IKEv2 VPN declarative configuration for Apple devices
Use the IKEv2 VPN configuration to set up a VPN connection that uses the IKEv2 protocol. IKEv2 supports strong authentication and encryption, on-demand connections, and per-app routing.
The IKEv2 VPN configuration supports the following:
Minimum supported operating system versions and channels: iOS 27, iPadOS 27, Shared iPad device, macOS 27 device, macOS 27 user, tvOS 27, visionOS 27.
Requires supervision: No.
Supported enrollment methods: Device Enrollment, Automated Device Enrollment.
IKEv2 VPN settings
Setting | Description | Required | |||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
Visible name | The name of the VPN connection that the operating system displays on the device. | Yes | |||||||||
Hostname | The IP address or hostname of the VPN server. | Yes | |||||||||
Local identifier | Identifier of the IKEv2 client. | Yes | |||||||||
Remote identifier | The remote identifier. | Yes | |||||||||
Authentication details | Settings that control authentication. See the Authentication details settings. | Yes | |||||||||
Network routing details | Specifies details about how the VPN routes different types of network traffic. See the Network routing details settings. | No | |||||||||
Disconnect on idle settings | Specifies details about how the operating system handles idle VPN connections. See the Disconnect on idle settings. | No | |||||||||
On Demand details | Specifies details about how the operating system controls On Demand VPN. See the On Demand details settings. | No | |||||||||
Use IPv4/IPv6 internal subnet attributes | If turned on, negotiations should use IKEv2 Configuration Attribute. | No | |||||||||
Disable mobility and multihoming | Turns off MOBIKE. | No | |||||||||
Disable redirect | Turns off IKEv2 redirect. If not set, the operating system redirects an IKEv2 connection when it receives a redirect request from the server. | No | |||||||||
Enable perfect forward secrecy | Turns on Perfect Forward Secrecy (PFS) for IKEv2 Connections. | No | |||||||||
Enable certificate revocation check | If turned on, the system performs a certificate revocation check for IKEv2 connections. This is a best-effort revocation check and server response timeouts won’t cause it to fail. | No | |||||||||
Enable fallback | Turns on a tunnel over cellular data to carry traffic that’s eligible for Wi-Fi Assist and also requires VPN. Enabling fallback requires that the server support multiple tunnels for a single user. | No | |||||||||
Maximum transmission unit | The Maximum Transmission Unit (MTU) specifies the maximum size in bytes of each packet that the operating system sends over the IKEv2 VPN interface. | No | |||||||||
Enforce strict algorithm selection | If turned on, the device doesn’t allow DES, 3DES, and Diffie-Hellman groups less than 14. Also the device requires the encryption algorithm specified in IKE security association parameters to be at least as cryptographically strong as the algorithm specified in Child security association parameters. The device rejects this configuration if these requirements aren’t met. | No | |||||||||
Post quantum key exchange | Post Quantum Key Exchange settings. See the Post quantum key exchange details settings. | No | |||||||||
IKE security association parameters | These parameters apply to Child Security Association unless Child security association parameters is specified. See the IKE security association parameters settings. | No | |||||||||
Child security association parameters | The Child security association parameters dictionaries. | No | |||||||||
DNS | A dictionary to use for all VPN types. See the DNS settings. | No | |||||||||
Proxies | The dictionary to use to configure Proxies for use with VPN. See the Proxy settings. | No | |||||||||
Authentication details settings
Setting | Description | Required |
|---|---|---|
Authentication method | The type of authentication method for the VPN. To turn on EAP-only authentication, set this to | Yes |
Certificate type | The type of key used by the identity set in the Identity asset reference to use for IKEv2 machine authentication. | No |
Credentials asset reference | The identifier of an asset declaration that contains the credentials to authenticate with the VPN server. | If shared secret is used as authentication method. |
Extended authentication (EAP) | Specifies details about extended authentication. See the Extended authentication (EAP) details settings. | No |
Identity asset reference | The identifier of a credential asset declaration that contains the identity that this account requires to authenticate with the VPN server. If certificate is used as authentication method, the operating system sends this certificate out for IKEv2 machine authentication. If extended authentication (EAP) is used, the operating system sends this certificate out for EAP-TLS authentication. | No |
Extended authentication (EAP) details settings
Setting | Description | Required |
