VPN

VPN configuration lets Neo reach targets on private networks, internal environments, and isolated infrastructure. Once configured, agents connect to the VPN automatically when a task requires access to internal hosts. Go to Settings → VPN to configure your provider. Providers marked “Configured” have credentials stored and are ready to use. You can store credentials for multiple providers and switch between them as needed. If your provider is not listed, you can still configure it by adding the required environment variables directly in Secrets.

​

Supported providers

​

WireGuard

Upload your WireGuard .conf file.

​

OpenVPN

Upload your OpenVPN .ovpn file and provide credentials if your server requires authentication.

​

OpenConnect

Used for Cisco AnyConnect-compatible servers and other OpenConnect-supported gateways.

​

GlobalProtect

Connects to Palo Alto GlobalProtect portals, including Okta SAML/SSO with TOTP MFA. Provide the portal plus either credentials (with an optional TOTP secret to automate MFA) or a pre-obtained portal cookie. Only the portal is required.

​

Tailscale

Connects Neo as a node on your Tailnet. Get your auth key from the Tailscale Admin Console.

​

IPsec/IKEv2

Upload your IPsec configuration and secrets files.

​

Cisco Meraki

Connects via Meraki Client VPN. Find your PSK in the Meraki Dashboard under Security & SD-WAN > Client VPN.

​

Twingate

Connects Neo as a service account on your Twingate network. Get your service key from Twingate Admin Console under Service Accounts.

​

Cloudflare WARP

Supports site-to-site tunnel mode, headless Zero Trust enrollment via a service token, and consumer mode. For headless Zero Trust enrollment, provide WARP_ORGANIZATION, WARP_AUTH_CLIENT_ID, and WARP_AUTH_CLIENT_SECRET together.