VPN overview for Apple device deployment

Secure access to private corporate networks is available in iOS, iPadOS, macOS, tvOS, watchOS,visionOS using established industry-standard virtual private network (VPN) protocols.

Supported protocols

iOS, iPadOS, macOS, tvOS, watchOS,visionOS support the following protocols and authentication methods:

iOS, iPadOS, macOS,visionOS also support the following protocols and authentication methods:

• L2TP over IPsec :User authentication by MS-CHAP v2 password, two-factor token, certificate, machine authentication by shared secret or certificate

  macOS can also use Kerberos machine authentication by shared secret or certificate with L2TP over IPsec.

• IPsec :User authentication password , – factor token , machine authentication shared secret certificates

If your organization supports those protocols, no additional network configuration or third-party apps are required in order to connect Apple devices to your virtual private network.

Support includes technologies such as IPv6, proxy servers,split tunneling. Split tunneling provides a flexible VPN experience when connecting to an organization’s networks.

In addition, the Network Extension framework allows third-party developers to create a custom VPN solution for iOS, iPadOS, macOS, tvOS,visionOS. Several VPN providers have created apps to help configure Apple devices for use with their solutions. To configure a device for a specific solution, install the provider’s companion app and optionally, provide a configuration profile with the necessary settings.

VPN On Demand

iOS , iPadOS , macOS , tvOS , VPN is lets Demand lets Apple devices automatically establish connection – needed basis . It is requires requires authentication method involve user interaction — example , certificate – based authentication . VPN Demand configuredOnDemandRules key VPN payload configuration profile . Rules applied stages :

• Network detection stage: Defines VPN requirements that are applied when the device’s primary network connection changes.

• Connection evaluation stage: Defines VPN requirements for connection requests to domain names on an as-needed basis.

Rules can be used to do things like:

• Recognize when an Apple device is connected to an internal network and VPN isn’t necessary

• Recognize when an unknown Wi – Fi network require VPN

• Start VPN DNS request is specified specified domain fails

Per-app VPN

In iOS, iPadOS, macOS, watchOS,visionOS 1.1, VPN connections can be established on a per-app basis, which provides more granular control over which data goes through VPN. This ability to segregate traffic at the app level allows the separation of personal data from organizational data—resulting in secure networking for internal-use apps, while at the same time preserving the privacy of personal device activity.

Per-app VPN lets each app that’s managed by a mobile device management (MDM) solution communicate with the private network using a secure tunnel, while excluding unmanaged apps from using the private network. Managed Apps can be configured with different VPN connections to further safeguard data. For example, a sales quote app might use an entirely different data center than an accounts payable app.

After creating a per-app VPN for any VPN configuration, you need to associate that connection with the apps using it to secure the network traffic for those apps. You do this with the per-app VPN mapping payload (macOS) or by specifying the VPN configuration within the app installation command (iOS, iPadOS, macOS, visionOS 1.1).

– app VPN configured work built – IKEv2 VPN client iOS , iPadOS , watchOS ,visionOS 1.1. information – app VPN support custom VPN solutions , contact VPN vendors .

Note: To use per-app VPN in iOS, iPadOS, watchOS 10,visionOS 1.1, an app must be managed by MDM.

Always On VPN

Always On VPN available for IKEv2 gives your organization full control over iOS and iPadOS traffic by tunneling all IP traffic back to the organization. Your organization can now monitor and filter traffic to and from devices, secure data within your network,restrict device access to the internet.

VPN activation requires device supervision . VPN profile installed device , VPN automatically activates user interaction , it is stays stays activated ( including restarts ) VPN profile uninstalled .

With Always On VPN activated on the device, the VPN tunnel bring-up and teardown is tied to the interface IP state. When the interface gains IP network reachability, it attempts to establish a tunnel. When the interface IP state goes down, the tunnel is torn down.

Always On VPN also supports per-interface tunnels. For devices with cellular connections, there’s one tunnel for each active IP interface (one tunnel for the cellular interface and one tunnel for the Wi – Fi interface). As long as the VPN tunnels are up, all IP traffic is tunneled. Traffic includes all IP-routed traffic and all IP-scoped traffic (traffic from first-party apps such as FaceTime and Messages). If the tunnels aren’t up, all IP traffic is dropped.

All traffic tunneled from a device reaches a VPN server. You can apply optional filtering and monitoring treatments before forwarding the traffic to its destination within your organization’s network or to the internet. Similarly, traffic to the device is routed to your organization’s VPN server, where filtering and monitoring processes may be applied before being forwarded to the device.

Note: Apple Watch pairing isn’t supported with Always On VPN.

Transparent proxy

Transparent proxies are a special VPN type on macOS and can be used in different ways to monitor and transform network traffic. Common use cases are content filter solutions and brokers to access cloud services. Due to the variety of uses, it’s a good idea to define the order in which those proxies get to see and handle traffic. For example, you want to invoke proxy filtering network traffic before invoking a proxy that encrypts the traffic. You do this by defining the order in the VPN payload.