|---|---|---|
Credentials asset reference | The identifier of an asset declaration that contains the credentials to authenticate with the VPN server. | No |
Enabled | Turns on EAP-only authentication. | No |
Server certificate common name | The common name of the server certificate. The operating system uses this name to validate the certificate sent by the IKE server. If not set, the operating system uses the remote identifier to validate the certificate. | No |
Server certificate issuer common name | Common Name of the server certificate issuer. If set, this field causes IKE to send a certificate request based on this certificate issuer to the server. | No |
TLS maximum version | The maximum TLS version to use with EAP-TLS authentication. | No |
TLS minimum version | The minimum TLS version to use with EAP-TLS authentication. | No |
Network routing details settings
Setting | Description | Required |
|---|---|---|
Enforce routes | If turned on, all the VPN’s non-default routes take precedence over any locally defined routes. If include all networks is turned on, the operating system ignores the value of enforce routes. | No |
Exclude APNs | If turned on and include all networks is turned on, then the operating system excludes the network traffic for the Apple Push Notification service (APNs) from the tunnel. | No |
Exclude cellular services | If turned on and include all networks is turned on, then the operating system excludes internet-routable network traffic for cellular services (VoLTE, Wi-Fi Calling, IMS, MMS, Visual Voicemail, and so on) from the tunnel. Note that some cellular carriers route cellular services traffic directly to the carrier network, bypassing the internet. Such cellular services traffic is always excluded from the tunnel. | No |
Exclude device communication | If turned on and include all networks is turned on, the device excludes network traffic used for communicating with devices connected through USB or Wi-Fi from the tunnel. | No |
Exclude local networks | If turned on and include all networks is turned on, routes all local network traffic outside the VPN. | No |
Include all networks | If turned on, routes all traffic through the VPN, with some exclusions. Several of the exclusions can be controlled with the exclude local networks, exclude cellular services, exclude APNs, and exclude device communication properties. The following traffic is always excluded from the tunnel:
| No |
Disconnect on idle settings
Setting | Description | Required |
|---|---|---|
Dead peer detection rate | How often to detect unresponsive connections. The options are:
| No |
Disconnect on idle time | The length of time to wait, in seconds, before disconnecting an On Demand connection. | No |
Enable disconnect on idle | If turned on, disconnects after an On Demand connection idles. | No |
On Demand details settings
Setting | Description | Required |
|---|---|---|
Enable VPN On Demand | Turns on VPN On Demand. | No |
On Demand rules | A list of dictionaries defining On Demand Rules. See the On Demand rules settings. | No |
Prevent users from toggling VPN On Demand | Turns off the Connect On Demand toggle in Settings or System Settings for this configuration. | No |
On Demand rules settings
Setting | Description | Required |
|---|---|---|
Action parameters | A list of dictionaries that provides rules that are evaluated on each connection instead of when the network changes. This value is only for use with dictionaries in which the On Demand action option is evaluate. The operating system evaluates these dictionaries in order and the first dictionary that matches determines the behavior. Each item specifies a list of domains, domain action, a list of required DNS servers, and required URL string probe. | No |
DNS domain match | A list of domain names. This rule matches if any of the domain names in the specified list matches any domain in the device’s search domains list. The operating system supports a wildcard ( | No |
DNS server address match | A list of IP addresses. This rule matches if any of the network’s specified DNS servers match any entry in the list. The operating system supports matching with a single wildcard. For example, | No |
Interface type match | An interface type. If specified, this rule matches only if the primary network interface hardware matches the specified type. | No |
On Demand action | The action to take if this dictionary matches the current network. Possible options are:
| Yes |
SSID match | A list of SSIDs to match against the current network. If the network isn’t a Wi-Fi network or if the SSID doesn’t appear in this list, the match fails. Omit this key and the corresponding list to match against any SSID. | No |
URL string probe | A URL to probe. This rule matches when this URL is successfully fetched (returns a 200 HTTP status code) without redirection. | No |
Post quantum key exchange details settings
Setting | Description | Required |
|---|---|---|
