WiscVPN (uwmadison.vpn.wisc.edu) - Getting Started

WiscVPN is based on the Palo Alto client named GlobalProtect. The GlobalProtect client can be downloaded either by

• Connecting to https://uwmadison.vpn.wisc.edu, or
• By visiting https://vpn.wisc.edu and following the manual download NetID protected link at the bottom of the page "Manual download and install, VPN Client Downloads".

See:

• WiscVPN - How to Install, Connect, Uninstall, and Disconnect WiscVPN Palo Alto GlobalProtect
• WiscVPN - Installing the Palo Alto GlobalProtect Client (Mac)
• Global Protect - Accessibility and Usability Information

NOTE: You MUST use a GlobalProtect client when using the static WiscVPN service. You will not get a static IP address if you configure the native IPSEC for OSX, or Linux. You will get a dynamic IP address even if you log in with your username_1.

On 8/23/2021 between 2-3AM(originally 6-7AM, scheduling conflicts), WiscVPN will have Multi-Factor Authentication(MFA) enabled.  After a successful login using your NetID & Password, you will see the following:

At this point you can either type:

"1" and hit "Enter" to have a Duo Push sent to your phone

or 

Enter the code you see in your Duo app or hardware token

Q: Why is Multi-factor authentication(MFA) being enabled on WiscVPN? (UW-Madison uses Duo for MFA) 

A: MFA-Duo provides two pieces of evidence to ensure the user is who they say they really are and in return protecting the resources they have access to.

Q: I can't log into WiscVPN. 

A1: If after 8/23/2021, please make sure you are MFA-Duo enrolled.

A2: If you are a guest/contractor, please reach out to your UW contact to confirm your account is still WiscVPN eligible.

A3: Please reach out to the DoIT Helpdesk, they may need to add you to the "mfa_eligibility" Manifest group.

As of 8/16/2021, all members below should be eligible for MFA-Duo in preparation for enabling MFA for WiscVPN on 8/23/2021. Please enroll in MFA-Duo prior to 8/23/2021.

If you find you cannot, you will need to work with the DoIT Helpdesk to resolve the issue.   

• All Current and Future Enrolled Students
• All Current and Future Employees
• Consultants (as entered in as a POI in HRS)
• Emeritus
• Non-UW TimeSheet Approver (HRS POI)
• All Colleges/Extension Restructure POIs (as entered in as a POI in HRS)
• Extension POI Affiliates
• Special Authorizations
• Volunteers (as entered in to as a POI in HRS)
• UW Medical Foundation or UW Hospital and Clinics employees

Users can request temporary VPN access from the Help Desk for up to one month. After that time, the person/contractor who needs the VPN/MFA access needs to either a) have a $0 affiliate appointment to the respective HR department, which will create a SpecAuth account or b) be entered into the HRS system as a Person of Interest (POI), work with your local HR department to accomplish this.

SpecAuth records are created via the Office of Human Resources (OHR).  It's similar to an HRS record for an end user. POIs are entered into HRS directly. Once in the HR system, they'll be eligible to use both MFA-Duo and WiscVPN automatically.

Departmental VPN users will need to work with their network administrator to add the new user to their respective Manifest group.

Related:

• Getting NetIDs for Affiliate Populations

You will need to work with your UW Contact that gave you WiscVPN access or the DoIT Helpdesk to resolve issues related to Guest access

When workstations are connected to the WiscVPN (uwmadison.vpn.wisc.edu) service, the client computers will not be NAT translated while on campus and use the IP address ranges of:

10.130.176.0/20 (10.130.176.0-10.130.191.255)

10.254.0.0/16 (10.254.0.0-10.254.255.255)

All workstations, servers, firewalls, networking equipment on campus will see the 10.130.176.0/20 or 10.254.0.0/16 as a source IP address.

When workstations are connected to the GlobalProtect vpn service and accessing non-campus Internet sites, the client computers IP source address will be translated to 144.92.38.224/27

When you log into "uwmadison.vpn.wisc.edu" using the GlobalProtect VPN client, using your "username_#", like "bbadger_1", you'll be assigned your static IP after a successful authentication. Static IPs are assigned from:

146.151.192.0/19 (146.151.192.0 - 146.151.223.254)

Note: You MUST use a GlobalProtect client when using the static WiscVPN service. You will not get a static IP address if you configure the native IPSEC for OSX, or Linux. You will get a dynamic IP address even if you log in with your "username_1".

