Installation

Note: As of July 22, 2022, the branding for the campus VPN client has changed from Pulse Secure (9.1rx) to Ivanti Secure Access (22.2Rx). All other aspects of the client are the same. Any reference to Pulse Secure should be interpreted as Ivanti Secure Access and vice-versa.

Step 1: Download the appropriate Pulse Secure Linux client package for your Linux distribution (UCSB SSO login required). Note that separate installer packages are available for Debian/Ubuntu (.deb) and RHEL/CentOS (.rpm) distributions. On Ubuntu distributions, installing through Ubuntu Software Center is supported for Pulse Secure. For CLI access, you'll need to install openconnect (see below).

Step 2:

(Ubuntu/Debian): Install the Pulse Secure package using the command: sudo dpkg -i <package name>

(RHEL/CentOS): Install the Pulse Secure package using the command: sudo rpm -ivh <package name>

Note: The nss3-tools and net-tools are dependency packages required to successfully install the Pulse Client. Use the following commands to install these dependency tools manually.

(Ubuntu/Debian): sudo apt-get install libnss3-tools net-tools

(RHEL/CentOS): yum install nss-tools net-tools

Step 3: Launch the Pulse Secure GUI from the command line with 

/opt/pulsesecure/bin/pulseUI

or select the application from your GUI's application menu (you may have to search your system to locate it - shown below in Ubuntu).

Step 4: Once the GUI has loaded for Pulse Secure, click the plus icon to add a Connection Profile.

Step 5: Fill the Connection Profile with the following parameters:

Name: UCSB Remote Access
URL: https://ps.vpn.ucsb.edu/ra

Ensure that you have typed the URL exactly as listed above - http: will not work - it must be https: 

Click "Add" to save the Connection Profile. Your Pulse Secure GUI should now contain the Connection Profile as shown below.

Usage

IMPORTANT: you must first have at least one device already enrolled with UCSB's MFA service (Duo Security) in order to connect to VPN.

Step 1: In the Pulse Secure client window, click the Connect button inside the "UCSB Remote Access Trusted" connection profile. Make sure the Connection profile has https://ps.vpn.ucsb.edu/ra as the URL.

The first thing you see will be a prompt explaining how to use Duo multi-factor authentication with the VPN client. 

Step 2: Once you have read the instructions carefully, click the "Proceed" button to begin the authentication process.

Step 3: A window will open prompting you to enter your UCSBnetID and password.  Provide them and click "Connect"

Step 4: Once your UCSBNetID credentials have been authenticated, you will be prompted to enter which factor you want to use for multi-factor authentication (MFA).

Please type 'push' (no quotes) in the designated field to get a push notification via the Duo mobile application, or enter a current SMS, Duo, or hard token numerical passcode. Alternatively, you can type 'sms' (no quotes) to receive a new set of codes via SMS message on your phone (login will fail - you will need to authenticate to the VPN again to use the newly received SMS passcodes, which are good for one hour). You have a short period of time after entering this information to approve the Duo push notification or enter your code.  Click "Connect."

You can find more about the distinctions in Duo device setup here: https://www.it.ucsb.edu/getting-started-mfa-duo/which-devices-should-i-enroll-mfa-duo.

After a few seconds, your client will connect and  the button should change to read "Disconnect." Click the arrow on the left to expand the status area - this will show the words "Status: Connected."

Linux Connections Window Connected

Step 4: Verify your VPN connection by using a web browser to visit https://next.noc.ucsb.edu/ip. The web page will display the network address your computer is using. If the VPN is in use, it should say “On-campus address (VPN)”.

Step 5: To disconnect from the campus VPN service, click the "Disconnect" button.

Connecting to the Campus VPN via command line (CLI):

NOTE: If you are having trouble with SSH while logged in via the GUI, you may find success with the CLI (and vice-versa).

  • If not already installed, you'll need to enter the following command to install openconnect - at this time we cannot recommend using the Pulse Secure CLI:
    • sudo apt install openconnect network-manager-openconnect network-manager-openconnect-gnome
  • Open a Terminal window and enter the command:
    • sudo openconnect --protocol=nc https://ps.vpn.ucsb.edu/ra
  • After prompting for your sudo password, you will be prompted for your username - this is your UCSB NetID.
  • Next, you will be prompted for your UCSB NetID password.
  • When prompted for "password#2", refer to the Step 4 instructions above (or the instructions in your terminal that should appear after you type your sudo password) to complete your Duo authentication.
  • If prompted to choose a tunnel, enter the preferred tunnel and press enter. Otherwise, you should receive a message that you are connected, such as
    • Connected as 128.111.xxx.xxx, using SSL, with ESP in progress
      ESP session established with server
  • Press CTRL+C to disconnect.

PLEASE NOTE: We provide "best effort" support for Pulse Secure on Linux due to the wide range of distributions and their varying configuration methods. More information about the Linux client and dependencies is available here from the vendor's support site.