Virtual private network (VPN)

Some University online resources, particularly web pages, can only be accessed by devices directly connected to the University's network.

Examples of restricted services include:

• Accessing the HR Self-Service for online payslips
• Accessing certain secured departmental and college web pages
• Connecting to local departmental services
• Accessing departmental network drives
• Viewing external websites when using the OWL WiFi network

Use your Oxford username followed by @OX.AC.UK, for example abcd1234@OX.AC.UK.

Your Single Sign-On password is also used for your Nexus365 account and the password can be set up or reset at Accounts and passwords

There is no way to make the client remember your Oxford username or Single Sign-On (SSO) password.

Each time you log in to the Cisco VPN you will need to use your Oxford username and Single Sign-On (SSO) password.

Please note that with the upgraded service:

• The Cisco AnyConnect Client is configured to enable local network access (for local printing and file access) while the VPN is connected, so you no longer need to log out and back in to carry out those tasks
• High volume Microsoft traffic (such as Teams) is sent outside the VPN tunnel by default, which means the service has greater capacity so there is no need to disconnect from the VPN service when not using it
• If you are using managed staff (CONNECT) devices, these are now set up in such a way that you can access University network drives without you having to personally connect to the VPN. You will still need to start the VPN to use other services that need it, for example HR Self-Service.

To access the VPN you will need:

• An internet connection
• The Cisco AnyConnect VPN client
• Know your Oxford username and Single Sign-On password

You will not be able to use the VPN service where:

• You cannot install new software onto your device, such as in an internet café or public library
• Your Internet Service Provider or organisation blocks the use of a VPN
• You are trying to access it through software other than the Cisco AnyConnect Client
• You are trying to sign in using your Remote Access, instead of Single Sign-On (SSO) password
• Your Cisco Client is not up-to-date
• You are not using a supported operating system 

Many services do not require the VPN and are restricted by Single Sign-On (SSO) only, this includes services such as email, Nexus365 apps (for example Microsoft Teams) and the Libraries SOLO service.

The standard VPN configuration is to allow you to connect to devices, such as home assistants or printers on your local wireless network, during an active VPN connection.

If you find this is not the case, you can set this functionality manually by selecting the settings cog icon   at the bottom left of the Cisco client login screen. Select the Preferences tab and tick Allow local (LAN) access when using VPN (if configured).

The Cisco AnyConnect socket filter uses a network system extension on macOS and has a role in monitoring, routing and filtering network traffic on the VPN connections. It runs all the time, even when VPN is not connected, although it doesn’t actively do much.

If this component appears to cause problems the first step should be to ensure the most recent VPN Cisco client is running. You can see the latest versions of the Cisco AnyConnect VPN client from our Software downloads page. If this is the case and issues persist, the component can be uninstalled by deleting the application Cisco AnyConnect Socket Filter.app and rebooting.

This is not the case, but people using macOS may get this impression because of a network extension called the Cisco AnyConnect Socket Filter. This is designed to run all the time, even when the VPN client is not active. However, it doesn't connect to anything (it chiefly does monitoring, routing and filtering of network traffic on the VPN connection), and certainly isn’t an indication that the VPN is connecting automatically.

Make sure you are entering your Single Sign-On (SSO) password. You can reset your Single Sign-On password at Accounts and passwords.

If you use Kaspersky security software you may need to add an exception to trust the VPN software.

To add an exception to either Kaspersky Internet Security 2010 and Kaspersky Anti-Virus 2010:

1. Right-click on the Kaspersky icon near your system clock and choose Settings
2. Select Options > Threats and exclusions
3. Under the Exclusions section, select Settings....
4. Select the Trusted applications tab, then Add
5. Select Browse...
6. Locate the vpnagent program (normally in C:\Program Files\Cisco\Cisco AnyConnect VPN Client), then Open.
7. In the window titled Exclusions for application, under Exclusions check the box Do not scan network traffic.
8. Click OK, OK, then OK again to close the settings window and apply the changes.

To check whether you have the current version installed:

1. Start the AnyConnect VPN Client.
2. Compare the latest version of the software available for your operating system in the VPN section of the IT Services software download page.

   • On Windows and Linux systems, select the About tab.
   • On macOS systems, check the bottom-right of the AnyConnect VPN Client window.

3. If the version number shown on the downloads page for your operating system is higher than the start of your version, download and install it.

Windows

1. Select Start Menu > Settings > Apps
2. Select the entry for Cisco AnyConnect Secure Mobility Client, then Uninstall

macOS

1. Select Applications > Cisco
2. Select Uninstall AnyConnect
3. Follow the prompts to uninstall the program.

Linux

1. Open a terminal window
2. Type the command sudo /opt/cisco/vpn/bin/vpn_uninstall.sh.
3. You will be prompted for your password.

Sometimes you may feel that the network you are using is particularly untrustworthy (for instance if you get an on-screen warning that the network is not secure).  In these circumstances you should use VPN encryption on all your network communication. To do so, you should connect to vpn.ox.ac.uk/tunnel-all by typing this into the login box instead of vpn.ox.ac.uk.  This will cause all network traffic to go through the VPN tunnel.  It will still be possible to access your local network (for local printing and file access) with this configuration.