Duo for VPN

CU System Administration users must authenticate their identity to connect to the VPN. It takes two items – a password and your phone – to access Cisco AnyConnect. This decreases the likelihood that others can access your data, even if they have your password.

Get the Duo app

The Duo app will make authenticating your identity easy, giving you three authentication options: receiving a mobile push notification, entering a six-digit code from the Duo app or receiving a phone call.

How to enroll in Duo

Type duo.cu.edu in your browser as a web address (Google Chrome, Firefox, Internet Explorer or Safari).
You will be redirected to login through Single Sign-On (SSO).
Select Add a new Device on the authentication menu.
We need to confirm that it's really you when enrolling in Duo Push. Select an authentication method to confirm your identity.
Enter your phone number. Then, click Continue.
To verify that you have this phone number, select to have a passcode either texted or called to the phone number. Enter in your passcode and select Verify. Once verified, click Continue.
You can now download the Duo Mobile app in your phone's app store.  Apple Store Google Play Store Once you have downloaded the app, select I have Duo Mobile.
A personalized QR code will appear. Open your Duo Mobile app and scan the QR code to register your device.
Once you have scanned the QR code, a green checkmark will appear over the code. Select Continue.
You have now enrolled in Duo Push notifications! The next time you log in to the VPN, Send Me a Push is an authentication option.

  If you need assistance downloading the Duo app or using multifactor authentication, watch this UIS Service Desk webinar.

How to use the VPN and authenticate your identity

  Download the VPN guide

Step 1: Open Cisco AnyConnect on your desktop

Go to the Search bar. Type VPN, and select Cisco AnyConnect Secure Mobility Client.  A pop-up below will appear on the screen. This is where you authenticate your identity.

 

Step 2: Select a VPN channel

From the Group drop-down menu, select the VPN channel you would like to use.
Select 1-System-SplitTunnel-Idp under the Group drop-down menu. When next logging in, 1-System-SplitTunnel-Idp will auto-populate. Users will have the option to switch groups when necessary.

Step 3: Enter your CU username and password

You will be redirected to a webpage to log into Ping. Enter your CU username and password.

Step 4: Select an authentication option

We recommend enrolling in Duo prior to first authenticating. This is required when authenticating with a mobile push notification or entering a code. 

You have three authentication options: Receive a mobile push notification, enter a six-digit code from the Duo app, or receive a phone call.

Option 1: Use the Duo App

The Duo App is the most secure way to authenticate your identity. 

 

Open the Duo App.
Press the refresh button. The app will generate a new six-digit code.
Enter this code into the Duo Option field on your computer.
Press OK to log in.

Option 2: Mobile push notification

You will receive a pop-up notification on your cell phone. Select the notification.
Select the green button to accept. You are now logged in to the VPN.

Option 3: Receive a phone call

The phone number on file in the employee portal will be called.   Need to update your phone number? Instructions are available.
Answer the call, then press any key on your phone to log in. You are now logged in to the VPN.

Need to access a campus VPN?

CU Anschutz Medical Campus
CU Boulder
CU Denver
UCCS

Need assistance?

• If you are having difficulty using the authentication system due to an out-of-date phone number, please contact your department's payroll liaison for assistance. In CU's human resources management tool, HCM, your payroll liaison can add a phone number to your employee record's cellular, campus 1 or campus 2 contact fields.
• For other issues, please email the Service Desk at help@cu.edu. Please include your name, employee ID number, contact information and a description of the problem.