Frequently asked questions and troubleshooting steps for the Palo Alto GlobalProtect 2factor VPN.
The 2factor VPN is used to protect systems that contain sensitive data. You may need to connect to the VPN in order to access these resources when working remotely, or while in the office on wireless networks. While connected to the VPN, all traffic is routed through UW Madison servers. As such, you are subject to UW Madison's Responsible Use of Information Technology Policy. Connecting to the campus network, including the 2factor VPN, constitutes consent to have network traffic monitored. If malware or copyright material is detected on a university or personal owned computer that is connected to the VPN, you will be subject to remediation steps with the Office of Cybersecurity. Failure to comply will result in loss of access to the 2factor VPN. Minimizing connections via personally-owned computers and disconnecting when access to protected systems is no longer required are recommended 2factor VPN practices.
Currently, Microsoft Windows and Apple OS X are the only operating systems compatible with the 2factor VPN. It is not possible to connect via Linux, Unix, Android, or iOS.
For Windows and OS X, GlobalProtect is the only client that can be used to connect at this time. See 2factor VPN - Download and Install the Palo Alto GlobalProtect Client. Cisco AnyConnect and other VPN clients are not compatible. There is a GlobalProtect application for Android and iOS devices, but this application is not compatible with the 2factor VPN service.
Although uncommon, reaching the following limits will result in being disconnected from the VPN:
No matter what connection symptoms or error messages you are encountering, you should start by verifying the following:
Prior to consulting this troubleshooting guide, please verify that you are following these steps to connect to the VPN: 2factor VPN - Connect to VPN with the Palo Alto GlobalProtect Client
Verify that you do not have both Ethernet and wireless network connections enabled at the same time:
Operating Systems can switch between Ethernet and wireless without user intervention which has been known to cause VPN connectivity issues.
If on wireless, verify that you are connected to your preferred wireless network and that you have a strong signal. If you are moving a laptop between rooms, switching wireless networks may interrupt VPN connections. If you are on campus, consider switching from the UWNet to eduroam wireless network, or vice versa, if one has a less reliable connection at your location.
Verify that you have consistent network connectivity. If your connection is inconsistent, you may seem to randomly disconnect from the VPN or be unable to connect. If you are concerned about your network consistency, you should consider doing a ping test to check for dropped packets.
Attempt to reboot your computer if you have not done so already.
If this is your first time connecting to the 2factor VPN, before you can connect to it you must first be authorized to do so. If you have not been told that you are authorized to connect but you need to connect to the VPN, see 2factor VPN - Request Access to Palo Alto GlobalProtect VPN.
There are multiple 2factor VPN services, such as the HRS and Cybersecurity VPNs. The VPN you are attempting to connect to is determined by the string you enter in the "Portal" field in GlobalProtect. Make sure you are properly entering the string for the VPN that you are authorized to connect to. See 2factor VPN - Connect to VPN with the Palo Alto GlobalProtect Client.
GlobalProtect uses your NetID and NetID password for authentication. To verify that you are using the correct credentials, click on https://my.wisc.edu and attempt to login. If you are able to login, you are using the correct credentials and you can close out of MyUW. If you see the message "error: login failed," you are not using the correct credentials. See NetID - Recovering a Forgotten NetID to determine your NetID, and/or NetID Account Recovery (Password Reset) to reset your password.
If you have tried the above troubleshooting steps and you still get the Authentication Failed error when connecting, contact firstname.lastname@example.org for assistance.
The OTP input window may pop up on another monitor if you use multiple monitors. On rare occasions, it has been reported to appear behind other windows. To be certain the OTP input box isn't being covered, try minimizing all windows other than GlobalProtect, and check all monitors for the input box.
Verify that you are not connected to another VPN, such as WiscVPN via Cisco AnyConnect. Connecting to multiple VPNs one one computer (whether in the same Operating System or in a virtual environment) is not a supported configuration and should be avoided.
On rare occasions, your GlobalProtect configuration may become corrupt. This can be resolved by uninstalling and reinstalling GlobalProtect. See 2factor VPN - Download and Install the Palo Alto GlobalProtect Client.
If you have tried the above troubleshooting steps and you still do not get prompted for your OTP code when connecting, contact email@example.com for assistance.
If you believe this applies to you, you can determine whether this is the issue by verifying your OTP Serial Number:
If the Serial Number found above doesn't match the Serial Number displayed at the top of the screen in your VIP Access Smartphone application, you will need to be credentialed by an LRA in order for your OTP device to work again. Detailed instructions are available here.