Departmental VPN - Overview
Departmental VPN description
Departmental VPN access is controlled by the departmental Firewall/VPN/Network administrators. They do this either through Manifest (preferred) or through their local departmental authentication system. Please contact your departmental Firewall/VPN/Network administrator(s) for access to a Departmental VPN.
- Filtering: The service protects client devices through the use of URL filtering of malware and phishing sites. The filtering policy is determined and implemented through the Office of Cybersecurity.
- Tunneling: The GlobalProtect VPN service tunnels ALL traffic though campus.
The service does NOT yet support IPv6
IP Assignments
The external Public IP used for GlobalProtect Departmental VPN are allocated from 144.92.105.0/26 (with some grandfathered exceptions).
The End User IP assignments for Departmental VPN GlobalProtect users are assigned from 10.130.240.0/20 (with some grandfathered exceptions).
WiscVPN
WiscVPN is the standard VPN service for all students, staff, and faculty at UW-Madison. Nearly all active NetIDs currently have access to WiscVPN (uwmadison.vpn.wisc.edu). If you are having issues connecting to this VPN termination point using the Palo Alto Global Protect VPN client, please contact the Help Desk.
For more information on the WiscVPN service, refer to WiscVPN - Overview.
Handy UW Madison VPN links/addresses
| Link/Address | Description |
|---|---|
| WiscVPN - Overview | Ways in which to get the Palo Alto Global Protect VPN client. |
| https://manifest.services.wisc.edu | Control who is allowed to authenticate to the VPN termination point and/or self assign a static IP address.(If Central Campus RADIUS or AD is being used.) |
| https://access.services.wisc.edu | Site for end users to self assign a static IP address per VPN group they belong to above. (If Central Campus RADIUS is being used.) |
| uwmadison.vpn.wisc.edu | The main UW Madison VPN termination point. Requires the Palo Alto Global Protect client. |
| <department_name>.vpn.wisc.edu | The general format for departmental VPN termination points. |
VPN Authentication Methods
|
Authentication Method |
Preferred |
Site Redundant System |
Supports NetID |
Static IP Assignment |
Supports Static IP Self-Assignment |
Multi-Factor Auth. - DUO Capable |
User Based Firewall Rules |
Group Based Firewall Rules |
| Central Campus RADIUS | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes - In conjunction with Campus AD (Uses UUID group names) |
| Central Campus AD |
No (No MFA) |
Yes | Yes | Yes - With some NS manual intervention per user | No | No | Yes | Yes - But uses UUID group names |
| Departmental AD |
No (No MFA) |
Dept. Dependent | No | Possibly - With some NS manual intervention per user | No | No | Yes | Yes |
| Departmental RADIUS |
No (No MFA) |
Dept. Dependent | No | Possibly - Dept. Dependent | Possibly - Dept. Dependent | Possibly - Dept & DoIT IAM interaction required | Yes | No |
NS = Network Services
MFA Duo
If using MFA, your GlobalProtect client will look like this when MFA is enabled:
Requesting a Departmental VPN
Determine if the "uwmadison.vpn.wisc.edu" VPN termination point meets your VPN requirements today?
If YES: Use WiscVPN (uwmadison.vpn.wisc.edu) service and do not request a Departmental VPN.
- You can use static IP assignments with the uwmadison.vpn.wisc.edu termination point.
- UserID to IP mappings can be synced between this VPN and your Palo Alto vsys firewall. Please create a WiscIT ticket.
If NO: Please create a ticket with the Help Desk and send them the answers to the following questions?
- I would like a Departmental VPN because ...
- Using the VPN Authentication Method table above, decide on which one you'd like to use and include it in the request.
- Note: It is required for all new VPNs to support Multi Factor Authentication(MFA). Central Campus uses Duo.
- Roughly how many users in a 24 hour time frame could connect to your Dept. VPN?
- Do you have the need for IPs being assigned to specific users?
- If so, how many?
- Do you already have a Palo Alto virtual firewall that you manage?
- If so, what is the name/vsys#?
- What do you want to name the VPN termination point?
- Example: <department_name>.vpn.wisc.edu
Diagram - Palo Alto Based Departmental VPN
