Supported protocols

Supported VPN protocols

VPN Up speaks every SSL-VPN protocol that OpenConnect supports. Set <protocol> on a profile (or pick it in vpn-up add-profile).

Protocol value	Gateway	Notes
anyconnect	Cisco AnyConnect (and ocserv)	Default. Full AuthGroup/realm and browser SSO support.
gp	Palo Alto GlobalProtect	Portal/gateway login; browser SSO supported.
pulse	Pulse Connect Secure	Pulse/Ivanti SSL VPN.
nc	Juniper Network Connect	Legacy Juniper; no SSO support.

Cisco AnyConnect from the command line

A command-line alternative to the Cisco AnyConnect Secure Mobility Client for any AnyConnect-compatible gateway:

vpn-up start "Work VPN"   # protocol: anyconnect

Supports AuthGroup/realm selection, Duo 2FA, certificate pinning, and browser-based SSO for Okta/Azure AD/Ping gateways.

GlobalProtect, Pulse Secure, and Juniper

Set the matching protocol value in the profile:

<VPN>
  <name>GP VPN</name>
  <protocol>gp</protocol>          <!-- or: pulse, nc -->
  <host>gw.example.com</host>
  <user>you</user>
</VPN>

GlobalProtect supports browser SSO; Pulse and Juniper use password / Duo 2FA flows.

Not sure what your gateway speaks?

If the vendor client is “Cisco AnyConnect,” use anyconnect. For Palo Alto GlobalProtect use gp. When in doubt, try anyconnect first — many gateways are AnyConnect-compatible. See troubleshooting if a connection fails.

Authenticating with a certificate instead of (or in addition to) a password? See client-certificate authentication. Want only some traffic through the VPN? See split-tunnel routing.