A way for remote users to connect to University of Wisconsin-Madison resources through an encrypted tunnel.
WiscVPN is based on the Palo Alto client named GlobalProtect. The GlobalProtect client can be downloaded either by
NOTE: You MUST use a GlobalProtect client when using the static WiscVPN service. You will not get a static IP address if you configure the native IPSEC for OSX, or Linux. You will get a dynamic IP address even if you log in with your username_1.
On 8/23/2021 between 2-3AM(originally 6-7AM, scheduling conflicts), WiscVPN will have Multi-Factor Authentication(MFA) enabled. After a successful login using your NetID & Password, you will see the following:
At this point you can either type:
"1" and hit "Enter" to have a Duo Push sent to your phone
Enter the code you see in your Duo app or hardware token
Q: Why is Multi-factor authentication(MFA) being enabled on WiscVPN? (UW-Madison uses Duo for MFA)
A: MFA-Duo provides two pieces of evidence to ensure the user is who they say they really are and in return protecting the resources they have access to.
Q: I can't log into WiscVPN.
A1: If after 8/23/2021, please make sure you are MFA-Duo enrolled.
A2: If you are a guest/contractor, please reach out to your UW contact to confirm your account is still WiscVPN eligible.
A3: Please reach out to the DoIT Helpdesk, they may need to add you to the "mfa_eligibility" Manifest group.
If you find you cannot, you will need to work with the DoIT Helpdesk to resolve the issue.
Q: "tmp-###" based NetIDs are not able to log into WiscVPN?
A: As of 2/21/2021, when we switched to the new authentication method for WiscVPN, NetIDs starting with "tmp-" lost the ability to log into WiscVPN. Per IAM, the site that does supply temporary NetIDs will be going away Spring 2021.
IAM does have a another option using Manifest groups. This new process can be found here Manifest - Services
Generally the new process steps are:
As of 8/16/2021, if a user in this category has logged into WiscVPN over the past 3 months, they should be eligible for MFA-Duo in preparation for enabling MFA for WiscVPN on 8/23/2021. Please enroll in MFA-Duo prior to 8/23/2021.
If you find you cannot, you will need to work with your UW Contact that gave you WiscVPN access or the DoIT Helpdesk to resolve the issue:
When workstations are connected to the WiscVPN (uwmadison.vpn.wisc.edu) service, the client computers will not be NAT translated while on campus and use the IP address ranges of:
All workstations, servers, firewalls, networking equipment on campus will see the 10.130.176.0/20 or 10.254.0.0/16 as a source IP address.
When workstations are connected to the GlobalProtect vpn service and accessing non-campus Internet sites, the client computers IP source address will be translated to 184.108.40.206/27
When you log into "uwmadison.vpn.wisc.edu" using the GlobalProtect VPN client, using your "username_#", like "bbadger_1", you'll be assigned your static IP after a successful authentication. Static IPs are assigned from:
220.127.116.11/19 (18.104.22.168 - 22.214.171.124)
Note: You MUST use a GlobalProtect client when using the static WiscVPN service. You will not get a static IP address if you configure the native IPSEC for OSX, or Linux. You will get a dynamic IP address even if you log in with your "username_1".
Who currently has access to reserve a static IP address?
Q: Where can a I reserve, view or delete a static IP address for https://uwmadison.vpn.wisc.edu?
Q: How many static IPs can I reserve?
A: "4" per user NetID
Q: I don't see uwmadison.vpn.wisc.edu when I go to https://access.services.wisc.edu/IPaddress, why?
A: You most likely don't have access. All current employees of UW Madison should have access. If you feel this is in error, please create a ticket with the Helpdesk. They'll add you to a temporary group until IAM and Network Services looks at the users and figures out what population may have been missed during the authentication migration on 2/21/2021.
Q: Where can I find the list of static IPs for a group of users?
A: There is no way for a single user today to be able to view the static IPs of other WiscVPN users. CyberSecurity is looking into feasibility of providing such information. Last Updated: 3/2/2021 For now, a user will have to login into https://access.services.wisc.edu/IPaddress, to see their static IP and send it to admins requesting it.
Q: I need to reserve a static IP for a new employee, how can I do this on their behalf?
A: Reserving a static IP for someone else is not possible after 2/21/2021. CyberSecurity is currently looking into whether to provide that ability in the near future. Last Updated:3/4/2021 Today, all new employees can go to https://access.services.wisc.edu/IPaddress, to request their static IP address.
There are also departmental VPNs on campus under a different "DEPT-NAME".vpn.wisc.edu. These behave, in many ways, much like uwmadison.vpn.wisc.edu.
More details can be found here:
The new service allows for protection of client devices though the use of URL filtering of malware and phishing sites. The policy of what is filtered is determined and implemented though the Office of Cyber security. NO SSL decryption is enabled so no banking and passwords are decoded.
The old WiscVPN service allowed the user to pick either off or on campus profiles as a method to pick either fully tunneling all VPN traffic or only traffic to UW campus resources. The new GlobalProtect VPN service tunnels ALL internet bound traffic though campus.
Q: What happens if I connect multiple times with my static WiscVPN username?
A: If you do not log out of the static WiscVPN service, any additional logins to the service will result in your workstation being assigned a dynamic IP address from the non-static WiscVPN service.
Q: How do I know what IP address my workstations got assigned (i.e. maybe I forgot to log out on my work machine and I am connecting in from another computer):
A: You may view the currently assigned IP address by clicking on the Palo Alto GlobalProtect icon in your tray, selecting "Settings" from the drop-down menu, and then clicking on the "Connection" tab and viewing "Assigned Local IP:" Or you can use one of the "what is my IP address" web sites to view what external network sees your computer. Typing in "what is my ip address" in a google.com search will give you that information.