NetworkVPNIKEV2

The declaration to configure a VPN using the IKEv2 sub-type.

Declaration

object NetworkVPNIKEV2

Properties

Name	Type	Description
`Authentication` Required	`NetworkVPNIKEV2AuthenticationObject`	Settings that control authentication.
`ChildSecurityAssociationParameters`	`NetworkVPNIKEV2SecurityAssociationParametersObject`	The `ChildSecurityAssociationParameters` dictionaries.
`DisableMOBIKE`	boolean	If `true`, the system disables MOBIKE.
`DisableRedirect`	boolean	If `true`, the system disables IKEv2 redirect. If not set, the system redirects an IKEv2 connection when it receives a redirect request from the server.
`DNS`	`NetworkVPNIKEV2DNSObject`	A dictionary to use for all VPN types.
`EnableCertificateRevocationCheck`	boolean	If `true`, the system performs a certificate revocation check for IKEv2 connections. This is a best-effort revocation check and server response timeouts won’t cause it to fail.
`EnableFallback`	boolean	If `true`, the system enables a tunnel over cellular data to carry traffic that’s eligible for Wi-Fi Assist and also requires VPN. Enabling fallback requires that the server support multiple tunnels for a single user. Available: iOS 27+ \| iPadOS 27+ \| tvOS 27+ \| visionOS 27+
`EnablePFS`	boolean	If `true`, enables Perfect Forward Secrecy (PFS) for IKEv2 Connections.
`EnforceStrictAlgorithmSelection`	boolean	If set to `true`, the device doesn’t allow DES, 3DES, and Diffie-Hellman groups less than 14. Also the device requires the encryption algorithm specified in `IKESecurityAssociationParameters` to be at least as cryptographically strong as the algorithm specified in `ChildSecurityAssociationParameters`. The device rejects this configuration if these requirements aren’t met.
`HostName` Required	string	The IP address or hostname of the VPN server.
`Idle`	`NetworkVPNIKEV2IdleObject`	Specifies details about how the system handles idle VPN connections.
`IKESecurityAssociationParameters`	`NetworkVPNIKEV2SecurityAssociationParametersObject`	These parameters apply to Child Security Association unless `ChildSecurityAssociationParameters` is specified.
`LocalIdentifier` Required	string	Identifier of the IKEv2 client.
`MTU`	integer	The Maximum Transmission Unit (MTU) specifies the maximum size in bytes of each packet that the system sends over the IKEv2 VPN interface.
`NetworkRouting`	`NetworkVPNIKEV2NetworkRoutingObject`	Specifies details about how the VPN routes different types of network traffic. Available: iOS 27+ \| iPadOS 27+ \| macOS 27+ \| visionOS 27+
`OnDemand`	`NetworkVPNIKEV2OnDemandObject`	Specifies details about how the system controls on-demand VPN.
`PostQuantumKeyExchange`	`NetworkVPNIKEV2PostQuantumKeyExchangeObject`	Post Quantum Key Exchange settings.
`Proxies`	`NetworkVPNIKEV2ProxiesObject`	The dictionary to use to configure `Proxies` for use with `VPN`.
`RemoteIdentifier` Required	string	The remote identifier.
`UseConfigurationAttributeInternalIPSubnet`	boolean	If `true`, negotiations should use IKEv2 Configuration Attribute `INTERNAL_IP4_SUBNET` and `INTERNAL_IP6_SUBNET`.
`VisibleName` Required	string	The name of the VPN connection that the system displays on the device.

Discussion

Specify com.apple.configuration.network.vpn.ikev2 as the declaration type.

Configuration availability


Allowed in supervised enrollment	iOS, macOS, Shared iPad, tvOS, visionOS
Allowed in device enrollment	iOS, Shared iPad, tvOS, visionOS
Allowed in user enrollment	N/A
Allowed in local enrollment	iOS, macOS, Shared iPad, tvOS, visionOS
Allowed in system scope	iOS, macOS, Shared iPad, tvOS, visionOS
Allowed in user scope	macOS
Apply	Multiple configurations are applied separately

NetworkVPNIKEV2

Declaration

Properties

Discussion

Configuration availability

Configuration examples

Topics

Objects

See Also

Configurations