iOS

and

macOS

: VPN profile settings

This setting specifies the FQDN or IP address of a VPN server.

This setting specifies the username that a device uses to authenticate with the VPN gateway. If the profile is for multiple users, you can specify the %UserName% variable.

This setting specifies the keys and associated values for the custom SSL VPN. The configuration information is specific to the vendor's VPN app.

This setting is valid only if the "Connection type" setting is set to "Custom."

This setting specifies the login group or domain that the VPN gateway uses to authenticate a device.

This setting is valid only if the "Connection type" setting is set to "

SonicWALL Mobile Connect

."

This setting specifies the name of the authentication realm that the VPN gateway uses to authenticate a device.

This setting is valid only if the "Connection type" setting is set to "

Juniper

" or "

Pulse Secure

."

This setting specifies the name of the user role that the VPN gateway uses to verify the network resources that a device can access.

This setting is valid only if the "Connection type" setting is set to "

Juniper

" or

Pulse Secure

."

This setting specifies the authentication type for the VPN gateway.

The "Connection type" setting determines which authentication types are supported and the default value for this setting.

Possible values:

Password
RSA SecurID
Shared secret
Shared secret/Group name
Shared certificate
SCEP
User credential

This setting specifies authentication plugins for the VPN.

This setting is valid only if the "Connection type" setting is set to "L2TP" or "PPTP" and the "Authentication type" setting is set to "

RSA SecurID

."

This setting specifies authentication protocols for the VPN.

This setting is valid only if the "Connection type" setting is set to "L2TP" or "PPTP" and the "Authentication type" setting is set to "

RSA SecurID

."

This setting specifies the password that a device uses to authenticate with the VPN gateway.

This setting is valid only if the "Authentication type" setting is set to "Password."

This setting specifies the group name for the VPN gateway.

This setting is valid only in the following conditions:

The "Connection type" setting is set to "
Cisco AnyConnect
."
The "Connection type" setting is set to "IPsec" and the "Authentication type" setting is set to "Shared secret/Group name."

This setting specifies the shared secret to use for VPN authentication.

This setting is valid only in the following conditions:

The "Connection type" setting is set to "L2TP."
The "Connection type" setting is set to "IPsec" and the "Authentication type" setting is set to "Shared secret/Group name."
The "Connection type" setting is set to "IKEv2" or "IKEv2 Always On" and the "Authentication type" setting is set to "Shared secret."

This setting specifies the shared certificate profile with the client certificate that a device uses to authenticate with the VPN gateway.

This setting is valid only if the "Authentication type" setting is set to "Shared certificate."

This setting specifies the associated SCEP profile that a device uses to obtain a client certificate to authenticate with the VPN.

This setting is valid only if the "Authentication type" setting is set to "SCEP."

This setting specifies the associated user credential profile that a device uses to obtain a client certificate to authenticate with the VPN.

This setting is valid only if the "Authentication type" setting is set to "User credential."

This setting specifies the level of data encryption for the VPN connection. If this setting is set to "Automatic," all available encryption strengths are allowed. If this setting is set to "Maximum," only the maximum encryption strength is allowed.

This setting is valid only if the "Connection type" setting is set to "PPTP."

Possible values:

The default value is "None."

This setting specifies whether to send all network traffic through the VPN connection.

This setting is valid only if the "Connection type" setting is set to "L2TP" or "PPTP."

This setting specifies whether to use a server-side certificate for authentication.

This setting is valid only if the "Connection type" setting is set to "IPsec" and "Authentication type" is set to "Shared secret/Group name"

This setting specifies whether a device prompts the user for a password.

This setting is valid only if the "Connection type" setting is set to "IPsec" and "Authentication type" is set to "Shared secret/Group name"

This setting specifies whether the device prompts the user for a PIN.

This setting is valid only if the "Connection type" setting is set to "IPsec" and the "Authentication type" setting is set to "Shared Certificate," "SCEP," or "User credential."

This setting specifies the IP address or hostname of the VPN server.

This setting is valid only if the "Connection type" setting is set to "IKEv2" or "IKEv2 Always On."

This setting specifies the identity of the IKEv2 client in one of the following formats: FQDN, UserFQDN, Address, and ASN1DN.

