Table of Contents
Who is eligible for the Restricted VPN (rVPN) service?
Individuals who access and control a large quantity of restricted data or key IT infrastructure as part of their normal business activity may be eligible for this service. Individuals who use the data are not necessarily eligible; this service is for those with a high level of access to bulk quantities of data (typically P4). Additionally, researchers working in heavily targeted areas may be eligible.
To confirm eligibility, please contact rvpn@berkeley.edu with a description of the types and quantities of data you are accessing, and where it is stored.
Should the Restricted VPN (rVPN) be used full time?
Because of the increased monitoring, most users will only want to use the Restricted VPN for access to the systems that host the restricted data. For general tasks, it is preferable to use the normal VPN service.
How is the rVPN monitoring different from being on campus?
The degree of monitoring on campus varies depending on the location of the system. For most users, the only traffic inspected for signs of compromise is traffic that leaves the campus network or is directed at systems protected by central firewalls. For networks protected by a departmental firewall, there is additional monitoring at that location.
When using the Restricted VPN, monitoring occurs for almost every packet that leaves the system connected to the VPN.
How does the rVPN monitoring differ from that of the normal VPN?
The normal VPN has minimal traffic monitoring beyond login information. In comparison, the Restricted VPN monitors all traffic as it exits the VPN and employs the vulnerability, anti-spyware, antivirus, file monitoring, and threat detection/blocking features of the Palo Alto firewalls.
How is the rVPN different from the regular VPN service?
The regular VPN allows remote access to campus resources. The Restricted VPN enforces stricter security controls, including:
- Logging all network traffic.
- Detecting signs of unusual activity.
- Using security profiles to block malicious or vulnerability-related traffic (Medium severity or higher).
- Monitoring host system security (OS version, malware protection, disk encryption, and patching status).
What traffic is blocked by the rVPN?
Traffic is blocked if it is interacting with IP addresses, hostnames, or URLs known to be involved in malicious activity. These lists are derived from internal monitoring and reputable third-party sources. Additionally, any traffic identified as malicious by Palo Alto Networks (rated Medium or higher) is automatically blocked.