NetworkVPNAlwaysOn

The declaration to configure a VPN using the Always On sub-type.

Declaration

object NetworkVPNAlwaysOn

Properties

Name	Type	Description
`AllowAllCaptiveNetworkPlugins`	boolean	If `true`, allows traffic from all captive networking apps outside the VPN tunnel to perform captive network handling.
`AllowCaptiveWebSheet`	boolean	If `true`, allows traffic from Captive Web Sheet outside the VPN tunnel.
`AllowedCaptiveNetworkPlugins`	[`NetworkVPNAlwaysOnAllowedCaptiveNetworkPluginElementObject`]	The array of captive networking apps whose traffic is allowed outside the VPN tunnel, to perform captive network handling. Used only when `AllowAllCaptiveNetworkPlugins` is `false`.
`ApplicationExceptions`	[`NetworkVPNAlwaysOnApplicationExceptionElementObject`]	An array that contains an arbitrary number of apps whose connections occur outside the VPN.
`ServiceExceptions`	[`NetworkVPNAlwaysOnServiceExceptionElementObject`]	An array that contains an arbitrary number of service exceptions.
`TunnelConfigurations` Required	[`NetworkVPNAlwaysOnTunnelConfigurationElementObject`]	An array that contains an arbitrary number of tunnel configurations.
`UIToggleEnabled`	boolean	If `true`, allows the user to disable the VPN configuration.
`VisibleName` Required	string	The name of the VPN connection that the system displays on the device.

Discussion

Specify com.apple.configuration.network.vpn.always-on as the declaration type.

Configuration availability


Allowed in supervised enrollment	iOS, Shared iPad, visionOS
Allowed in device enrollment	iOS, Shared iPad, visionOS
Allowed in user enrollment	N/A
Allowed in local enrollment	iOS, Shared iPad, visionOS
Allowed in system scope	iOS, Shared iPad, visionOS
Allowed in user scope	N/A
Apply	Only a single configuration is applied

Configuration example

This configuration sets up an always-on IKEv2 VPN for both Cellular and Wi-Fi interfaces using certificate authentication.

{
    "Type": "com.apple.configuration.network.vpn.always-on",
    "Identifier": "EB13EE2B-5D63-4EBA-810F-5B81D07F5017",
    "ServerToken": "E180CA9A-F089-4FA3-BBDF-94CC159C4AE8",
    "Payload": {
        "VisibleName": "Always-On VPN",
        "UIToggleEnabled": false,
        "TunnelConfigurations": [
            {
                "ProtocolType": "IKEv2",
                "Interfaces": [
                    "Cellular",
                    "WiFi"
                ],
                "IKEV2": {
                    "HostName": "vpn.example.com",
                    "LocalIdentifier": "device@example.com",
                    "RemoteIdentifier": "vpn.example.com",
                    "Authentication": {
                        "Method": "Certificate",
                        "IdentityAssetReference": "CB3E6C7F-2318-437B-8A9E-D50C69376DE4"
                    }
                }
            }
        ]
    }
}

NetworkVPNAlwaysOn

Declaration

Properties

Discussion

Configuration availability

Configuration example

Topics

Objects

See Also

Configurations