Remote Access Penn: The 2026 Comprehensive Connection And Security Guide

Disambiguation Notice: This guide covers secure remote network access across the University of Pennsylvania (PennKey, GlobalProtect VPN, PennFlex) and Penn Medicine (UPHS Remote Access Portal, SecureAuth, and Epic Hyperspace via Citrix). If you are attempting to reach Pennsylvania State University (Penn State) or Pennsylvania state government resources, please refer to their respective enterprise portals.

Accessing internal digital resources at the University of Pennsylvania and the University of Pennsylvania Health System (UPHS) requires navigating two distinct yet interconnected IT architectures. Whether you are an academic researcher running simulations through High-Performance Computing (HPC) clusters, an administrative staff member accessing PennWorks and Workday, or a clinical provider reviewing inpatient charts in Epic Hyperspace, remote access protocols are engineered around zero-trust network architecture (ZTNA).

In 2026, security baselines across the university and health system require endpoint health verification, continuous behavioral authentication, and mandatory hardware-bound or cryptographic multi-factor authentication (MFA). Bypassing traditional perimeter firewalls is no longer possible with simple credentials; you must configure your device to meet active compliance benchmarks before internal subnets grant authorization.

Technical Architecture: UPenn Campus vs. Penn Medicine Networks

The University of Pennsylvania operates separate security domains for its academic/research units and its clinical healthcare enterprise. While both integrate with PennKey single sign-on (SSO) at foundational touchpoints, their production subnets, VPN concentrators, and endpoint management systems are completely segregated to protect Protected Health Information (PHI) under HIPAA regulations and restricted research data under federal compliance mandates.

University of Pennsylvania (Campus IT / ISC)

Information Systems & Computing (ISC) governs the central campus network. Campus remote access relies primarily on Palo Alto Networks GlobalProtect VPN, federated Shibboleth authentication, and PennKey managed through Duo Security with push verification, FIDO2 WebAuthn security keys, or biometric passes. Academic departments—such as the School of Arts and Sciences (SAS), the Wharton School, and the School of Engineering and Applied Science (SEAS)—maintain tailored gateways within GlobalProtect or run dedicated terminal environments like Wharton Virtual Lab and SEAS Eniac environments.

Penn Medicine (UPHS Enterprise IT)

The clinical environment operates under strict zero-trust parameters managed by Penn Medicine Information Services (IS). Direct VPN tunnel connections to internal hospital subnets are heavily restricted. Instead, external access is channeled through the UPHS Remote Access Portal via Citrix Workspace, secured by SecureAuth identity provider integration and Duo MFA. This architecture containerizes clinical workflows, ensuring that Epic Hyperspace, PennChart, and clinical imaging systems (PACS) remain inside the secure boundary without exposing raw TCP/IP sessions to unmanaged personal hardware.

Gateway Comparison: Core Penn Remote Access Methods

Selecting the correct remote access conduit depends on your role, the classification of the data you handle, and whether your device is institutionally managed or personally owned.

Configuring University Campus Remote Access (ISC GlobalProtect)

To establish an encrypted tunnel to the general campus network, users must install the Palo Alto Networks GlobalProtect client configured to point toward central ISC gateways.

System Preparation and Compatibility

Before initiating installation, confirm that your workstation runs a supported operating system: Windows 11 (23H2 or newer), macOS Sonoma (14.x) or Sequoia (15.x), or supported Linux distributions (Ubuntu LTS or RHEL). Your local endpoint must have full-disk encryption enabled (BitLocker on Windows, FileVault on macOS) and run an active anti-malware solution.

Step-by-Step Connection Procedure

1. Verify Your PennKey and Duo MFA Enrollment: Navigate to the PennKey management self-service portal to ensure your password is valid and that your Duo account contains at least two verified authentication devices (such as a primary smartphone with Duo Mobile and a backup hardware token or telephone number).

2. Download the Official Client: Do not download the GlobalProtect software from third-party vendor sites. Log in to the official Penn GlobalProtect portal using your central PennKey credentials. Download the installer matching your OS architecture (x64 or ARM64).

3. Install and Configure Gateway Address: Run the installer following the system prompts. When prompted for the portal address, input the designated campus portal address provided by your departmental Local Support Provider (LSP), typically ending in the institutional university domain.

4. Authenticate via Single Sign-On: Click Connect. The client will launch an internal or default system browser window initiating the PennKey SSO redirect. Supply your username and password, then approve the prompt triggered on your Duo Mobile app.

5. Establish Session Verification: Once authenticated, the GlobalProtect tray icon displays a continuous connected shield status. Verify connectivity by accessing an internal campus asset, such as an internal departmental file server or an IP-restricted library research repository.

Accessing Penn Medicine Systems: Clinical Protocols

Clinical users must follow an alternate, sandboxed workflow designed to prevent patient data leakage. Accessing PennChart (Epic) or hospital management applications outside Penn Medicine facilities requires the Citrix Workspace environment.

Operational Prerequisite for Penn Medicine Users

All remote clinical connections require an active, unsuspended UPHS active directory account. If your account undergoes a password reset or dormancy lockout, remote portals will reject your credentials immediately without routing to the MFA step. Ensure your identity profile is active via the Penn Medicine Identity and Access portal prior to authenticating remotely.

Accessing Systems via the UPHS Web Gateway

1. Install Citrix Workspace: Ensure the current production release of Citrix Workspace is installed on your local computer. Ensure that browser extensions or local firewalls do not block ICA file types or native protocol handlers.

2. Open the Remote Access Portal: Navigate to the official Penn Medicine remote web portal using a compliant browser (Chrome, Safari, Edge, or Firefox).

3. Dual-Factor Identity Verification: Enter your UPHS network credentials. You will be prompted by the SecureAuth identity engine to verify your session through Duo MFA. Complete the verification on your provisioned mobile device.

