Documentation from the windows team is here: http://www2.slac.stanford.edu/comp/windows/docs/VPN/VPN.aspx
If you are using a SLAC-issued centrally-managed Windows laptop, and you don't see your network drives after connecting to the VPN, you can connect to all these drives by running the script which can be found under \\slac.stanford.edu\netlogon\domainlogon.vbs (type this address into an Explorer window once connected to VPN). It should be possible to create a shortcut or bookmark to this script to make it easier to connect to network drives.
If you are using a personal machine not in the SLAC domain, then domainlogon.vbs does not work. You will need to map your drive manually using http://www2.slac.stanford.edu/comp/net/dialup/faq-dialup.htm#map.
For more information on drive mapping, please see the windows infrastructure page regarding this matter/
There is a fixed timeout of 12 hours after which your VPN connection is disconnected. There is also a non-activity timeout of 20 minutes which takes effect if no network traffic passes for 20 minutes.
An auto reconnect feature is enabled, but it is only in effect within a session with a duration < session timeout (12 hours). So you can't be connected more than 12 hours without manually re-connecting and re-entering your credentials. This is by design and was explicitly asked by security.
For the iPhone and iPad running iOS 4.1 or later (multitasking) you need to download the free Cisco AnyConnect client. The iPhone/iPad client is not officially supported, but many users have reported success. This is available from the Apple App Store. For the iPhone app, search the app stores for "Cisco AnyConnect Client". Within the app, select "Add VPN Connection...". Enter vpn.slac.stanford.edu as the server address, this will be replaced with a list of the VPN servers that is automatically updated each time you connect.
There are also Android apps but often they require the phone to be rooted.
SLAC does not provide support for personal devices or such apps at this time, but you are free to make your own attempts to connect using them. Other mobile devices may be able to connect when Cisco releases AnyConnect Secure Mobility clients for those platforms. Any informal support from the OCIO will focus on iOS and Android today and target browsers with HTML5 first
We have received reports of some users getting disconnected when their wireless signal is not strong. Try moving to a location with a better wireless signal.
Connecting to the SLAC VPN from a virtual machine is not officially supported, but it may work providing the following requirements are satisfied:
Yes, you can access PeopleSoft just as you would from your desk while connected to the SLAC VPN.
Internal AFS servers should be accessible.
In some cases, you will need to renew your Kerberos credentials and establish the connection with the internal AFS servers. Under Mac OS X or Linux,
kinit <username>@SLAC.STANFORD.EDU (where <username> with your SLAC UNIX account name)aklogThis will update your tokens for AFS.
Initial access may incur a delay as the local cache is built.
If you experience an inability to access AFS, please email net-admin@slac.stanford.edu and describe your problem.
The license server may not function well over VPN. There are many failure modes, and most vendors have not upgraded to more recent flexlm versions that are more reliable, nor to support alternative license servers when one fails or needs to be restarted due to upgrades/patching/failure. Also serving a license across a VPN may be a license violation (e.g. if the licenses is limited to a site). At the moment it appears to work, however there are no guarantees.
You should be able to access SLAC computers via RDP. If not please report this with details as a problem to net-admin@slac.stanford.edu.
You should be able to access Confluence. If not please report this with details as a problem to net-admin@slac.stanford.edu .
When connected to our VPN service, policy states that all traffic must go through SLAC: Security policies dicate that split tunneling is not allowed.
This also means that all the VPN traffic is going through the same set of security appliances (including webproxy, logging, malicious code checking, spam filters etc.) as those used when you are connecting from SLAC.
This is a security feature of the new VPN. Once connected to SLAC, your system is isolated from your local network for your protection. In order to do things like access a home network-shared printer, local network file shares etc., you will need to temporarily disconnect from the SLAC VPN.
This is supported for most models of printers. If your particular printer is not accessible, please work with IT Department Support to assess the problem.
From the internet, you should be able to ping vpn.slac.stanford.edu. However, after you have connected to the VPN servers, you will no longer be able to ping the vpn servers.
