Update as of Dec. 6, 2025: The dates for the introduction new Cardinal Key VPN profiles and retirement of the legacy profiles provided in this article are no longer accurate. We'll publish updated information as soon as it is available.
Starting next month, we’ll introduce two-step authentication for Cardinal Key VPN to enhance security. You’ll see minor changes if you use an iOS, macOS, or Windows device with Cardinal Key installed to connect to the Stanford VPN.
Key dates and changes
- Starting Dec. 7, 2024, two new profiles will become available in the Group list:
- CardinalKey (split-tunnel)
- CardinalKey-Full (non-split-tunnel)
- We’ll implement a transition period from Dec. 7, 2024, through Jan. 16, 2025.
- During this time, the legacy profiles CardinalKey-VPN and CardinalKey-Full Traffic will remain accessible.
- Documentation for both the new and legacy profiles will be provided.
- On Jan. 16, 2025, we’ll retire the legacy profiles CardinalKey-VPN and CardinalKey-Full Traffic.
Discover your new Cardinal Key VPN experience
We encourage you to test the new profiles during the transition period. This is an opportunity to get familiar with the two-step authentication for VPN and provide feedback to our technical teams.
If you've previously used the Duo app for Stanford authentication, you'll likely find the new process familiar and user-friendly.
Steps to connect:
- Choose either CardinalKey (split tunnel) or CardinalKey-Full (non-split-tunnel).
Note: If you are unsure which profile to use, scroll to “Two types of VPN” to learn more.
- When prompted, authenticate using your preferred Duo method via the push notification. (We're working on making other two-factor methods available.)
- After completing authentication, you’ll get a notification confirming your connection to su-vpn.stanford.edu.
For detailed instructions, please visit the "Using Your Cardinal Key” page. Step-by-step guides for the new Duo profiles will be available soon in the right menu.
Two types of VPN
Stanford’s VPN allows you to connect to Stanford’s network as if you were on campus. There are two types of VPN available:
- Non-split tunnel encrypts all internet traffic from your computer but may inadvertently block you from using resources on your local network, such as a networked printer at home.
- Split-tunnel allows access to anything at stanford.edu via the VPN connection but non-Stanford traffic flows normally on an unencrypted internet connection.
Questions and support
If you have questions or would like to provide feedback, please submit a Help request.
