Skip to content Skip to site navigation

Windows: Connect to the Stanford VPN with a Cardinal Key

Non-Stanford Devices that are managed by BigFix/VLRE and are compliant can use Cardinal Key to sign into VPN without multifactor authentication.

Note: If your device is not compliant, you will be unable to use Cardinal Key to connect to the Cisco AnyConnect VPN.

You can connect to the Stanford VPN using a Cardinal Key on your device to authenticate. This eliminates the need to enter your SUNet ID, password, and authentication method for two-step authentication.

You'll need to use the Cisco AnyConnect VPN client to connect to the Stanford VPN with a Cardinal Key.

Two types of Cardinal Key VPN connections are available:

  • CardinalKey-VPN (split-tunnel) allows access to anything at stanford.edu via the VPN connection but non-Stanford traffic flows normally on an unencrypted internet connection.
  • CardinalKey-FullTraffic (non-split-tunnel) encrypts all internet traffic from your computer but may inadvertently block you from using resources on your local network, such as a networked printer at home. However, this also allows access to library journals as if you were on campus.

Before you begin

Make sure you have the following installed on your device:

Connect to the Stanford VPN using a Cardinal Key for Windows

  1. Launch the Cisco AnyConnect Secure Mobility Client client. 
    If you don't see Cisco AnyConnect Secure Mobility Client in the list of programs,  navigate to Cisco > Cisco AnyConnect Secure Mobility Client.
     
  2. When prompted for a VPN, enter su-vpn.stanford.edu and then click Connect.

    connect to the Sanford VPN
     
  3. You may be prompted to select a certificate for authentication. Click More choices, select the certificate that is issued by Stanford University MyDevices and click OK.

    select the certficate issued by Stanford University MyDevices
     
  4. In the Group list, select either CardinalKey-VPN  or CardinalKey-FullTraffic and then click OK.
    Note: This step downloads the Cardinal Key certificate for subsequent connections; it doesn't use the Cardinal Key for authentication on this connection.

    choose Cardinal Key full traffic or split tunnel VPN for the Group
     
  5. A notice briefly appears in the notification area to show that you are connected to su-vpn.stanford.edu.

    message saying that Cisco AnyConnect is connected to su-vpn.stanford.edu
     
  6. If you no longer require a VPN connection, click Disconnect to disconnect from su-vpn.stanford.edu.

    disconnect from su-vpn.stanford.edu
     
  7. From the Cisco AnyConnect client, select CardinalKey-VPN  or CardinalKey-Full Traffic.
    Once you have successfully connected to the Stanford VPN using a Cardinal Key, this becomes your default setting for subsequent connections to the VPN.

    connect t6ot CardinalKey-VPN
     
  8. A notice briefly appears in the notification area to show that you are connected to the VPN with a Cardinal Key.

    message saying that Cisco AnyConnect is connected to Cardinal Key VPN

Connect to the Stanford VPN without a Cardinal Key

If you decide that you do not want to use a Cardinal Key for authentication, you can connect using your SUNet ID and password, followed by two-step authentication. On the VPN website, see Connect to the Stanford VPN for instructions.

Last modified September 22, 2020