vpn-up.command.profiles.default

<VPNs>
    <!-- VPN PROFILE 1 -->
    <VPN>
        <name>VPN PROFILE 1</name>
        <!-- Available protocol options: 
             - anyconnect: Compatible with Cisco AnyConnect SSL VPN, as well as ocserv (default)
             - nc: Compatible with Juniper Network Connect
             - gp: Compatible with Palo Alto Networks (PAN) GlobalProtect SSL VPN
             - pulse: Compatible with Pulse Connect Secure SSL VPN -->
        <protocol options="anyconnect, nc, gp, pulse">anyconnect</protocol>
        <host></host>
        <authGroup></authGroup>
        <user></user>
        <password>&lt;password&gt;</password>
        <!-- Duo 2FA Method options:
             - passcode: Log in using a passcode, either generated with Duo Mobile, sent via SMS, generated by your hardware token, or provided by an administrator.
             - push: Push a login request to your registered phone (if you have Duo Mobile installed and activated on your iOS, Android, or Windows phone device).
             - phone: Authenticate via callback to your registered phone.
             - sms: Sends an SMS message with a new batch of passcodes to your registered device. -->
        <duo2FAMethod options="passcode, push, phone, sms">&lt;2famethod&gt;</duo2FAMethod>
        <serverCertificate></serverCertificate> <!-- SHA1 -->
        <!-- authMode: password (default) or sso. Use 'sso' when the gateway
             forces a browser-based SAML/SSO login (Okta, Azure AD, Ping) with
             an embedded Duo iframe. Requires openconnect >= 9.0; runs in the
             foreground and cannot run as a login service. -->
        <authMode>password</authMode>
        <!-- tokenMode: empty (default) or totp for an authenticator-app code.
             The TOTP secret is stored in the secrets backend, not here:
             vpn-up set-secret "<profile name>" token_secret  (needs oathtool). -->
        <tokenMode></tokenMode>
        <!-- extraArgs (advanced): extra openconnect flags passed verbatim at
             connect time, such as no-dtls, os=win, csd-wrapper, or a split-tunnel
             script (write each with its usual leading dashes). Quotes are
             respected. Avoid flags vpn-up already manages (protocol, user,
             pid-file, passwd-on-stdin, background, servercert, authgroup,
             external-browser, certificate, sslkey). openconnect runs as root, so
             some flags (csd-wrapper, script) execute programs as root. Full list
             and examples: https://sorinipate.github.io/vpn-up-for-openconnect/usage/ -->
        <extraArgs></extraArgs>
        <!-- clientCertificate / clientKey (optional): X.509 client-certificate
             authentication. Each may be a file path or a PKCS#11 URI for a
             smartcard / YubiKey PIV, e.g.
               <clientCertificate>/etc/vpn/me.pem</clientCertificate>
               <clientCertificate>pkcs11:manufacturer=piv_II;id=%01</clientCertificate>
             clientKey is only needed when the private key is separate from the
             cert. The cert/key path or URI is NOT a secret; a key passphrase or
             PKCS#11 PIN is — store it in the secrets backend instead of here:
             vpn-up set-secret "<profile name>" key_password
             An encrypted key prompts for its passphrase interactively (foreground
             only). For a login service, use an unencrypted 0600 key or a PKCS#11
             token with a stored PIN. -->
        <clientCertificate></clientCertificate>
        <clientKey></clientKey>
        <!-- proxy (optional): HTTP/SOCKS proxy URL for openconnect, e.g.
             http://proxy.corp:8080 or socks5://127.0.0.1:1080. It is an
             identifier, not a secret; avoid embedding user:pass in the URL
             (that would put credentials on the command line). -->
        <proxy></proxy>
    </VPN>

    <!-- VPN PROFILE 2 -->
    <VPN>
        <name>VPN PROFILE 2</name>
        <!-- Protocol options are the same as for VPN PROFILE 1 -->
        <protocol options="anyconnect, nc, gp, pulse">anyconnect</protocol>
        <host></host>
        <authGroup></authGroup>
        <user></user>
        <password>&lt;password&gt;</password>
        <!-- Duo 2FA Method options are the same as for VPN PROFILE 1 -->
        <duo2FAMethod options="passcode, push, phone, sms">&lt;2famethod&gt;</duo2FAMethod>
        <serverCertificate></serverCertificate> <!-- SHA1 -->
        <!-- authMode options are the same as for VPN PROFILE 1 -->
        <authMode>password</authMode>
        <!-- tokenMode: empty (default) or totp for an authenticator-app code.
             The TOTP secret is stored in the secrets backend, not here:
             vpn-up set-secret "<profile name>" token_secret  (needs oathtool). -->
        <tokenMode></tokenMode>
        <!-- extraArgs (advanced): see VPN PROFILE 1. -->
        <extraArgs></extraArgs>
        <!-- clientCertificate / clientKey: see VPN PROFILE 1. A key passphrase or
             PKCS#11 PIN goes in the secrets backend (key_password), not here. -->
        <clientCertificate></clientCertificate>
        <clientKey></clientKey>
        <!-- proxy: see VPN PROFILE 1 (HTTP/SOCKS proxy URL for openconnect). -->
        <proxy></proxy>
    </VPN>
    <!-- Add more VPN profiles as needed -->
</VPNs>