UCSB is moving away from using Campus VPN services to access internal resources, and shifting to a Zero Trust cybersecurity model for employees (faculty, staff, and student employees). The official date for the decommissioning of Ivanti VPN for all faculty and staff will be January 22, 2027.

The Campus VPN service, Ivanti Connect Secure, will be replaced with Secure Service Access (SSA), which uses an application called Zscaler Client Connector. Only employees (faculty and staff, including student employees) are permitted to use the connector. 

This page is a comprehensive repository of information and documentation to prepare individuals for this transition, including addressing current use-cases of the VPN and what replaces it. If your use case is not addressed here, please reach out to security@ucsb.edu

Who does this impact?

Anyone currently using VPN to access a secure systems will need to transition to using Secure Service Access (SSA) and install the Zscaler Client Connector. 

Using the Campus VPN for remote access to on-campus servers 

Remote access to on-campus resources via RDP/SSH/VNC can be done using SSA, and faculty and staff should consult with their local IT support groups. Non-employee students who currently use the campus VPN to remotely access on-campus servers may continue to use it for a short period until a different solution is available.

Using of the Campus VPN to access UCSB Library electronic resources

Beginning January 22, 2027, users will need to access these resources through alternate methods. Many databases and subscriptions now support direct access/login via UCSB SSO – look for “Access Through Your Institution.” Any that do not can be accessed using the UCSB Library proxy server.

Using of the Campus VPN to access commercial video, music, or streaming services

Campus VPN services are reserved for university-related tasks. Moving forward, users accessing region-based streaming services will need to procure their own VPN solution through commercially available services.

Using of the Campus VPN while traveling overseas

A limited number of licenses will be reserved for travelers to China who need to access resources from behind the Great Firewall.

Secure Service Access (SSA) Information

Certain configuration updates and deployment of the Zscaler Client Connector will faciliate the transition away from VPN and ensure users can continue to access their systems: 

General Use Documentation

Review the SSA / Zscaler Client Connector General Use documentation: Client Connector General Use

Configuration Changes

Update ACL and firewall configurations to allow access from the Zscaler Client Connector: UCSB Networks & Firewall Requirements

Deployment / Installation

Any systems currently requiring the Campus VPN / Ivanti Connect Secure will use the Zscaler Client Connector. Similarly to Ivanti, any devices accessing secure systems will need to install the connector. The connector can be deployed by IT support teams, or can be download and installed manually.

Auto-deployment

IT support teams can use device management tools MaaS360 and Jamf to auto-deploy to enrolled UCSB devices. If you have any questions about how to use these for auto-deployment, reach out to the team: 

  • Office Hours on Tuesdays at 10 a.m. (Zoom link), or reach out to Kyle Glendinning (kyleglen@ucsb.edu) 
  • Submit a ServiceNow Inquiry to the Engineering Escalation team (Link)

App Catalog and Self-Service

MaaS360 and Jamf can also be used to download the client connector manually: Client Installation and Initial Setup

Have a question about SSA / Zscaler? Submit a ServiceNow inquiry here or search keyword: Zscaler in the catalog.