Allow post-quantum key exchange fallback | If turned off, the VPN doesn’t establish a connection if the server doesn’t support or doesn’t allow post-quantum key exchanges. | No |
Post-quantum pre-shared key | The Post-quantum Pre-shared key (PPK) the device uses for this VPN. This key is is used with VPN servers that support RFC 8784. If this key is present post-quantum pre-shared key identifier also needs to be present. | No |
Post-quantum pre-shared key identifier | The identifier for the Post-quantum Pre-shared key (PPK) the device uses for this VPN. This key is is used with VPN servers that support RFC 8784. If this key is present Post-quantum pre-shared key also needs to be present. | No |
Post-quantum pre-shared key mandatory | If turned on, the VPN doesn’t establish a connection if the server doesn’t support RFC 8784 or doesn’t accept the PPK identifier specified in Post-quantum pre-shared key identifier. The device ignores this key if post-quantum pre-shared key and post-quantum pre-shared key identifier aren’t present. | No |
IKE security association parameters settings
Setting | Description | Required |
|---|---|---|
Diffie hellman group | The Diffie-Hellman group. For always-on VPN, the minimum allowed value is 14. | No |
Encryption algorithm | The encryption algorithm. | No |
Integrity algorithm | The integrity algorithm. | No |
Lifetime in minutes | The SA lifetime (rekey interval) in minutes. | No |
Post-quantum key exchange methods | A list of integers representing postquantum key exchange methods the device uses during SA establishment and rekey. You can specify up to seven items, which correspond to ADDKE1 - ADDKE7 from RFC 9370. | No |
DNS settings
Setting | Description | Required |
|---|---|---|
DNS search domains | The list of domain strings used to fully qualify single-label hostnames. | No |
DNS server addresses | The list of DNS server IP address strings. These IP addresses can be a mix of IPv4 and IPv6 addresses. | Yes |
Domain name | The primary domain of the tunnel. | No |
Identity asset reference | The identifier of a credential asset declaration that contains the identity that the device uses to authenticate to the DNS resolver. | No |
Supplemental match domains | The list of domain strings used to determine which DNS queries use the DNS resolver settings in DNS server addresses. The operating system uses this key to create a split DNS configuration where it resolves only hosts in certain domains using the tunnel’s DNS resolver. The operating system uses the default resolver for hosts that aren’t in one of the domains in this list. If Supplemental match domains contains the empty string it becomes the default domain. Split-tunnel configurations can direct all DNS queries to the VPN DNS servers before the primary DNS servers. If the VPN tunnel becomes the network’s default route, the servers listed in DNS server addresses become the default resolver and the operating system ignores the Supplemental match domains list. | No |
Supplemental match domains no search | If turned on, the device doesn’t append the domains in the supplemental match domains list to the resolver’s list of search domains. | No |
Proxy settings
Setting | Description | Required |
|---|---|---|
Protocol | The dictionary to use to configure HTTP servers for Proxies for use with VPN. See the Protocol settings. | No |
Proxy auto config enable | Turns on automatic proxy configuration. | No |
Proxy auto discovery enable | Turns on proxy auto discovery. | No |
Proxy server URL | The URL to the location of the proxy auto-configuration file. | No |
Supplemental match domains | A list of domains that defines which hosts use proxy settings for hosts. | No |
Protocol settings
Setting | Description | Required |
|---|---|---|
Credentials asset reference | The identifier of an asset declaration that contains the credentials to authenticate with the proxy server. | No |
HTTP protocol | The dictionary to use to configure the HTTP (non-TLS) server. See the HTTP protocol settings. | No |
HTTPS protocol | The dictionary to use to configure the HTTPS (TLS) server. See the HTTPS protocol settings.. | No |
HTTP protocol settings
Setting | Description | Required |
|---|---|---|
Enable HTTP | Turns on proxy for HTTP traffic. | No |
HTTP hostname | The hostname of the HTTP proxy. | No |
HTTP port | The port number of the HTTP proxy. | If the HTTP hostname is specified. |
HTTPS protocol settings
Setting | Description | Required |
|---|---|---|
Enable HTTPS | Turns on proxy for HTTPS traffic. | No |
HTTPS hostname | The hostname of the HTTPS proxy. | No |
HTTPS port | The port number of the HTTPS proxy. | If the HTTPS hostname is specified. |
Note: Not all configurations and their settings are available in all device management services. Each device management service developer implements these settings differently. To learn which settings are available for your devices, consult your developer’s device management service documentation.