# OpenConnect

An OpenConnect monitor logs in to an AnyConnect-compatible (ocserv) server the way a real client does.

:::tip[New to TunnelHQ?]
Start with the [Quick start](/docs/quickstart/).
:::

## Adding an OpenConnect monitor

In **Add monitor**, click **Enter details manually** and choose **OpenConnect**.

| Field | Required | Details |
| --- | --- | --- |
| Name | Yes | Required for OpenConnect. For other protocols the name is optional. |
| Host | Yes | The server address, such as `vpn.example.com` or `203.0.113.10`. |
| Username, Password | Yes | The credentials the server expects. |
| Port | No | Not asked when adding. Set it later in the monitor's settings if your server doesn't use the default. |

Each host can have only one monitor per project, whatever its protocol. If another monitor in the project already uses the host, the dialog shows `A monitor with host "vpn.example.com" already exists.` and **Add** stays disabled.

## When a check fails

The most common failure is **Tunnel unreachable**. Rejected configurations and **Tunnel established - Internet is stuck** are rare.

- **Tunnel unreachable**: the login or tunnel didn't complete. Check that the server is running, that the host (and port, if you set one) are right, and that the username and password work in an AnyConnect or OpenConnect client.
- **Couldn't complete this check — the monitor's configuration or credentials were rejected. The server's status is unknown.**: the monitor's settings couldn't be used. The monitor shows **Unknown**, with no alert. Check the host and credentials against a client that connects.
- **Server reachable — it rejected the monitor's credentials or certificate.**: the server answered and refused them. The monitor reads **Degraded** with no alert, unless it passed a check in the last 30 days: then TunnelHQ treats the refusal as an outage, and the monitor goes **Down** after its retries and alerts.
- **Tunnel established - Internet is stuck**: the tunnel came up, but traffic didn't reach the internet. Check the server's routing and DNS.

[What a failed check says](/docs/concepts/monitors/#what-a-failed-check-says) lists every failure message.