Virtual Private Network (VPN)

Overview

Eligibility

All members of the University can use the VPN.

Duo two-factor authentication is required to log in.

The VPN lets you access university and external services that are normally only available when on campus. These include:

• Filestore
• Restricted web apps - applications which normally require you to be on campus to use them, eg MyView
• Terminal sessions - SSH sessions to machines on campus, and remote desktop sessions to Windows machines 
• Licence servers - enables use of software that requires access to the University's licence servers 
• External services that require the user to be at York such as journal websites

Getting started

You can connect to the VPN using software called Pulse Secure.

If you are using a University managed laptop then Pulse Secure is already installed and configured, so you can get connected straight away:

• How to connect to the VPN from a managed laptop

For unmanaged and personal devices you will need to download install the Pulse Secure VPN software before connecting:

• Windows
• Mac
• Linux
• Chromebook
• iOS
• Android

Log in with your University username (eg abc500) and password. You will then be prompted for your Duo authentication method.

When you're connected to the VPN, all traffic from your computer, tablet etc goes through the VPN, regardless of whether you are accessing York services, or other internet based resources. Allows you to take advantage of the University's high performance security systems, giving you extra layers of security during VPN sessions.

Whilst connected to the VPN you may not be able to access resources local to you, so if you are on another campus or large network you may have to disconnect from the VPN to use local resources. You cannot connect to two VPNs at the same time.

WebVPN Web portal

You can also use the VPN web page to access web-based resources, providing a quick way to view restricted web pages. It should only be used if the primary method (using the VPN client to connect) isn't an option, and only works for simple web pages that deliver active content via plugins.

It's not suitable for everyone, but may be useful if you can't install Pulse Secure.

Access the Web VPN

Please note that:

• you need to log in with your username (eg abc500). Don't add @york.ac.uk.
• not all websites are supported
• the file browser does not allow you to drag and drop your files

Request VPN access to your service

Not all university services are available whilst connecting to the VPN. There is a firewall between connected users and campus. Members of the University can request services be available to all VPN users, a specific group of users or users that perform an additional security by contacting the IT Helpdesk.

Requests to allow a service on the VPN will receive an initial response within a working day but take up to 5 working days to become active.

Access to your service can be limited to a specific group of people if required.

Help & troubleshooting

Troubleshooting

My connection to non-University (external) services is slower when I'm connected to the VPN.

There are two options you can use when connecting to the VPN:

• All traffic - all connections go through the University VPN
• York traffic only (split) - only connections to University services go through the VPN

The 'split' option improves the performance of external services (especially for conferencing with Zoom, Circuit and Google Meet) as communications use your home broadband connection, without being sent back to campus. Therefore for the fastest experience we recommend using the split option, unless you have a specific need to use the all traffic option.

For more information see:

• VPN: How to improve the speed of Gmail and other internet resources
• Guidance on using the VPN - a new feature to improve performance (News item - published March 2020)

I'm getting the error message "Authentication requires SAML" when attempting to connect to the VPN from a Windows machine.

This occurs when using the built-in Windows VPN client rather than the Pulse Secure software. To connect a Windows machine to the VPN you will need to use the Pulse Secure software. Further information about this error can be found in our KnowledgeBase:

• Cannot connect to VPN with error message: Authentication requires SAML

Can I use the built-in Windows VPN client to connect to the University VPN?

No -  to connect a Windows machine to the VPN you will need to use the Pulse Secure software. Alternatively the WebVPN Web portal can be used in your web browser to access restricted web-based resources.

What does the 'Suspend' feature do?

If you're connected to the VPN and then find you can't access some content (eg local resources when working at another university), you'll just need to select Suspend (or Disconnect) within the Pulse Secure app.

The suspend feature allows all the credentials and settings to be retained, allowing for a quick return to the secured state.

Make sure you're using the latest version of Pulse Secure to use the suspend feature.

Library & IT Help Desk

If you're having problems using the VPN, get in touch with the Library & IT Help Desk.

Our commitments

Your responsibilities

Please remember, while you are connected to the VPN, you are subject to University regulations, including University Regulation 11: Use of computing facilities and acceptable use policies:

• University Information Policy index

Connecting to the VPN is the same as plugging your machine into the campus network:

• You will have access to University of York resources as well as internet access but you won't be able to access anything you can't access when at the University (eg blocked sites).
• While connected, the University's terms and conditions apply to all your internet usage and network activity.
• While connected, all your web traffic goes through the University, and may be intercepted, filtered and logged according to the University's policy (Regulation 11.10 and additional guidance).
• While connected you will appear to internet websites to come from a UK source, regardless of where you physically are in the world. This will enable VPN users abroad to access services such as Google Mail, even if that country has restrictions in place.

Where a service has been allowed on VPN:

• Inform IT Services if the service is no longer required on the VPN

Where specific group access has been set up:

• Ensure that the group members are kept up to date