IPSec VPN declarative configuration for Apple devices

Use the IPSec VPN configuration to set up a VPN connection that uses Cisco IPSec. This configuration supports shared secret or certificate authentication, optional XAuth, and On Demand connections.

The IPSec VPN configuration supports the following:

Minimum supported operating system versions and channels: iOS 27, iPadOS 27, Shared iPad device, macOS 27 device, visionOS 27.
Requires supervision: No.
Supported enrollment methods: Device Enrollment, Automated Device Enrollment.

IPSec VPN settings

Setting	Description	Required
Visible name	The name of the VPN connection that the operating system displays on the device.	Yes
Hostname	The IP address or hostname of the VPN server.	Yes
Authentication details	Settings that control authentication. See the Authentication details settings.	Yes
Disconnect on idle settings	Specifies details about how the operating system handles idle VPN connections. See the Disconnect on idle settings.	No
On Demand details	Specifies details about how the operating system controls On Demand VPN. See the On Demand details settings.	No
DNS	A dictionary to use for all VPN types. See the DNS settings.	No
Proxies	The dictionary to use to configure Proxies for use with VPN. See the Proxy settings.	No

Authentication details settings

Setting	Description	Required
Authentication method	The authentication method to use. Possible options are shared secret and certificate.	Yes
Credentials asset reference	The identifier of an asset declaration that contains the credentials to authenticate with the VPN servers for shared secret authentication.	No
Identity asset reference	The identifier of a credential asset declaration that contains the identity that this account requires to authenticate with the VPN servers for certificate authentication.	No
Local identifier	The name of the group. For hybrid authentication, the string needs to end with “`hybrid`.”	No
Local identifier type	Needs to be `KeyID` when shared secret authentication is used.	No
Prompt for PIN	If turned on, prompts for a PIN when connecting.	No
XAuth details	Settings that control XAuth. See the XAuth details settings.	No

XAuth details settings

Setting	Description	Required
Credentials asset reference	The identifier of an asset declaration that contains the credentials required for XAuth.	No
XAuth enabled	Turns on Xauth for Cisco IPSec VPNs.	Yes
XAuth password encryption	A string that either has the value `Prompt` or isn’t present.	No

Disconnect on idle settings

Setting	Description	Required
Disconnect on idle time	The length of time to wait, in seconds, before disconnecting an On Demand connection.	No
Enable disconnect on idle	If turned on, disconnects after an On Demand connection idles.	No

On Demand details settings

Setting	Description	Required
Enable VPN On Demand	Turns on VPN On Demand.	No
On Demand rules	A list of dictionaries defining On Demand Rules. See the On Demand rules settings.	No

On Demand rules settings

Setting	Description	Required
Action parameters	A list of dictionaries that provides rules that are evaluated on each connection instead of when the network changes. This value is only for use with dictionaries in which the On Demand action option is evaluate. The operating system evaluates these dictionaries in order and the first dictionary that matches determines the behavior. Each item specifies a list of domains, domain action, a list of required DNS servers, and required URL string probe.	No
DNS domain match	A list of domain names. This rule matches if any of the domain names in the specified list matches any domain in the device’s search domains list. The operating system supports a wildcard (`\`) prefix. For example, `\.melardclothing.com` matches against either `mydomain.melardclothing.com` or `yourdomain.melardclothing.com`.	No
DNS server address match	A list of IP addresses. This rule matches if any of the network’s specified DNS servers match any entry in the list. The operating system supports matching with a single wildcard. For example, `17.\*` matches any DNS server in the `17.0.0.0/8subnet`.	No
Interface type match	An interface type. If specified, this rule matches only if the primary network interface hardware matches the specified type.	No
On Demand action	The action to take if this dictionary matches the current network. Possible options are: Unconditionally initiate a VPN connection on the next network attempt. Tear down the VPN connection and don’t reconnect On Demand as long as this dictionary matches. Evaluate the action parameters list for each connection attempt. Leave any existing VPN connection up, but don’t reconnect On Demand as long as this dictionary matches.	Yes
SSID match	A list of SSIDs to match against the current network. If the network isn’t a Wi-Fi network or if the SSID doesn’t appear in this list, the match fails. Omit this key and the corresponding list to match against any SSID.	No
URL string probe	A URL to probe. This rule matches when this URL is successfully fetched (returns a 200 HTTP status code) without redirection.	No

DNS settings

Setting	Description	Required
DNS search domains	The list of domain strings used to fully qualify single-label hostnames.	No
DNS server addresses	The list of DNS server IP address strings. These IP addresses can be a mix of IPv4 and IPv6 addresses.	Yes
Domain name	The primary domain of the tunnel.	No
Identity asset reference	The identifier of a credential asset declaration that contains the identity that the device uses to authenticate to the DNS resolver.	No
Supplemental match domains	The list of domain strings used to determine which DNS queries use the DNS resolver settings in DNS server addresses. The operating system uses this key to create a split DNS configuration where it resolves only hosts in certain domains using the tunnel’s DNS resolver. The operating system uses the default resolver for hosts that aren’t in one of the domains in this list. If Supplemental match domains contains the empty string it becomes the default domain. Split-tunnel configurations can direct all DNS queries to the VPN DNS servers before the primary DNS servers. If the VPN tunnel becomes the network’s default route, the servers listed in DNS server addresses become the default resolver and the operating system ignores the Supplemental match domains list.	No
Supplemental match domains no search	If turned on, the device doesn’t append the domains in the supplemental match domains list to the resolver’s list of search domains.	No

Proxy settings

Setting	Description	Required
Protocol	The dictionary to use to configure HTTP servers for Proxies for use with VPN. See the Protocol settings.	No
Proxy auto config enable	Turns on automatic proxy configuration.	No
Proxy auto discovery enable	Turns on proxy auto discovery.	No
Proxy server URL	The URL to the location of the proxy auto-configuration file.	No
Supplemental match domains	A list of domains that defines which hosts use proxy settings for hosts.	No

Protocol settings

Setting	Description	Required
Credentials asset reference	The identifier of an asset declaration that contains the credentials to authenticate with the proxy server.	No
HTTP protocol	The dictionary to use to configure the HTTP (non-TLS) server. See the HTTP protocol settings.	No
HTTPS protocol	The dictionary to use to configure the HTTPS (TLS) server. See the HTTPS protocol settings.	No

HTTP protocol settings

Setting	Description	Required
Enable HTTP	Turns on proxy for HTTP traffic.	No
HTTP hostname	The hostname of the HTTP proxy.	No
HTTP port	The port number of the HTTP proxy.	If the HTTP hostname is specified.

HTTPS protocol settings

Setting	Description	Required
Enable HTTPS	Turns on proxy for HTTPS traffic.	No
HTTPS hostname	The hostname of the HTTPS proxy.	No
HTTPS port	The port number of the HTTPS proxy.	If the HTTPS hostname is specified.

Note: Not all configurations and their settings are available in all device management services. Each device management service developer implements these settings differently. To learn which settings are available for your devices, consult your developer’s device management service documentation.

Helpful?

Apple Platform Deployment