Installation

Search for and install the Ivanti Secure Access VPN client application from the Apple App Store. Please note that iOS 11 or later is required.

There are two ways to configure the VPN client: one is by automatic configuration, and the other is by manual configuration. Both methods are described below.
 

Automatic Configuration (recommended)

Step 1: Use the Safari web browser and navigate to https://ps.vpn.ucsb.edu/install  
IMPORTANT - you must use Safari for the automatic configuration in order to install the certificate profile.

Step 2: Enter your UCSB NetID and password and click "Login"

ios vpn screenshot

Step 3: You should see "Welcome to Onboarding Service." Tap the green "Download Profile" button. When you see the message "This website is trying to download a configuration profile. Do you want to allow this?", tap Allow.

Step 4: Once allowed, you'll see a pop-up confirming the profile has been downloading and asking you to "Review the profile in the Settings app if you want to install it." Please go to Settings to complete this installation.

 

Step 5: On the "Install Profile" screen, you should see the green "Verified" text and a checkmark next to "Signed by ps.vpn.ucsb.edu"

Step 6: Tap "Install" in the upper right hand of your screen. You may need to enter your device's passcode.

Step 7: The next screen will explain that a VPN profile is being installed to your device. Tap "Install".

Step 8: The last screen shows "Profile Installed." Tap "Done".

Step 9: Tap the "Sign Out" button in the upper-right corner of the app to finish the onboarding process or when you are done with your VPN session.

 

(Alternative) Manual Configuration

Step 1: Open the Ivanti Secure Access app to create a VPN configuration profile. Tap the "Add a new Connection" button towards the bottom of the screen.

 

Step 2: Create a connection profile with the following parameters:

Connection Name: UCSB Remote Access Trusted
URL: https://ps.vpn.ucsb.edu/ra-trusted
Username: <your UCSB NetID>

Ensure that you have typed the URL exactly as listed above - http:  will not work - it must be https: 

Tap "Add" to create the connection profile or "Connect" to sign in to the VPN. When prompted, tap "Allow" to complete the process.

Usage

IMPORTANT: you must first have at least one device already enrolled with UCSB's MFA service (Duo Security) in order to connect to VPN.

Step 1: Open the Ivanti Secure Access VPN client. Tap the "UCSB Remote Access Trusted" connection profile, then tap "Connect" on the subsequent screen.

Step 2: The first thing you see will be a prompt explaining how to use Duo multi-factor authentication with the VPN client. Once you have read the Pre Sign-in notification carefully, tap "Proceed" to begin the authentication process.

Step 3: Provide your UCSB NetID and password and tap "Sign In." Alternatively, if you have enabled TouchID access, use your fingerprint to initiate a connection.

Step 4: Once your UCSB NetID credentials have been authenticated, you will be prompted to enter which factor you want to use for multi-factor authentication (MFA).

Please type 'push' (no quotes) in the designated field to get a push notification via the Duo mobile application, or enter a current SMS, Duo, or hard token numerical passcode. Alternatively, you can type 'sms' (no quotes) to receive a new set of codes via SMS message on your phone (login will fail - you will need to authenticate to the VPN again to use the newly received SMS passcodes, which are good for one hour). You have a short period of time after entering this information to approve the Duo push notification or enter your code.  Tap "Sign In."

You can find more about the distinctions in Duo device setup here: https://www.it.ucsb.edu/getting-started-mfa-duo/which-devices-should-i-enroll-mfa-duo.

Once you have verified your login via Duo (usually only a few seconds), your client will connect and the status indicator should change to  "Active Connection." Selecting your Connection Profile will expand the status area and should show "Connected" at the top.

If your device supports TouchID or FaceID, you may be prompted to save your credentials for future TouchID or FaceID-based access.  

Step 5: Verify your VPN connection by using a web browser on your iOS device to visit https://next.noc.ucsb.edu/ip. The web page will display the network address your device is using. If the VPN is in use, it should say “On-campus address (VPN)”.

Step 6: To disconnect from the VPN, return to the Ivanti Secure Access VPN client app, tap the UCSB Remote Access Trusted connection profile, then tap the “Disconnect” button.