VPN

The type of the VPN, which defines which settings are appropriate for this VPN payload. If the type is `VPN` or `TransparentProxy`, then the system requires a value for `VPNSubType`. `TransparentProxy` is only available in macOS. `L2TP` and `IPSec` aren't available in tvOS. `AlwaysOn` is only available on iOS and `AlwaysOn` doesn't support Apple Watch pairing. For a previously paired Apple Watch, all phone-watch communications cease when `AlwaysOn` is enabled. Not available in watchOS.

Range: VPN, L2TP, IPSec, IKEv2, AlwaysOn, TransparentProxy

An identifier for a vendor-specified configuration dictionary when the value for `VPNType` is `VPN`. If `VPNType` is `VPN`, the system requires this field. If the configuration targets a VPN solution that uses a VPN plugin, then this field contains the bundle identifier of the plugin. Here are some examples: - Cisco AnyConnect: `com.cisco.anyconnect.applevpn.plugin` - Juniper SSL: `net.juniper.sslvpn` - F5 SSL: `com.f5.F5-Edge-Client.vpnplugin` - SonicWALL Mobile Connect: `com.sonicwall.SonicWALL-SSLVPN.vpnplugin` - ``Aruba VIA: `com.arubanetworks.aruba-via.vpnplugin` If the configuration targets a VPN solution that uses a network extension provider, then this field contains the bundle identifier of the app that contains the provider. Contact the VPN solution vendor for the value of the identifier. If `VPNType` is `IKEv2`, then the `VPNSubType` field is optional and reserved for future use. If it's specified, it needs to contain an empty string. Not available in watchOS.

The description of the VPN connection that the system displays on the device. Not available in watchOS.

The vendor-specific configuration dictionary, which the system reads only when `VPNSubType` has a value. Not available in watchOS.

The dictionary to use when `VPNType` is `VPN`.

The dictionary that contains IPv4 settings. Not available in watchOS.

The dictionary to use when `VPNType` is `L2TP` or `PTPP`. Not available in watchOS.

The dictionary that contains IPSec settings. Not available in watchOS.

The dictionary to use when `VPNType` is `IKEv2`.

A dictionary to use for all VPN types.

The dictionary to use to configure `Proxies` for use with `VPN`.

The dictionary to use when `VPNType` is `AlwaysOn`. Not available in tvOS or watchOS.

The dictionary to use when `VPNType` is `TransparentProxy`.

The Kerberos realm name, which needs to be properly capitalized. Valid only for Juniper SSL and Pulse Secure. Not available in watchOS.

The role to select when connecting to the server. Valid only for Juniper SSL and Pulse Secure. Not available in watchOS.

The group to connect to on the head end. Valid for Cisco AnyConnect and Cisco Legacy AnyConnect. Not available in watchOS.

The login group or domain. Valid only for SonicWALL Mobile Connect. Not available in watchOS.

The VPN account username.

The VPN account password. Only use this if `AuthenticationMethod` is set to `Password`.

The IP address or hostname of the VPN server.

The authentication method to use.

Default: "Password"

Range: Password, Certificate, Password+Certificate

The UUID of the certificate payload within the same profile to use for account credentials.

The bundle identifier for the VPN provider. Not available in watchOS.

If the VPN provider uses a system extension, this field is required. Not available in watchOS.

If `1`, disconnects after an on-demand connection idles.

Default: 0

Range: 0, 1

The length of time to wait, in seconds, before disconnecting an on-demand connection. In watchOS, the maximum allowed value is `15`.

The type of VPN service. If the value is `app-proxy`, the service tunnels traffic at the app level. If the value is `packet-tunnel`, the service tunnels traffic at the IP layer. Not available in watchOS.

Default: "packet-tunnel"

Range: packet-tunnel, app-proxy

If `1``, routes all traffic through the VPN, with some exclusions. Several of the exclusions can be controlled with the `ExcludeLocalNetworks`, `ExcludeCellularServices`, `ExcludeAPNs` and `ExcludeDeviceCommunication` properties. The system always excludes the following traffic from the tunnel: - Traffic necessary for connecting and maintaining the device's network connection, such as DHCP. - Traffic necessary for connecting to captive networks. - Certain cellular services traffic that's not routable over the internet and is instead directly routed to the cellular network. See the ExcludeCellularServices property for more details. - Network communication with a companion device such as a watchOS device. Not available in watchOS.

Default: 0

Range: 0, 1

If `1`, all the VPN's non-default routes take precedence over any locally defined routes. If `IncludeAllNetworks` is `1`, the system ignores the value of `EnforceRoutes`. Not available in watchOS.

Default: 0

Range: 0, 1

If `1` and `IncludeAllNetworks` is `1`, routes all local network traffic outside the VPN. Not available in watchOS.

Range: 0, 1

If `1` and `IncludeAllNetworks` is `1`, then the system excludes internet-routable network traffic for cellular services (VoLTE, Wi-Fi Calling, IMS, MMS, Visual Voicemail, etc.) from the tunnel. Note that some cellular carriers route cellular services traffic directly to the carrier network, bypassing the internet. Such cellular services traffic is always excluded from the tunnel. Not available in watchOS.

