We maintain point to point connections to link various resources to the testbed, mostly at layer 2 for networking experiments. This consists of dialable links over Internet2, as well as IKEv2/IPSec tunnels over the public internet.

User VPN Service

Connect to the following endpoints using your COSMOS username and password. Your VPN connection will only be active during your approved reservation time-slots.

Testbed DomainVPN EndpointControl Subnet =Data 1 Subnet= =Data 2 Subnet=
COSMOS Main Testbed
COSMOS Sandbox 1
COSMOS Sandbox 2

Please be aware of the subnet specified in the table above for the testbed domain you are connecting to. If your local network shares the same IP space, there could be unforeseen problems that will be difficult to troubleshoot.

Instructions per Client OS


Windows PowerShell commands for specific testbed domains:

Add-VpnConnection -Name "COSMOS sb1" -ServerAddress -DnsSuffix -TunnelType IKEv2 -EncryptionLevel Required -AuthenticationMethod EAP -SplitTunneling -RememberCredential -PassThru
Add-VpnConnectionRoute -ConnectionName "COSMOS sb1" -DestinationPrefix -PassThru
Add-VpnConnectionRoute -ConnectionName "COSMOS sb1" -DestinationPrefix -PassThru
Add-VpnConnectionRoute -ConnectionName "COSMOS sb1" -DestinationPrefix -PassThru

Add-VpnConnection -Name "COSMOS sb2" -ServerAddress -DnsSuffix -TunnelType IKEv2 -EncryptionLevel Required -AuthenticationMethod EAP -SplitTunneling -RememberCredential -PassThru
Add-VpnConnectionRoute -ConnectionName "COSMOS sb2" -DestinationPrefix -PassThru
Add-VpnConnectionRoute -ConnectionName "COSMOS sb2" -DestinationPrefix -PassThru
Add-VpnConnectionRoute -ConnectionName "COSMOS sb2" -DestinationPrefix -PassThru

Add-VpnConnection -Name "COSMOS Main Testbed" -ServerAddress -DnsSuffix -TunnelType IKEv2 -EncryptionLevel Required -AuthenticationMethod EAP -SplitTunneling -RememberCredential -PassThru
Add-VpnConnectionRoute -ConnectionName "COSMOS Main Testbed" -DestinationPrefix -PassThru
Add-VpnConnectionRoute -ConnectionName "COSMOS Main Testbed" -DestinationPrefix -PassThru
Add-VpnConnectionRoute -ConnectionName "COSMOS Main Testbed" -DestinationPrefix -PassThru

Open the PowerShell command window as administrator

Opening !PowerShell Command Window

Cut and paste the pair of commands into the PowerShell window as show in figure below:

Executing !PowerShell Commands

Alternatively, [download the Windows PowerShell script] to your local machine, right-click on it and run it as administrator. This will create three VPN connections for the three COSMOS domains.

Once VPN connection(s) are created, you will be able to bring the connection menu up by left mouse click on the network icon on the Windows task bar:

VPN Menu

Selecting the appropriate connection (for which you must have current reservation) will bring up the prompt for username and password (only the very first time that particular VPN connection is activated):

VPN Username/Password


Instructions are provided for configuring the strongswan network manager plugin. Strongswan is an IKE daemon which can be used to set up an IPSEC tunnel. The strongswan package is available for a variety of linux distros, and can be configured manually through files in /etc instead of installing the network manager plugin. See this page on the strongswan wiki for examples.

These instructions are specific to ubuntu 20.04, although they should be similar for other versions of ubuntu. Additional linux distros which use network-manager may provide a version of the plugin through their packaging system.

To install the plugin, run apt-get install network-manager-strongswan.

Open settings and navigate to the Network tab. Below wired connections, there should be a section for VPN connections. Select the "+" to add a new VPN connection.

Network settings for Ubuntu

Fill in the connection information as below, making sure to use your cosmos username and select the correct domain (e.g.

strongswan configuration for ubuntu

In the IPv4 tab, you can configure manual routes or you can simply check the option to "Use this connection only for resources on its network".

The VPN can be enabled and disabled through the entry in network settings:

How to enable vpn through ubuntu settings

When you enable the vpn, you will be prompted to enter the password for your cosmos username.

Note: there has been some difficulty with DNS resolution over the vpn connection. If you encounter this problem, please let us know. Until the issue is resolved, you can use ip addresses instead of dns names. To find the ip address of a machine, use the host utility to query the dns server located at

how to look up host ip address


  1. Open "System Preferences" by clicking on the "apple logo" and selecting "System Preferences…" from the menu.

  1. In the "System Preferences" window, go to "Network"

  1. Click the "+" button on the left hand side

  1. Select "VPN" in the "Interface" drop-down and select "IKEv2" from the "VPN Type" drop-down. The "Service Name" can be anything you like (example: COSMOS sb1). Then click "Create".

  1. Fill in the "Service Address" and "Remote ID" fields with the correct VPN endpoint for the specific testbed you want to connect to (example: Note that the two fields must be identical.

  1. Click "Authentication Settings…"

  1. Enter your COSMOS username in the "Username" field. Optionally you can also enter your COSMOS password in the "Password" field if you do not want to enter it every time you connect to the VPN. Then click "OK".

  1. IMPORTANT: You must click "Apply" for the VPN settings to be saved correctly.

  1. To connect to the VPN, click "Connect".

  1. If you did not fill in your COSMOS password in step 7, you will be asked to enter it now.

Done! You are now connected via VPN to the testbed domain.

Remember that you must have a currently approved reservation in order to use the VPN. Also, please don't forget to disconnect from the VPN when you are done.

Each testbed domain (ie.,, etc.) requires its own VPN configuration.

Last modified 12 months ago Last modified on Nov 29, 2022, 1:52:05 AM

Attachments (19)

Download all attachments as: .zip

Note: See TracWiki for help on using the wiki.