Overview

---

Follow the steps below to use the Duo two-step login with the campus VPN. General information about installing and configuring the UCSD VPN can be found on Virtual Private Networks (VPN) at UCSD.

Critical Concepts

---

• Everyone is required to use two-step login with VPN. If you are using a passcode from a token, mobile app, or bypass code, please follow the Using a Passcode steps to connect to the VPN.
• Some applications, such as the UCSD VPN, do not support a web interface to select the type of two-step login method or device you would like to use. For these types of applications, Duo Security's "append mode" is used which lets you specify the type of two-step login you would like to use with just a little bit of extra typing. 
• You'll see various VPN groups when attempting to establish a connection. You must select a group labeled 2-Step Secured or secure-connect in order to use the two-step login. Otherwise, you will receive an error message and the connection will not go through.
• Information for registering for Duo Two-Step can be found on the Register for Two-Step Login (Duo) article. More information about Duo's append mode can be found on Duo's Append Mode Guide.

Steps to Take

---

1. Open your VPN client and enter the following address: vpn.ucsd.edu
2. Click Connect.
3. Select a 2-Step Secured or secure-connect group. Here are the common groups used:
   
   • 2-Step Secured - allthruucsd
     
     • Allthru means all of your web activity will route through the VPN (for example, performing a Google search then visiting FinancialLink). 
   • 2-Step Secured - split
     
     • Split means only your visits to UC San Diego sites will route through the VPN (for example, your visit to FinancialLink goes through VPN but your Google search doesn't).
   • secure-connect-allthruucsd
     • Similar to "2-Step Secured - allthruucsd" but for devices requiring Secure Connect NAC compliance.
   • secure-connect-split
     • Similar to "2-Step Secured - split" but for devices requiring Secure Connect NAC compliance.
4. Enter your Active Directory username and password as usual, then be prepared to immediately complete the second step. 
5. Duo two-step will automatically send two-step verification prompt to your devices in this order:
   
   • Duo push notification will be sent to the first device with Duo Mobile activated on your list of registered devices. 
   • If you do not have a device with the Duo Mobile app, you will need to follow the steps below on how to log into the VPN using the passcode method. 
   • Want to use a passcode or alternative method for two-step verification? See the steps below for details.

Using a Passcode

1. Open your VPN client like normal, choose vpn.ucsd.edu and click Connect.
2. Select a 2-Step Secured or secure-connect group. Here are the common groups used:
   
   • 2-Step Secured - allthruucsd
     
     • Allthru means all of your web activity will route through the VPN (for example, performing a Google search then visiting FinancialLink). 
   • 2-Step Secured - split
     
     • Split means only your visits to UC San Diego sites will route through the VPN (for example, your visit to FinancialLink goes through VPN but your Google search doesn't).
   • secure-connect-allthruucsd
     • Similar to "2-Step Secured - allthruucsd" but for devices requiring Secure Connect NAC compliance.
   • secure-connect-split
     • Similar to "2-Step Secured - split" but for devices requiring Secure Connect NAC compliance.
3. Enter your Active Directory username and password as usual. Don't click OK just yet! 
4. Immediately after your password - no spaces - type a comma followed by the passcode. Here is the format to follow: password,code
   
   • For example, if you password is 11g0@lscorer and your passcode is 562737 you would enter the following in the Password field: 11g0@lscorer,562737
     
     
5. The passcode you use for step #4 will be either your 6 digit code from your DUO Mobile or your DUO Token. 

Using an Alternative Method

If you are not receiving a Push right away, you can request a push through following the steps below. 

1. Connect to the Cisco Secure client using the instructions above. 
2. Enter your Active Directory username and password as usual. Don't click OK just yet! 
3. Immediately after your password - no spaces - type a comma followed by one of the corresponding words (see image below for an example): 
   
   • push - Receive push notification (if Duo installed on phone & device registered) by entering: password,push

If you have multiple devices registered - for example, a mobile phone and a backup tablet - you can select your backup device using a similar method as well. Please note, phone call and SMS options have been removed from Duo and you will not be able to register devices for phone call only, including landlines, or send codes using SMS. 

To select another device, simply add the number of the device to trigger it - for example push1, push2, push3. The number of the phone will correspond to the order it is listed on the Duo Registration Portal (duo.ucsd.edu). For example, if you had 3 devices listed, the phone at the top would be 1, the next phone directly below would be 2, and the last phone would be 3.

This is called the "append method" and more information is available on Duo's Knowledge Base.