Who currently has access to reserve a static IP address?

• All Current and Future Employees
• Consultants (as entered in as a POI in HRS)
• Special Authorizations
• Manifest groups who have requested WiscVPN services via Manifest process Manifest - Services

Q: Where can a I reserve, view or delete a static IP address for https://uwmadison.vpn.wisc.edu?

A: https://access.services.wisc.edu/IPaddress

Q: How many static IPs can I reserve?

A: "4" per user NetID

Q: I don't see uwmadison.vpn.wisc.edu when I go to https://access.services.wisc.edu/IPaddress, why?

A: You most likely don't have access. All current employees of UW Madison should have access. If you feel this is in error, please create a ticket with the Helpdesk.  They'll add you to a temporary group until IAM and Network Services looks at the users and figures out what population may have been missed during the authentication migration on 2/21/2021.

Q: Where can I find the list of static IPs for a group of users?

A: There is no way for a single user today to be able to view the static IPs of other WiscVPN users.  CyberSecurity is looking into feasibility of providing such information. Last Updated: 3/2/2021  For now, a user will have to login into https://access.services.wisc.edu/IPaddress, to see their static IP and send it to admins requesting it.

Q: I need to reserve a static IP for a new employee, how can I do this on their behalf?

A: Reserving a static IP for someone else is not possible after 2/21/2021. CyberSecurity is currently looking into whether to provide that ability in the near future.  Last Updated:3/4/2021  Today, all new employees can go to https://access.services.wisc.edu/IPaddress, to request their static IP address.  

There are also departmental VPNs on campus under a different "DEPT-NAME".vpn.wisc.edu. These behave, in many ways, much like uwmadison.vpn.wisc.edu.

More details can be found here:

• WiscVPN - Departmental VPN

The new service allows for protection of client devices though the use of URL filtering of malware and phishing sites. The policy of what is filtered is determined and implemented though the Office of Cyber security. NO SSL decryption is enabled so no banking and passwords are decoded.

See:

• WiscVPN - General Connectivity Troubleshooting
• WiscVPN - Static IP Troubleshooting
• [Link for document 84893 is unavailable at this time.]
• WiscVPN - Troubleshooting the Palo Alto GlobalProtect Client (MacOS)
• WiscVPN - Troubleshooting the Palo Alto GlobalProtect Client (iOS/ Android)
• Palo Alto GlobalProtect VPN - What DoIT will need to troubleshoot client connectivity issues

The old WiscVPN service allowed the user to pick either off or on campus profiles as a method to pick either fully tunneling all VPN traffic or only traffic to UW campus resources. The new GlobalProtect VPN service tunnels ALL internet bound traffic though campus.

Users will lose VPN access once they are no longer a member of any of the eligible populations listed in the "Who Currently Has VPN Access" section. For security purposes, there is no grace period to retain VPN services after a user has dropped out of an eligible population. It is worth noting that if you are a member of more than one of the above populations, you will not lose access if only one of your affiliations change. Common reasons for losing eligibility are listed below:

• Graduating students who are no longer enrolled in classes or eligible to enroll. Membership is usually lost within two weeks of the end of the students' last term.
• Individuals that are no longer employed by the university. Membership is lost when the employee is no longer listed as a current employee in HRS.

It is common for graduating students that are still helping in labs or assisting a professor with research to lose VPN access. If you need VPN access for less than a month, you can reach out to the DoIT Help Desk to receive temporary access. However, if you need longer term access (greater than one month), you will need to work with your local HR department to get added as a Person of Interest (POI) in HRS. Persons of Interest are eligible to use Duo and VPN for the duration of their engagement as entered into HRS.

Q: What happens if I connect multiple times with my static WiscVPN username?

A: If you do not log out of the static WiscVPN service, any additional logins to the service will result in your workstation being assigned a dynamic IP address from the non-static WiscVPN service.

Q: How do I know what IP address my workstations got assigned (i.e. maybe I forgot to log out on my work machine and I am connecting in from another computer):

A: You may view the currently assigned IP address by clicking on the Palo Alto GlobalProtect icon in your tray, selecting "Settings" from the drop-down menu, and then clicking on the "Connection" tab and viewing "Assigned Local IP:" Or you can use one of the "what is my IP address" web sites to view what external network sees your computer. Typing in "what is my ip address" in a google.com search will give you that information.