VPN at UC Berkeley: How to Set Up bSecure GlobalProtect

UC Berkeley’s official VPN is bSecure Remote Access VPN, which runs on Palo Alto Networks’ GlobalProtect client: you install GlobalProtect, enter the portal address vpn.berkeley.edu, and sign in with your CalNet ID plus Duo two-step verification. Students, staff and faculty can use it at no direct cost. Pick the “Library Access and Full Tunnel” option if you want licensed journals and databases from off campus.

Below is how it works, how to set it up, which tunnel to choose, and when you can skip the VPN and use the library proxy. Everything here comes from official Berkeley pages as of October 2026. Campus IT changes these services from time to time, so check the linked pages if a screen looks different.

What the Berkeley VPN is for

The Information Security Office describes bSecure as a service that lets CalNet-authenticated users securely reach the UC Berkeley network from outside campus. Some campus systems, like department file servers, internal admin apps and some EH&S tools, only answer connections that come from the campus network. The VPN makes your laptop look like it is on that network.

It is not a commercial VPN. It is not built to unblock streaming catalogs or hide your activity from the university. When you use the full tunnel, your traffic goes through Berkeley’s network.

A bit of history explains old instructions you may still find: bSecure GlobalProtect replaced the older Cisco AnyConnect VPN, which campus retired in 2019. If a guide tells you to install AnyConnect, it is out of date.

Who can use it

• Eligible: students, staff and faculty with an active CalNet ID.
• Cost: no direct user costs, according to the campus service listing.
• Sign-in: CalNet ID and passphrase, then Duo two-step verification.

Visitors and affiliates without a CalNet ID can’t sign in. Visitors from other eduroam schools can use their own institution’s VPN from campus instead.

How to install and connect

On a personal (self-managed) computer

You need admin rights on the machine to install the client.

1. Open a browser and go to https://vpn.berkeley.edu.
2. Sign in with your CalNet ID and passphrase and approve the Duo prompt.
3. Download the GlobalProtect client for your operating system from the portal and install it.
4. Open GlobalProtect and enter vpn.berkeley.edu as the portal address if it asks.
5. Sign in again with CalNet and Duo.
6. Choose a gateway (tunnel type). See the next section for which one.

The getonline.berkeley.edu remote access page is the official walkthrough for personal devices. It has the current download steps for each platform.

On a Berkeley-managed computer

If your machine runs managed Berkeley Desktop, don’t download the client yourself. Install GlobalProtect from Self Service on macOS or BigFix on Windows. If neither has it, ask your department IT contact.

Phones, tablets and Linux

• iOS and Android: install the GlobalProtect app from the App Store or Google Play, then use vpn.berkeley.edu as the portal.
• Linux: the getonline page says a GUI version is shared from a campus Google Drive folder that needs a @berkeley.edu account to open. Follow the link on that page rather than third-party builds.

Only download GlobalProtect from the Berkeley portal, your managed-device catalog, or the official app stores.

Choosing the right tunnel

After you sign in, GlobalProtect asks which gateway to use. This choice matters more than anything else in the setup.

Split Tunnel

This is the default. Per the Statistics department’s campus VPN FAQ, traffic meant for campus goes through the tunnel, while traffic for sites like Google goes directly over your own connection. It is usually faster for everyday browsing, since only campus-bound traffic takes the detour.

Library Access and Full Tunnel

Everything you do online goes through campus and appears to come from a Berkeley IP address. Publishers often license content by IP range, so this is the one you want for journals. The Library’s VPN help page says plainly: if you’re accessing Library journals, use this option.

The trade-off is that all your traffic, including non-university browsing, travels through the campus network while you’re connected. Disconnect when you’re done with your library work.

Restricted Tunnel

This one isn’t for most people. The Restricted VPN page says it is limited to trusted people who administer systems holding critical P4 (highest-sensitivity) data, or who control large amounts of restricted data or key IT infrastructure. Simply using sensitive data doesn’t make you eligible. Researchers in heavily targeted fields may also qualify.

To request access, email rvpn@berkeley.edu with the data and systems involved and at least one group point of contact. Devices must also pass stricter checks. The page lists an encrypted C: drive on Windows, the default “Macintosh HD” volume name on Macs, and current security patches. Devices that fail are blocked. The page also notes that monitoring covers almost every packet leaving connected systems.

You may not need the VPN at all

For library resources, Berkeley gives you two lighter options:

• Start from the library’s own links. If you open a resource through UC Library Search or the Databases A-Z list, you get a login prompt. Sign in with CalNet, or with your library PIN and Cal 1 card number.
• Use the libproxy bookmarklet. For articles you find through Google, Google Scholar or an emailed link, the library’s EZproxy FAQ recommends adding the libproxy bookmarklet to your browser toolbar. Click it when you land on a paywalled page. Installing it is only step one, and it does nothing until you click it on the article page. The library guides also say your browser needs pop-ups, third-party cookies and JavaScript allowed for this to work.

On campus, the picture is simpler. The library says you skip authentication when you are on eduroam or a wired campus connection. Berkeley-Visitor (formerly CalVisitor) is the exception. It is meant for email and general internet use and does not give access to licensed library resources. One campus source also says it won’t let you connect to bSecure GlobalProtect. If you’re a student or staff member on campus, switch to eduroam.

Troubleshooting tips

1. A journal still asks you to pay. Check that you picked “Library Access and Full Tunnel”, not Split Tunnel. Or open the article through the libproxy bookmarklet instead.
2. The client won’t install. On a personal machine you need admin rights. On a managed machine, use Self Service or BigFix.
3. Login loops or Duo never arrives. Confirm your CalNet passphrase works on another campus site and that your Duo device is enrolled.
4. You’re on campus and the VPN fails. If you’re on Berkeley-Visitor, move to eduroam. You probably don’t need the VPN there anyway.
5. Still stuck. Faculty and staff can contact the Berkeley IT Service Desk (itcsshelp@berkeley.edu, 510-664-9000). For library access problems, students can reach Student Technology Services (sts-help@berkeley.edu, 510-642-HELP) or their subject librarian.

The short version

For most Berkeley students and staff, the setup is: install GlobalProtect from vpn.berkeley.edu (or Self Service/BigFix on managed machines), sign in with CalNet and Duo, and use Split Tunnel for campus systems or the Library full tunnel for journals. If all you want is one article, the libproxy bookmarklet is often quicker than starting a VPN.