future.
/ . Log in and the system will detect which version is suitable for your systems.
The Java installation usually fails, but then it defaults to the manual installation. Download the VPN client by clicking on the link provided. Install it as administrator:
- On linux you need to execute the file that you downloaded as root with the command "sh vpnsetup.sh" (you can also use sudo from your regular account with the command "sudo sh vpnsetup.sh".
- On windows you need to do a right click and "Run as administrator"
- On mac you will need "to allow access" when running it
The first time you connect, you will have to manually enter the connection hostname, please set it as vpn.slac.stanford.edu
What to Do if You Have Problems
Please have a look to the FAQ SLAC VPN Frequently Asked Questions (FAQ) and SLAC ServiceNow KB Article for Posture Assessment.
If necessary, manual download of the client install packages can be done via links here: Cisco AnyConnect Installation Packages
For further help, please contact our IT helpdesk.
Other Notes
4/5/2016: Two-factor authentication is now deployed on SLAC VPN gateways, if you are already enrolled you will be asked for 2nd factor (push, token, etc.)
1/11/2018: Posture assessment is deployed on SLAC VPN gateways, for FAQs please visit: https://slacprod.servicenowservices.com/kb_view.do?sysparm_article=KB0010903
I want to connect my Smart Phone to SLAC's VPN
This is not yet supported, but iPhone connections (via IPSec) are planned in the near future. Android and Windows Mobile connectivity are on our roadmap.
Can I access the K: disk?
Currently you cannot access this disk. Once the service is better understood this will be reviewed.
Can I access PeopleSoft?
Access to PeopleSoft is not currently available via the new VPN. Once the service is better understood, this will be reviewed.
Can I access the license server?
The license server is very fragile. There are many failure modes, and most vendors have not upgraded to more recent flexlm versions that are more reliable, nor to support alternative license servers when one fails or needs to be restarted due to upgrades/patching/failure. Also serving a license across a VPN may be a license violation (e.g. if the licenses is limited to a site). For more on this see VPN and license server. At the moment it appears to work, however there are no guarantees.
Can I use RDP
You should be able to access RDP. If not please report this with details as a problem to net-admin@slac.stanford.edu.
Can I access Confluence?
You should be able to access Confluence. If not please report this with details as a problem to net-admin.
Does all traffic go via VPN or does SLAC traffic go direct?
Once connected to our VPN service, policy states that all traffic will go through SLAC. We do not use split tunneling.
I connected to the VPN and now many web pages are inaccessible
We have noticed this happening if you change your network connection (e.g. go from a wired to a wireless connection and soon after start the VPN). Try disconnecting the VPN and reconnecting it. Failing that try rebooting if it is a Windows host. Failing that try re-installing the Cisco AnyConnect client.
I could not ping vpn.slac.stanford.edu
...