This setting is valid only if the "Connection type" setting is set to "IKEv2" or "IKEv2 Always On."

This setting specifies the remote identifier of the IKEv2 client using one of the following formats: FQDN, user FQND, Address, or ASN1DN.

This setting is valid only if the "Connection type" setting is set to "IKEv2" or "IKEv2 Always On."

This setting specifies whether a device can start a VPN connection automatically when it accesses certain domains.

For

iOS

and

iPadOS

devices, this setting applies to work apps.

This setting is valid only in the following conditions:

The "Connection type" setting is set to "IPsec," "
Cisco AnyConnect
," "
Juniper
," "
Pulse Secure
," "
F5
," "
SonicWALL Mobile Connect
," "
Aruba VIA
," "
Check Point Mobile
," "
OpenVPN
," or "Custom" and the "Authentication type" is set to "Shared certificate," "SCEP," or "User credential."
The "Connection type" setting is set to "IKEv2" and the "Authentication type" is set to "Shared certificate."

This setting specifies the domains and the associated actions for VPN on demand.

This setting is valid only if the "Enable VPN on demand" setting is selected.

Possible values for "On demand action":

This setting specifies the connection requirements for VPN on demand. You must use one or more keys from the payload format example.

This setting overrides the "Domain or host names that can use VPN on demand" setting.

This setting is valid only if the "Enable VPN on demand" setting is selected.

This setting specifies whether the VPN connection disconnect when it idle for a specified period of time.

This setting is valid only if the "Enable VPN on demand" setting is selected.

This setting specifies the idle time in seconds after which the VPN disconnects.

The default value is "120"

This setting is valid only if the "Disconnect on idle" setting is selected.

This setting specifies whether the user can disable VPN on demand.

This setting is valid only if the "Connection type" setting is set to "IPsec," "

Cisco AnyConnect

," "

Juniper

," "

Pulse Secure

," "

F5

," "

SonicWALL Mobile Connect

," "

Aruba VIA

," "

Check Point Mobile

," "

OpenVPN

," or "Custom."

This setting applies only to devices running

iOS

and

iPadOS

14 and later.

This setting specifies whether to exclude local network traffic from using the VPN connection. If the “Include all networks” setting is also selected, no local network traffic is routed through the VPN. This setting applies only to devices running

iOS

and

iPadOS

13 and later.

This setting specifies whether the non-default routes for the VPN take precedence over any locally defined routes. If the “Include all networks” setting is also selected, this setting is ignored.

This setting is valid only if the "Connection type" setting is set to "

Cisco AnyConnect

," "

Juniper

," "

Pulse Secure

," "

F5

," "

SonicWALL Mobile Connect

," "

Aruba VIA

," "

Check Point Mobile

," "

OpenVPN

," or "Custom."

This setting applies only to devices running

iOS

and

iPadOS

14.2 and later.

This setting specifies whether to route all traffic through the VPN. If "Exclude local network" is also selected, local network traffic in not routed through the VPN. This setting applies only to devices running

iOS

and

iPadOS

13 and later.

This setting specifies a designated VPN provider. If the VPN provider is implemented as a system extension, this setting is required.

This setting is valid only if the "Connection type" setting is set to "IPsec," "

Cisco AnyConnect

," "

Juniper

," "

Pulse Secure

," "

F5

," "

SonicWALL Mobile Connect

," "

Aruba VIA

," "

Check Point Mobile

," "

OpenVPN

," or "Custom."

This setting specifies whether users can disable the VPN connection.

This setting is valid only if the "Connection type" setting is set to "IKEv2 Always On."

This setting specifies whether you want to set separate VPN settings for the device depending on whether the device is sending data over a cellular network or a

Wi-Fi

network. If this setting is not selected, you can set different cellular and Wi-Fi settings in the same profile.

This setting is valid only if the "Connection type" setting is set to "IKEv2 Always On."

This setting specifies whether the VPN supports extended authentication.

This setting is valid only if the "Connection type" setting is set to "IKEv2" or "IKEv2 Always On."

This setting specifies the maximum TLS version that devices use for EAP-TLS authentication.

This setting is valid only if the "Enable xAuth" setting is selected and the Authentication type is “Certificate.”

Possible values:

The default setting is “1.2.”

This setting specifies the type of certificate used for IKEv2 machine authentication.