In order to test VPN connectivity, you should ping an internal SLAC only server; an example would be www-lanmon.slac.stanford.edu
Regardless of getting VPN to work, Apple is currently at Lion (OSX 10.7). PPC/G5 Macintoshes are not supported under 10.6/10.7, so plans to replace such systems should be instigated for security/patching reasons alone.
The Cisco AnyConnect client for PPC is stuck at version 2.5. Although Cisco has been releasing security patches for that version, it is one major release behind the current software for all other platforms, which is at 3.0.
We performed significant testing of the 2.5 client, including on PPC systems, but eventually the the decision to support only 3.0+ client versions was made due to the small number of users who would be affected, and the assumption that Apple will not continue to support PPC systems in the future (we don't know for sure, but are making an educated guess based on Apple's past behavior).
Testing is being performed with all those, and others, but there are many different OS versions, system configuration options and user use cases. And the SLAC community often has found unique ways of doing things that have simply not been (well) tested.
Any success/failure information adds to the knowledge base. Please submit your experiences at net-admin@slac.stanford.edu
Most email providers supply a web-based interface for reading and sending mail, and in most cases those will work through the SLAC VPN.
You may connect to external mail providers from your mail client via IMAP or POP protocols to receive mail, but when using VPN you must send mail through SLAC's authenticated SMTP server (or temporarily shut down the VPN connection)
The SLAC authenticated SMTP server does not look at the From: line, so the email will still appear to be from xxx.xxx@gmail.com. In addition, the SLAC authenticated SMTP server is Internet accessible so you should be able to use it from anywhere.
This means (for instance), the outgoing SMTP server in Thunderbird would be set to smtp-auth.slac.stanford.edu, port 587, <Windows/Unix Kerberos principal name>, normal password, STARTTLS.
Please note that most email clients allow you to configure multiple outgoing servers, and will attempt to connect to the default outbound mail server first. If the SLAC server is not the default, you may have to select it when sending mail or wait for the default server connection to time out before mail is sent.
Please see mail-admins page for futher details.
You can remove certificates using the "Credential Manager":
You may also be able to connect which will load a new client and next time you connect the certificates will not be displayed.
Please ensure you are using the connection string vpn.slac.stanford.edu
It is sometimes required to perform some maintenances on VPN gateways, and this message indicates that the network administrator has disconnected your session so that the VPN server can be rebooted. Thanks to our redundant system, users using vpn.slac.stanford.edu as connection string are not affected by our scheduled maintenances.
Yes, as all your traffic will be then routed through the VPN tunnel making you appearing from a different IP address to the server. Only persistent connections are affected (ssh, remote desktop...) all other traffic (web surfing,...) will be transparently rerouted through the VPN.
You must use the login of your SLAC windows account, and this account should be enabled for "dialup services".
When putting your login into Cisco anyconnect client's interface please do not prefix it with "SLAC\", only put your login name in the field.
IPv6 is currently not enabled for the SLAC VPN and is actively blocked.
See http://csrc.nist.gov/publications/nistpubs/800-113/SP800-113.pdf from NIST.
Stanford university is using different VPN protocols and technologies, so the SLAC VPN client can't be used to connect to Stanford through VPN. But when connected to SLAC VPN you can reach Stanford ressources as if you were in your office at SLAC.
If you are a SLAC employee/user willing to access SLAC ressources you should use SLAC VPN, if you are a Stanford university employee/student you should use the Stanford VPN client provided on http://itservices.stanford.edu/service/vpn.
A subset of people running Maverick is experiencing VPN connections being dropped every minute.
This bug was acknowledged and a special version fixing it is available to Mac users at: V:\SCS\ITDS\Apple\anyconnect-macosx-i386-3.1.04074-k9.dmg (windows share) or at /u/sf/gcx/vpn/anyconnect-macosx-i386-3.1.04074-k9.dmg (AFS).
Only affected people should use it as it is not yet considered production ready. We are still waiting a more stable release to have it automatically pushed by the VPN gateways for everybody. This was expected beginning of December, but will more likely be beginning of next year as we do not want to do changes on VPN around end of year holidays.