Secure Remote Access at Penn: The 2026 Guide to University and Penn Medicine Connections

Remote access at the University of Pennsylvania is primarily managed through two distinct pathways: the University's GlobalProtect VPN for academic use and the Penn Medicine Remote Access portal for clinical and health system personnel. To establish a secure connection in 2026, users require an active PennKey, a registered Duo Security multi-factor authentication device, and the latest client-side software compatible with current enterprise security protocols.

Depending on your affiliation, your technical requirements will differ significantly. If you are a student or faculty member accessing library resources or campus servers, you will utilize the Information Systems and Computing (ISC) infrastructure. Conversely, if you are a clinician or employee of the University of Pennsylvania Health System (UPHS), you must adhere to stricter HIPAA-compliant protocols via the Penn Medicine remote gateways.

The Architecture of Remote Connectivity at Penn in 2026

The remote access ecosystem at Penn has evolved into a Zero Trust Architecture (ZTA) to defend against the sophisticated cyber threats prevalent in 2026. This framework ensures that identity is verified at every step, regardless of whether the user is on-campus or halfway across the globe. The backbone of this system relies on high-speed encrypted tunnels that provide near-native performance for data-intensive research and clinical applications.

Core Components of the Remote Access Stack

1. Identity Provider (IdP): The PennKey remains the universal credential. In 2026, PennKey authentication is integrated with advanced biometric challenges and FIDO2 standards to prevent credential harvesting.
2. Multi-Factor Authentication (MFA): Duo Security is mandatory for all remote sessions. The 2026 implementation utilizes "Verified Push," requiring users to enter a code displayed on the login screen into their mobile device to thwart "push fatigue" attacks.
3. Endpoint Posture Assessment: Before a connection is authorized, the remote access client (GlobalProtect or FortiClient) scans the user's device. It verifies that the operating system is patched, antivirus is active, and disk encryption (such as BitLocker or FileVault) is enabled.
4. Split-Tunneling Logic: To optimize bandwidth, Penn uses intelligent split-tunneling. This means only traffic destined for Penn’s private network (e.g., internal databases, canvas, or department file shares) goes through the VPN, while general internet traffic (e.g., streaming or personal browsing) exits through the user’s local ISP.

Accessing the University Network (Students, Faculty, and Staff)

For those affiliated with the academic side of the University, the GlobalProtect VPN client is the standard tool for remote access. This service provides a secure "tunnel" into the Penn network, assigning the user a Penn IP address which is often required to access restricted journals and internal administrative systems.

Installation and Configuration Steps

To set up your connection in 2026, follow these authoritative steps:

Prerequisite Verification Ensure your device is running a supported operating system. As of 2026, this includes Windows 11 (version 24H2 or later), macOS 15 (Sequoia) or macOS 16, and current iterations of enterprise Linux distributions (RHEL/Ubuntu).

1. Download the Client: Visit the official Penn ISC software portal. Do not download GlobalProtect from third-party sites, as these may contain compromised binaries.
2. Portal Address: During the initial setup, the software will ask for a portal address. Enter vpn.upenn.edu for general university access.
3. Authentication: A browser window will launch for PennKey login. Complete the Duo Verified Push challenge on your registered mobile device.
4. Connection Confirmation: Once the status changes to Connected, your traffic to Penn resources is encrypted.

Department-Specific VPNs

Certain schools within the University, such as the Wharton School or the School of Engineering and Applied Science (SEAS), maintain their own specialized VPN gateways to provide access to proprietary research clusters or licensing servers.

• Wharton: Users typically connect via vpn.wharton.upenn.edu to access Wharton-specific drives and the WRDS platform.
• SEAS: Engineering students may require the FortiClient or a specific GlobalProtect gateway to access high-performance computing (HPC) environments.

Remote Access for Penn Medicine (UPHS Employees)

Penn Medicine operates on a separate, more stringent network designed to protect Protected Health Information (PHI) under HIPAA regulations. Accessing clinical systems like Epic (PennChart) or internal medical imaging (PACS) requires specific software and a higher tier of security clearance.

The Citrix Workspace and FortiClient Ecosystem

Most Penn Medicine employees use the Citrix Workspace app, which allows them to run clinical applications in a virtualized environment without storing any sensitive data on their local machine.

• Penn Medicine Remote Portal: The primary gateway is located at remote.pennmedicine.org.
• Authentication Requirements: You must use your Penn Medicine (UPHS) credentials, which may differ from your University PennKey. Duo MFA is also required here but is often managed through the Penn Medicine-specific Duo instance.
• FortiClient VPN: For users who need a full network tunnel rather than just application virtualization, the FortiClient VPN is utilized. This is common for IT staff or researchers working with large clinical datasets.