This setting is valid only if the "Enable xAuth" setting is selected and the Authentication type is “Certificate.”

This setting specifies the common name of the CA that issued the server certificate that the IKE server sends to the device. If you enable xAuth using a certificate, this setting is required.

This setting is valid only if the "Enable xAuth" setting is selected and the Authentication type is “Certificate.”

This setting specifies the common name of the server certificate that the IKE server sends to the device.

This setting is valid only if the "Enable xAuth" setting is selected and the Authentication type is “Certificate.”

This setting specifies how often a device sends a keepalive packet.

This setting is valid only if the "Connection type" setting is set to "IKEv2" or "IKEv2 Always On."

Possible values:

Disabled
30 minutes
10 minutes
1 minute

The default setting is "10 minutes."

This setting specifies whether MOBIKE is disabled.

This setting is valid only if the "Connection type" setting is set to "IKEv2" or "IKEv2 Always On."

This setting specifies whether IKEv2 redirect is disabled. If this setting is not selected, the IKEv2 connection is redirected if a redirect request is received from the server.

This setting is valid only if the "Connection type" setting is set to "IKEv2" or "IKEv2 Always On."

This setting specifies whether the VPN supports PFS.

This setting is valid only if the "Connection type" setting is set to "IKEv2" or "IKEv2 Always On."

This setting specifies whether the VPN supports NAT keepalive packets. Keepalive packets are used to maintain NAT mappings for IKEv2 connections.

This setting is valid only if the "Connection type" setting is set to "IKEv2" or "IKEv2 Always On."

This setting specifies how often a device sends a NAT keepalive packet (in seconds).

This setting is valid only if the "Connection type" setting is set to "IKEv2" or "IKEv2 Always On" and the "Enable NAT keepalive" setting is selected.

The minimum value and the default value is 20.

This setting specifies whether the VPN can use the IKEv2 configuration attribute INTERNAL_IP4_SUBNET and INTERNAL_IP6_SUBNET.

This setting is valid only if the "Connection type" setting is set to "IKEv2" or "IKEv2 Always On."

This setting specifies the common name in the certificate that the IKE server sends to the device.

This setting is valid only if the "Connection type" setting is set to "IKEv2" or "IKEv2 Always On."

This setting specifies the common name of the certificate issuer in the certificate that the IKE server sends to the device.

This setting is valid only if the "Connection type" setting is set to "IKEv2" or "IKEv2 Always On."

This setting specifies whether a certificate revocation check is attempted for the server certificate. The check does not fail if there is no response.

This setting is valid only if the "Connection type" setting is set to "IKEv2" or "IKEv2 Always On."

This setting specifies whether the device can establish a VPN tunnel over the mobile network when

Wi-Fi

Assist is enabled. This setting applies only to devices running

iOS

and

iPadOS

13 and later and requires that the server support multiple tunnels for individual users.

This setting is valid only if the "Connection type" setting is set to "IKEv2" or "IKEv2 Always On."

This setting specifies whether to apply child security association parameters.

This setting is valid only if the "Connection type" setting is set to "IKEv2" or "IKEv2 Always On."

This setting specifies whether to apply IKE security association parameters.

This setting is valid only if the "Connection type" setting is set to "IKEv2" or "IKEv2 Always On."

This setting specifies the Maximum Transmission Unit in bytes. This setting applies only to devices running

iOS

and

iPadOS

14 and later.

This setting is valid only if the "Connection type" setting is set to "IKEv2 Always On."

This setting specifies whether connections to the voice mail service are sent through the VPN tunnel, sent outside of the VPN tunnel, or are blocked. This setting applies only to devices running

iOS

and

iPadOS

13.4 and later.

This setting is valid only if the "Connection type" setting is set to "IKEv2 Always On." It applies only to

Wi-Fi

connections.

This setting specifies whether

AirPrint

connections

AirPrint

are sent through the VPN tunnel, sent outside of the VPN tunnel, or are blocked. This setting applies only to devices running

iOS

and

iPadOS

13.4 and later.

This setting is valid only if the "Connection type" setting is set to "IKEv2 Always On." It applies only to

Wi-Fi

connections.

This setting specifies whether traffic from captive web sheets can be sent outside of the VPN tunnel.

