Secure access to private corporate networks is available in iOS, iPadOS, macOS, tvOS and watchOS using established industry-standard virtual private network (VPN) protocols.
Supported protocols
iOS, iPadOS, macOS, tvOS and watchOS support the following protocols and authentication methods:
IKEv2: Support for both IPv4 and IPv6 and the following:
Authentication methods: Shared secret, certificates, EAP-TLS and EAP-MSCHAPv2
Suite B cryptography: ECDSA certificates, ESP encryption with GCM, and ECP Groups for the Diffie-Hellman Group
Additional features: MOBIKE, IKE fragmentation, server redirect, split tunnel
iOS, iPadOS and macOS also support the following protocols and authentication methods:
L2TP over IPsec: User authentication by MS-CHAP v2 password, two-factor token, certificate, machine authentication by shared secret or certificate
macOS can also use Kerberos machine authentication by shared secret or certificate with L2TP over IPsec.
Cisco IPsec: User authentication by password, two-factor token and machine authentication by shared secret and certificates
If your organisation supports those protocols, no additional network configuration or third-party apps are required in order to connect Apple devices to your virtual private network.
Support includes technologies such as IPv6, proxy servers and split tunnelling. Split tunnelling provides a flexible VPN experience when connecting to an organisation’s networks.
In addition, the Network Extension framework allows third-party developers to create a custom VPN solution for iOS, iPadOS, macOS and tvOS. Several VPN providers have created apps to help configure Apple devices for use with their solutions. To configure a device for a specific solution, install the provider’s companion app and, optionally, provide a configuration profile with the necessary settings.
VPN On Demand
In iOS, iPadOS, macOS and tvOS, VPN On Demand lets Apple devices automatically establish a connection on an as-needed basis. It requires an authentication method that doesn’t involve user interaction — for example, certificate-based authentication. VPN On Demand is configured using the OnDemandRules key in a VPN payload of a configuration profile. Rules are applied in two stages:
Network detection stage: Defines VPN requirements that are applied when the device’s primary network connection changes.
Connection evaluation stage: Defines VPN requirements for connection requests to domain names on an as-needed basis.
Rules can be used to do things like:
Recognise when an Apple device is connected to an internal network and VPN isn’t necessary
Recognise when an unknown Wi-Fi network is being used and require VPN
Start the VPN when a DNS request for a specified domain name fails
Per App VPN
In iOS, iPadOS, macOS and watchOS, VPN connections can be established on a per-app basis, which provides more granular control over which data goes through VPN. This ability to segregate traffic at the app level allows the separation of personal data from organisational data — resulting in secure networking for internal-use apps, while at the same time preserving the privacy of personal device activity.
Per App VPN lets each app that’s managed by a mobile device management (MDM) solution communicate with the private network using a secure tunnel, while excluding unmanaged apps from using the private network. Managed Apps can be configured with different VPN connections to further safeguard data. For example, a sales quote app might use an entirely different data centre than an account’s payable app.
After creating a Per App VPN for any VPN configuration, you need to associate that connection with the apps using it to secure the network traffic for those apps. You do this with the Per App VPN mapping payload (macOS) or by specifying the VPN configuration within the app installation command (iOS, iPadOS, macOS).
Per App VPN can be configured to work with the built-in IKEv2 VPN client in iOS, iPadOS and watchOS. For information about Per App VPN support in custom VPN solutions, contact your VPN vendors.
Note: To use Per App VPN in iOS, iPadOS and watchOS, an app must be managed by MDM.
Always On VPN
Always On VPN available for IKEv2 gives your organisation full control over iOS and iPadOS traffic by tunnelling all IP traffic back to the organisation. Your organisation can now monitor and filter traffic to and from devices, secure data within your network, and restrict device access to the internet.
Always On VPN activation requires device supervision. After the Always On VPN profile is installed on a device, Always On VPN automatically activates with no user interaction, and it stays activated (including across restarts) until the Always On VPN profile is uninstalled.
With Always On VPN activated on the device, the VPN tunnel bring-up and teardown is tied to the interface IP state. When the interface gains IP network reachability, it attempts to establish a tunnel. When the interface IP state goes down, the tunnel is torn down.
Always On VPN also supports per-interface tunnels. For devices with mobile data connections, there’s one tunnel for each active IP interface (one tunnel for the mobile data interface and one tunnel for the Wi-Fi interface). As long as the VPN tunnels are up, all IP traffic is tunneled. Traffic includes all IP-routed traffic and all IP-scoped traffic (traffic from first-party apps such as FaceTime and Messages). If the tunnels aren’t up, all IP traffic is dropped.
All traffic tunnelled from a device reaches a VPN server. You can apply optional filtering and monitoring treatments before forwarding the traffic to its destination within your organisation’s network or to the Internet. Similarly, traffic to the device is routed to your organisation’s VPN server, where filtering and monitoring processes may be applied before being forwarded to the device.
Note: Apple Watch pairing isn’t supported with Always On VPN.
Transparent proxy
Transparent proxies are a special VPN type on macOS and can be used in different ways to monitor and transform network traffic. Common use cases are content filter solutions and brokers to access cloud services. Due to the variety of uses, it’s a good idea to define the order in which those proxies get to see and handle traffic. For example, you want to invoke proxy filtering network traffic before invoking a proxy that encrypts the traffic. You do this by defining the order in the VPN payload.
See alsoUse a VPN proxy and certificate configuration in Apple devicesVPN settings overview for Apple devices
