Using Two-Factor RSA Token
with VPN
User Guide
November 2013
Using Your RSA token with WebVPN
1. Establish a connection to the Internet and connect to https://connect.doe.gov
2. Users who are using their RSA Token for the first time should follow the steps below for PIN creation.
Others who have already set up their PIN and used their RSA token previously should enter their six digit
numeric username and passcode; this is the PIN + the RSA token code. The result of this successful
login will be Step 8 below.
3. A login page similar to the picture below will be displayed. Enter your VPN Username (six-digit numeric
ID) and your Password by typing your generated RSA Token code and then click the Login button.
Example; your generated RSA token code is 032848 (from above). In the Password box, you will enter
032848, and then click the Login button.
4. The WebVPN application will direct you to set up a new PIN based on 4 to 8 alphanumeric characters.
This PIN will become a permanent part of your new two-factor token so make sure you set it to something
you can remember. You will need to enter the PIN twice to confirm. Please refer to the image below for
reference.
3
5. Wait for your RSA Token code to change and your passcode, which is a combination of your two-factor
in + the RSA Token code. Once this is done click “Continue” to proceed to the final step in this process.
Example: your two-factor pin is abcd1234 + your generated RSA token code is 032848. In the Response: box,
you will enter abcd1234032848, and then click the Continue button.
The RSA SecurID numeric token code changes every 30 or 60 seconds (depending on the token
model you have), and if three or more unsuccessful attempts happen before the token code changes
the token will automatically be disabled and you will need to contact PKI Support for re-activation.
Note: The bars on the left side of your RSA token screen show how much time is left
until a new 6-digit display will appear. If your RSA display shows one bar, you may
want to wait until the new number is displayed before entering this part of your Password
4
6. If you were successful in logging in with your pin + pass code you will be prompted with the Connected to
EITS VPN Services page.
5
Using Your RSA token with the Cisco AnyConnect client
1. Establish a connection to the Internet and open the Cisco Systems VPN Client by
clicking on Start -> All Programs -> Cisco -> Cisco AnyConnect VPN Client -> Cisco AnyConnect VPN
Client.
2. Type connect.doe.gov in the “Connect to” box if it is blank. You will not have to re-enter the server once
you have successfully connected once.
3. Click on the “Connect” button on the bottom.
4. A username and password box will appear. Enter your VPN username and PIN+6 digit token
which makes up the password.
First time AnyConnect VPN users
1. If this is the first time using the VPN connection and you need to create a PIN, enter only the 6
digits from the token as shown on step 2 of the WebVPN instructions. Creating a PIN is done in
the exact same way.
For further assistance, please contact the Service Desk at 301-903-2500 option2,3; (toll-free at 866-834-6246);
EITS.ServiceDesk@hq.doe.gov
