We’re introducing important security enhancements to Stanford VPN. As part of these improvements, starting March 6, you’ll notice a few changes when you log in.
- New VPN Profile Names: The VPN profiles will be updated. Whether you use Cardinal Key or enter your SUNet ID and password, you’ll need to select one of the new profiles the first time you log in after the change.
- Two-step authentication for Cardinal Key VPN: Two-step authentication will now be required for Cardinal Key VPN. In addition, you’ll need to ensure you’re running Cisco Secure Client version 5.1.7 or higher to use the new Cardinal Key VPN profiles.
What to expect
Here’s a quick guide to the new VPN profiles to help you decide which is best for you.
| New VPN profile | Legacy profile it replaces | Connection requirements |
|---|---|---|
| CardinalKey-Full (split-tunnel) | CardinalKey-VPN | Cardinal Key plus two-factor authentication |
| CardinalKey-Full (non-split-tunnel) | CardinalKey-FullTraffic | Cardinal Key plus two-factor authentication |
| Stanford (split-tunnel) | Default Stanford (split-tunnel) | SUNet ID and password plus two-factor authentication |
| Stanford-Full (non-split-tunnel) | Full Traffic (non-split-tunnel) | SUNet ID and password plus two-factor authentication |
Note: Split tunneling is a VPN configuration where non-Stanford internet traffic is routed through an unencrypted connection, while non-split tunneling directs all internet traffic through the VPN. Visit Remote Access VPN to learn more.
Update your VPN client
To use the new Cardinal Key VPN profiles, ensure you're running Cisco Secure Client version 5.1.7 or higher.
If you haven’t already done so, you’ll be prompted to update upon signing in. For your convenience, you can also download the latest version by visiting Remote Access VPN.
Improved security for Cardinal Key profiles
By requiring a secondary verification method, the new profiles add an extra layer of security to Cardinal Key VPN connections. If you've previously used the Duo app for Stanford authentication, you'll likely find the new Cardinal Key VPN process familiar. To learn more, visit Using Your Cardinal Key. Updated instructions will be available soon in the right menu.
How to choose a new VPN profile
Follow these steps to select a new VPN profile.
- Launch the Cisco Secure Client client. A window to prompt for VPN should display (as shown below). Click Connect.
- Next, the prompt for two-step authentication displays.
- Depending on your screen resolution and window placement, the Duo pop-up window may cover the profile selection window. If you do not see the profile selection window, move the Duo pop-up window out of the way (do not close it). You should then see the profile selection window (as shown below).
- From there, in the Group drop down menu, select your desired new VPN profile and click Ok. The new profile you choose will be the default selection the next time you start the VPN client.
Updated timing on the rollout
This change was initially announced in December, with plans to implement the new profiles in January 2025. However, further testing revealed that the new functionality requires an updated client version, which delayed the rollout.
Questions and support
If you have questions or want to share feedback, please submit a Help request.