This setting is valid only if the "Connection type" setting is set to "IKEv2 Always On." It applies only to

Wi-Fi

connections.

This setting specifies whether traffic from all captive networking apps can be sent outside of the VPN tunnel. If this setting is not selected, you can specify individual apps for which traffic can be sent outside the tunnel.

This setting is valid only if the "Connection type" setting is set to "IKEv2 Always On." It applies only to

Wi-Fi

connections.

This setting specifies individual captive networking apps for which traffic can be sent outside the tunnel.

This setting is valid only if the "Connection type" setting is set to "IKEv2 Always On." It applies only to

Wi-Fi

connections.

This setting specifies apps whose traffic can be sent outside the tunnel.

This setting is valid only if the "Connection type" setting is set to "IKEv2 Always On." It applies only to

Wi-Fi

connections.

This setting specifies the DH group that a device uses to generate key material.

This setting is valid only if the "Apply Child Security Association parameters" or "Apply IKE Security Association parameters" setting is selected.

Possible values:

0
1
2
5
14
15
16
17
18
19
20
21
31

The default setting is "2."

This setting specifies the IKE encryption algorithm.

This setting is valid only if the "Apply Child Security Association parameters" or "Apply IKE Security Association parameters" setting is selected.

Possible values:

DES
3DES
AES 128
AES 256
AES 128 GCM
AES 256 GCM
ChaCha20Poly1305

The default setting is "3DES."

This setting specifies the IKE integrity algorithm.

This setting is valid only if the "Apply Child Security Association parameters" or "Apply IKE Security Association parameters" setting is selected.

Possible values:

SHA1 96
SHA1 160
SHA1 256
SHA2 384
SHA2 512

The default value is "SHA1-96."

This setting specifies the lifetime of the IKE connection.

This setting is valid only if the "Apply Child Security Association parameters" or "Apply IKE Security Association parameters" setting is selected.

The possible values are from 10 to 1440 minutes.

The default value is 1440.

This setting specifies whether the VPN gateway supports per-app VPN. This feature helps decrease the load on an organization’s VPN. For example, you can enable only certain work traffic to use the VPN, such as accessing application servers or webpages behind the firewall.

This setting is valid only if the "Connection type" setting is set to "

Cisco AnyConnect

," "

Juniper

," "

Pulse Secure

," "

F5

," "

SonicWALL Mobile Connect

," "

Aruba VIA

," "

Check Point Mobile

," "

OpenVPN

," "Custom," "IKEv2," or "IKEv2 Always On."

This setting whether apps associated with per-app VPN can start the VPN connection automatically.

This setting is valid only if the "Enable per-app VPN" setting is selected.

This setting specifies the domains that can start the VPN connection in

Safari

.

This setting is valid only if the "Enable per-app VPN" setting is selected.

This setting specifies the domains that can start the VPN connection in Calendar.

This setting is valid only if the "Enable per-app VPN" setting is selected. This setting applies only to

iOS

and

iPadOS

13.0 and later devices.

This setting specifies the domains that can start the VPN connection in Contacts.

This setting is valid only if the "Enable per-app VPN" setting is selected. This setting applies only to

iOS

and

iPadOS

13.0 and later devices.

This setting specifies the domains that can start the VPN connection in Mail.

This setting is valid only if the "Enable per-app VPN" setting is selected. This setting applies only to

iOS

and

iPadOS

13.0 and later devices.

This setting specifies domains that can start the VPN connection on the device. The domains must also be included in the apple-app-site-association file.

This setting is valid only if the "Enable per-app VPN" setting is selected. This setting applies only to

iOS

and

iPadOS

14.0 and later devices.

This setting specifies domains that are blocked from starting the VPN connection on the device.

This setting is valid only if the "Enable per-app VPN" setting is selected. This setting applies only to

iOS

and

iPadOS

14.0 and later devices.

This setting specifies whether the VPN tunnels traffic at the application layer or the IP layer.

This setting is valid only if the "Enable per-app VPN" setting is selected. This setting applies only to

iOS

and

iPadOS

13.0 and later devices.

Possible values:

Application layer
IP layer

The default setting is "Application layer."

This setting specifies the associated proxy profile that a device uses to connect to a proxy server when the device is connected to the VPN.