4. Launching PennChart and Clinical Apps: Upon successful verification, the storefront displays authorized clinical and administrative icons. Clicking the PennChart icon initiates a virtualized presentation layer inside Citrix Workspace. The patient record software executes inside the Penn Medicine secure datacenter; no PHI is cached, downloaded, or written to your local physical machine's hard drive.

Troubleshooting Common Remote Access Connection Failures

When remote connections fail, identifying the layer at which the drop occurs saves critical diagnostic time. Use the following structured technical remedies to resolve common errors.

1. GlobalProtect Error: "Connection Failed - Gateway Unreachable"

• Cause: Often caused by local ISP blocks, corporate captive portals (such as public hotel or airport Wi-Fi), or outbound UDP/TCP port restrictions blocking IPsec/SSL VPN tunnels.
• Remedy: Open GlobalProtect Settings, navigate to the Gateway tab, and toggle the connection protocol or manually re-select the secondary campus gateway. If connected to a public Wi-Fi access point, ensure you have completed the network captive portal terms approval prior to initiating the VPN client.

2. Duo MFA Push Notification Not Arriving

• Cause: Network latency on the endpoint mobile carrier, power-saving restrictions on the mobile operating system, or misaligned device timestamps.
• Remedy: Open the Duo Mobile app manually and refresh the account list. If the notification does not appear, select the "Enter Passcode" option on the PennKey login screen, generate an offline one-time password inside the Duo Mobile app, and type it directly into the prompt.

3. Citrix Workspace Fails to Launch Virtual Desktop or PennChart

• Cause: Mismatched file associations for .ica files or strict popup blockers preventing the handoff from the web browser to the local client.
• Remedy: Reset file associations in your operating system so that .ica configuration files automatically execute with Citrix Workspace. Ensure that third-party ad blockers or security extensions add the remote access portal domain to their bypass exception lists.

4. PennKey "Invalid Credentials" or Account Lockdown

• Cause: Repeated failed background authentication attempts from mobile devices with expired cached passwords (such as eduroam or university email profiles).
• Remedy: Temporarily disable Wi-Fi on mobile devices that might be attempting connections with stale passwords. Access the PennKey password self-service manager from an unauthenticated browser to confirm your account status or execute a manual password reset.

Mandatory Endpoint Security Requirements for Remote Access

Operating an external endpoint connected to the University of Pennsylvania or Penn Medicine environment carries rigorous administrative and security obligations. Enterprise policies enforce continuous auditing of endpoints interacting with protected data.

• Mandatory Encryption: Every laptop or desktop accessing institutional resources must feature hardware or OS-level storage encryption. Unencrypted external drives or USB media must not interface with systems handling university non-public data.
• Automated System Updates: Operating systems must be configured to receive and apply security patches within 14 days of commercial release. Outdated versions of Windows or macOS failing to meet active lifecycle baselines will be flagged and blocked by network access control (NAC) engines.
• Separation of Work and Personal Environments: When utilizing personal computers (BYOD) to interface with Penn resources, users must avoid downloading, storing, or processing sensitive institutional data on personal local drives. All sensitive operations must occur inside authorized virtual desktop environments (AVD, Citrix Workspace, or Wharton Virtual Lab).
• Immediate Incident Reporting: In the event that a laptop or mobile device containing active PennKey tokens, cached UPHS credentials, or institutional data is lost or compromised, the user must immediately notify the ISC Information Security Office or the Penn Medicine Service Desk to revoke active sessions and rotate security certificates.

Frequently Asked Questions

Can I access Penn Library electronic resources without installing the GlobalProtect VPN?

Yes, you can access most electronic journals and library databases using the PennProxy service without connecting to the GlobalProtect VPN. When browsing the Penn Libraries catalog or using direct resource links, you will be prompted to log in using your PennKey and Duo MFA, granting seamless off-campus proxy access through your web browser. However, accessing proprietary datasets, localized research files, or high-performance computing clusters requires the GlobalProtect VPN client.

Why does my Penn Medicine Citrix session disconnect after a period of inactivity?

Citrix sessions are configured to auto-lock and disconnect after 15 minutes of inactivity to maintain strict compliance with HIPAA security standards. This automated timeout minimizes the risk of unauthorized access to clinical data on unattended terminals. If your session disconnects, your underlying application state is typically preserved within the datacenter for a short grace window, allowing you to re-authenticate and resume your active chart or workspace.

Which departments require separate VPN profiles instead of the standard ISC GlobalProtect portal?

The Wharton School and the School of Engineering and Applied Science (SEAS) maintain specialized VPN gateways with restricted routing configurations for their specific lab environments, Linux compute grids, and research filesystems. While central staff and general students use the main ISC portal, Wharton and SEAS affiliates should consult their respective internal IT guidelines to ensure their GlobalProtect client points to the appropriate school-level gateway address.

Can I run GlobalProtect and Penn Medicine Citrix simultaneously on the same machine?

Running both concurrently is generally not recommended as routing tables and security software (such as endpoint integrity agents) can conflict, causing dropped network packets or frozen Citrix sessions. For clinical workflows, authenticate directly to the UPHS Remote Access Portal via your local internet connection; you do not need to activate the university campus GlobalProtect VPN to launch PennChart or other Penn Medicine Citrix applications.

Optimizing Your Connection

Securing uninterrupted remote access to the University of Pennsylvania and Penn Medicine relies on maintaining verified credentials, running updated operating systems, and using the correct gateway for your administrative, research, or clinical duties. Review your Duo MFA backup methods, verify your device encryption settings, and coordinate with your school or clinical department Local Support Provider (LSP) to ensure your remote workflow remains fully compliant with enterprise standards.