Converting From Non-MFA VPN to the MFA-Enabled VPN on MacOS

If you are using Tunnelblick on MacOS and you are looking to convert to the new MFA-enabled GI VPN, you have come to the right place. You must already have Duo set up with your CruzID (which most of you do). If for some reason you don't have Duo set up yet on your phone, go here to enroll a device and configure Push Notifications with Duo before continuing:

https://its.ucsc.edu/mfa/enroll.html

OK! Let's get to it.

Disconnect from the VPN if you are already connected.

Then you will need to download the new OpenVPN config file from here:

https://giwiki.gi.ucsc.edu/downloads/

The credentials to access that website are username: genecats and password: KiloKluster

Go to the link above and right-click on prism-duo.ovpn and selecting "Save Link As...", and save it to your Desktop or some other area you will remember. Then open Tunnelblick and click on the Tunnelblick icon on the top right of your screen next to the date. It kind of looks like a small tunnel. In the window that opens, select "VPN Details...".

In the resulting window, select the "Configurations" tab on the top. You will see a list of Configurations on the left, and it should include the current configuration you use to connect. It may be called 'prism' or maybe 'client'.

Drag the new configuration called prism-duo.ovpn (from your Desktop) into the Configurations area beneath your old configuration. It should import the configuration. It will ask you if you want to install it for "Only You" or "All Users". Click "Only You". You will also be asked to type in your laptop password.

That's it! Select the new configuration on the left and click the "Connect" button on the bottom right. It will ask you for your usual GI PRISM username and password that you usually use to connect to our VPN, and after that it will send a Duo Push notification to your phone, and then you should be logged in. Other than the Duo Push, the VPN behaves exactly like it did before.

If you have issues you can always revert back to the old configuration, which will still work for a while. We will disable the old VPN soon though, so make every effort to get the new VPN setup working.

Once you have the new VPN working, feel free to delete the old profile from Tunnelblick by clicking on the old profile in the "Configurations" window, then click on the "-" button below to remove the old configuration.

As always, please email cluster-admin@soe.ucsc.edu if you need help or have any questions.