---
title: NetworkVPNAlwaysOn
framework: Device Management
role: symbol
role_heading: Object
platforms: [iOS 27.0+, iPadOS 27.0+, Mac Catalyst 27.0+, visionOS 27.0+]
path: devicemanagement/networkvpnalwayson
---

# NetworkVPNAlwaysOn

The declaration to configure a VPN using the Always On sub-type.

## Declaration

```data
object NetworkVPNAlwaysOn
```

## Properties

AllowAllCaptiveNetworkPlugins: If true, allows traffic from all captive networking apps outside the VPN tunnel to perform captive network handling. AllowCaptiveWebSheet: If true, allows traffic from Captive Web Sheet outside the VPN tunnel. AllowedCaptiveNetworkPlugins: The array of captive networking apps whose traffic is allowed outside the VPN tunnel, to perform captive network handling. Used only when AllowAllCaptiveNetworkPlugins is false. ApplicationExceptions: An array that contains an arbitrary number of apps whose connections occur outside the VPN. ServiceExceptions: An array that contains an arbitrary number of service exceptions. TunnelConfigurations: An array that contains an arbitrary number of tunnel configurations. UIToggleEnabled: If true, allows the user to disable the VPN configuration. VisibleName: The name of the VPN connection that the system displays on the device.

## Discussion

Discussion Specify com.apple.configuration.network.vpn.always-on as the declaration type. Configuration availability  |   |   |   |   |   |   |   |  Configuration example This configuration sets up an always-on IKEv2 VPN for both Cellular and Wi-Fi interfaces using certificate authentication. {     "Type": "com.apple.configuration.network.vpn.always-on",     "Identifier": "EB13EE2B-5D63-4EBA-810F-5B81D07F5017",     "ServerToken": "E180CA9A-F089-4FA3-BBDF-94CC159C4AE8",     "Payload": {         "VisibleName": "Always-On VPN",         "UIToggleEnabled": false,         "TunnelConfigurations": [             {                 "ProtocolType": "IKEv2",                 "Interfaces": [                     "Cellular",                     "WiFi"                 ],                 "IKEV2": {                     "HostName": "vpn.example.com",                     "LocalIdentifier": "device@example.com",                     "RemoteIdentifier": "vpn.example.com",                     "Authentication": {                         "Method": "Certificate",                         "IdentityAssetReference": "CB3E6C7F-2318-437B-8A9E-D50C69376DE4"                     }                 }             }         ]     } }

## Topics

### Objects

- [NetworkVPNAlwaysOnAllowedCaptiveNetworkPluginElementObject](devicemanagement/networkvpnalwaysonallowedcaptivenetworkpluginelementobject.md)
- [NetworkVPNAlwaysOnApplicationExceptionElementObject](devicemanagement/networkvpnalwaysonapplicationexceptionelementobject.md)
- [NetworkVPNAlwaysOnServiceExceptionElementObject](devicemanagement/networkvpnalwaysonserviceexceptionelementobject.md)
- [NetworkVPNAlwaysOnTunnelConfigurationElementObject](devicemanagement/networkvpnalwaysontunnelconfigurationelementobject.md)

## See Also

### Configurations

- [AccessibilitySettings](devicemanagement/accessibilitysettings.md)
- [AccountCalDAV](devicemanagement/accountcaldav.md)
- [AccountCardDAV](devicemanagement/accountcarddav.md)
- [AccountExchange](devicemanagement/accountexchange.md)
- [AccountGoogle](devicemanagement/accountgoogle.md)
- [AccountLDAP](devicemanagement/accountldap.md)
- [AccountMail](devicemanagement/accountmail.md)
- [AccountSettings](devicemanagement/accountsettings.md)
- [AccountSubscribedCalendar](devicemanagement/accountsubscribedcalendar.md)
- [AppManaged](devicemanagement/appmanaged.md)
- [AppSettings](devicemanagement/appsettings.md)
- [AudioAccessorySettings](devicemanagement/audioaccessorysettings.md)
- [ContentCaching](devicemanagement/contentcaching.md)
- [DiskManagementSettings](devicemanagement/diskmanagementsettings.md)
- [ExtensibleSSO](devicemanagement/extensiblesso.md)