Technical Specifications and Hardware Standards in 2026

To ensure a stable remote access experience, Penn's IT policy for 2026 mandates specific hardware and software benchmarks. Using outdated hardware not only slows down the connection but may result in the automated "Posture Assessment" blocking your access.

Recommended System Requirements

• Processor: Minimum Hexa-core (6-core) CPU (e.g., Intel Core i5/i7 14th Gen, Apple M3/M4, or AMD Ryzen 7000+ series).
• Memory: 16GB RAM is the baseline for 2026 to handle the overhead of simultaneous VPN encryption and virtualized applications.
• Network: A stable broadband connection with at least 25 Mbps download and 10 Mbps upload. Satellite internet (excluding low-earth orbit providers like Starlink) is generally discouraged due to high latency causing Citrix session drops.
• Security Hardware: A Trusted Platform Module (TPM) 2.0 is required for all Windows-based remote access to ensure secure key storage.

Troubleshooting Common Remote Access Issues

Even with the advanced infrastructure of 2026, users may encounter connectivity hurdles. Most issues stem from local network configurations or synchronized clock errors that interfere with MFA tokens.

Resolution Strategies for Connectivity Failures

1. MFA Out of Sync: If Duo pushes are not appearing, ensure your mobile device's time is set to Automatic. A discrepancy of even 60 seconds can cause the authentication token to be rejected by Penn's RADIUS servers.
2. DNS Flush: If you can connect to the VPN but cannot reach specific "penn.edu" sites, your local DNS cache may be stale. Use the terminal/command prompt to perform a DNS flush.
3. MTU Size Issues: If your connection is stable but extremely slow, your home router's Maximum Transmission Unit (MTU) might be too large for the VPN's encapsulated packets. Lowering the MTU on your local router to 1350 or 1400 often resolves "packet fragmentation" issues.
4. Local Firewall Conflicts: Ensure that UDP ports 4500 and 500 (standard for IPsec VPNs) or TCP port 443 (for SSL-based VPNs) are not blocked by your home ISP or router firewall.

Security Best Practices for Remote Work in 2026

Maintaining the integrity of the Penn network is a shared responsibility. In 2026, the University has implemented a "Device Health" policy that can automatically revoke access if a device is found to be non-compliant.

• Avoid Public Wi-Fi: Always use the VPN when on public or unsecured networks (airports, cafes). Even with HTTPS, metadata can be exposed without a VPN tunnel.
• Update Promptly: Software vulnerabilities are discovered daily. Set your GlobalProtect or Citrix client to "Auto-Update" to ensure you have the latest security patches.
• Session Management: Always disconnect from the VPN when your work is finished. Idle sessions are a target for session hijacking, and Penn’s servers are configured to auto-terminate sessions after 12 hours of activity or 30 minutes of inactivity.
• Data Residency: Remember that the VPN provides access to data, but it does not necessarily make your local device a secure storage location. For sensitive research or clinical data, always use PennBox or Penn OneDrive rather than saving files to your local desktop.

Frequently Asked Questions (FAQ)

Do I need a VPN to access Penn Libraries from home?

Yes, most restricted academic databases and journals require a Penn IP address, which is provided by the GlobalProtect VPN. Alternatively, many library resources can be accessed via EZProxy, which requires a PennKey login but does not require a full VPN client installation.

Can I use the Penn Medicine VPN if I am a University student?

No, the Penn Medicine (UPHS) network is restricted to clinical staff, medical students on rotation, and specific health-system employees. University students should use the ISC GlobalProtect VPN unless they have been explicitly granted UPHS credentials for clinical work.

What should I do if my PennKey is locked?

If you fail to provide the correct credentials multiple times, your PennKey may be temporarily locked for security. You must contact the PennKey Support team or visit the PennKey website to use the "Challenge-Response" questions or a "Setup Code" to regain access.

Does the Penn VPN work internationally, including in China or the Middle East?

Penn's VPN generally works globally; however, some countries implement strict Deep Packet Inspection (DPI) that may block standard VPN protocols. In these cases, using the "SSL-Tunnel" mode within the GlobalProtect settings is often more successful than the default IPsec protocol.

Is my personal browsing private while connected to the Penn VPN?

Because Penn uses split-tunneling, your personal traffic (like Netflix or personal email) typically does not travel through the Penn network. However, any traffic directed toward "penn.edu" domains or resources is logged and monitored by ISC for security purposes in accordance with the University's Acceptable Use Policy.

Strategic Recommendation for 2026

For the most resilient remote access experience, users should maintain a secondary MFA method (such as a hardware security key or Duo bypass codes) in addition to their primary mobile device. As we move through 2026, the transition toward passwordless authentication will continue to accelerate at Penn. Ensuring your hardware meets the TPM 2.0 and biometric standards today will guarantee seamless access to the University's digital resources as these security protocols become mandatory across all departments.