From OpenConnect:

OpenConnect is a client for Cisco's AnyConnect SSL VPN, which is supported by the ASA5500 Series, by IOS 12.4(9)T or later on Cisco SR500, 870, 880, 1800, 2800, 3800, 7200 Series and Cisco 7301 Routers, and probably others.



Install the openconnect package.


OpenConnect can be used with NetworkManager, or manually via the command line.


Install the networkmanager-openconnect package. Then configure and connect with nm-applet (network manager's tray icon utility from network-manager-applet) or similar utility. After installation, restart the NetworkManager.service.

See NetworkManager for details.

Command Line

Simply run openconnect as root and enter your username and password when prompted:

# openconnect vpnserver

More advanced invocation with username and password:

# echo -n password | openconnect -u user --passwd-on-stdin vpnserver

Often VPN provider are offering different authentication groups for different access configurations like for example for a full tunnel or split tunnel connection. To show the different offered auth-groups and to get more information about the connection to the server in general use:

# openconnect --authenticate vpnserver

Juniper Pulse Client

Here is an example of how to connect to a Juniper Pulse Secure Pulse Client. Only Openconnect version 7.06 and higher are compatible.

The --no-cert-check switch is no longer compatible with Openconnect 7.06 and higher.

Run this command below to get your ssl cert SHA1.

# openconnect --servercert=sha1: --authgroup="single-Factor Pulse Clients" --protocol=nc <VPN_SERVER_ADDRESS>/dana-na/auth/url_6/welcome.cgi --pid-file="/var/run/" --user=<USER_NAME>

It should return something like this. # Server SSL certificate didn't match: sha1:8cde39f3bf9d770cb7d1f2379e86384ff12932bb copy this into the comnmand below.

# openconnect --servercert=sha1:<SHA1_OF_THE_SSL_CERT_FROM_ABOVE> --authgroup="single-Factor Pulse Clients" --protocol=nc <VPN_SERVER_ADDRESS>/dana-na/auth/url_6/welcome.cgi --pid-file="/var/run/" --user=<YOU_USERNAME_HERE>

Integration in netctl

A simple tuntap netctl.profile(5) can be used to integrate OpenConnect in the normal Netctl workflow. For example:


BindsToInterfaces=(enp0s25 wlp2s0)

# Assuming the use of pass(1): 
PASSWORD="`su ${LOCAL_USERNAME} -c "pass ${REMOTE_USERNAME}" | head -n 1`" 

ExecUpPost="echo '${PASSWORD}' | /usr/bin/openconnect --background --pid-file=${PIDFILE} --interface='${Interface}' --authgroup='${AUTHGROUP}' --user='${REMOTE_USERNAME}' --passwd-on-stdin ${SERVER}"
ExecDownPre="kill -INT $(cat ${PIDFILE}) ; resolvconf -d ${Interface} ; ip link delete ${Interface}"

This allows execution like:

$ netctl start vpn
$ netctl restart vpn
$ netctl stop vpn

Note that this relies on LOCAL_USERNAME having a gpg-agent running, with the passphrase for the PGP key already cached, as it is not possible for pass to trigger an interactive query from this environment.

See also