Default: 1

Range: 0, 1

If `1` and `IncludeAllNetworks` is `1`, then the system excludes the network traffic for the Apple Push Notification service (APNs) from the tunnel. Not available in watchOS.

Default: 1

Range: 0, 1

If set to `1` and `IncludeAllNetworks` is set to `1`, the device excludes network traffic used for communicating with devices connected via USB or Wi-Fi from the tunnel.

Default: 1

Range: 0, 1

If `1`, enables VPN On Demand.

Default: 0

Range: 0, 1

If `1`, the device disables the Connect On Demand toggle in Settings for this configuration. Not available in watchOS.

Default: 0

Range: 0, 1

A list of domain names. The system treats associated domain names as though they're associated with the `OnDemandMatchDomainsOnRetry` key. This behavior can be overridden by `OnDemandRules`. In iOS 7 and later, this key is deprecated (but still supported) in favor of `EvaluateConnection` actions in the `OnDemandRules` dictionaries. Not available in watchOS.

A list of domain names. If the host name ends with one of these domain names, the system doesn't start the VPN automatically. The system uses this value to exclude a subdomain within an included domain. In iOS 7 and later, this key is deprecated (but still supported) in favor of `EvaluateConnection` actions in the `OnDemandRules` dictionaries. Not available in watchOS.

A list of domain names. If the host name ends with one of these domain names and a DNS query for that domain name fails, the system starts the VPN automatically. In iOS 7 and later, this key is deprecated (but still supported) in favor of `EvaluateConnection` actions in the `OnDemandRules` dictionaries. Not available in watchOS.

An array of dictionaries defining On Demand Rules.

The action to take if this dictionary matches the current network. Possible values are: - `Allow`: Deprecated. Allow VPN On Demand to connect if triggered. - `Connect`: Unconditionally initiate a VPN connection on the next network attempt. - `Disconnect`: Tear down the VPN connection and don't reconnect on demand as long as this dictionary matches. - `EvaluateConnection`: Evaluate the ActionParameters array for each connection attempt. - `Ignore`: Leave any existing VPN connection up, but don't reconnect on demand as long as this dictionary matches. Only the `Disconnect` action is available on watchOS 10 and later.

Range: Allow, Connect, Disconnect, EvaluateConnection, Ignore

An array of dictionaries that provides rules similar to the `OnDemandRules` dictionary, but evaluated on each connection instead of when the network changes. This value is only for use with dictionaries in which the `Action` value is `EvaluateConnection`. The system evaluates these dictionaries in order and the first dictionary that matches determines the behavior. Not available in watchOS.

An array of domain names. This rule matches if any of the domain names in the specified list matches any domain in the device's search domains list. The system supports a wildcard (`\*`) prefix. For example, `\*.example.com` matches against either `mydomain.example.com` or `yourdomain.example.com`.

An array of IP addresses. This rule matches if any of the network's specified DNS servers match any entry in the array. The system supports matching with a single wildcard. For example, `17.\*` matches any DNS server in the `17.0.0.0/8` subnet.

An interface type. If specified, this rule matches only if the primary network interface hardware matches the specified type.

Range: Ethernet, WiFi, Cellular

An array of SSIDs to match against the current network. If the network isn't a Wi-Fi network or if the SSID doesn't appear in this array, the match fails. Omit this key and the corresponding array to match against any SSID.

A URL to probe. This rule matches when this URL is successfully fetched (returns a `200` HTTP status code) without redirection. Not available in watchOS.

A dictionary that provides rules similar to the OnDemandRules dictionary, but evaluated on each connection instead of when the network changes. These dictionaries are evaluated in order, and the behavior is determined by the first dictionary that matches. The keys allowed in each dictionary are described below. Note: This array is used only for dictionaries in which EvaluateConnection is the Action value.

The domains to apply this evaluation.

Defines the VPN behavior for the specified domains. Allowed values are: * 'ConnectIfNeeded': The specified domains should trigger a VPN connection attempt if domain name resolution fails, such as when the DNS server indicates that it can't resolve the domain, responds with a redirection to a different server, or fails to respond (timeout). * 'NeverConnect': The specified domains should never trigger a VPN connection attempt.

Range: ConnectIfNeeded, NeverConnect

An array of IP addresses of DNS servers to use for resolving the specified domains. These servers don't need to be part of the device's current network configuration. If these DNS servers aren't reachable, the system establishes a VPN connection. These DNS servers need to be either internal DNS servers or trusted external DNS servers. This key is valid only if the value of 'DomainAction' is 'ConnectIfNeeded'.

An HTTP or HTTPS (preferred) URL to probe, using a GET request. If the URL's hostname can't be resolved, if the server is unreachable, or if the server doesn't respond with a 200 HTTP status code, the device establishes a VPN connection in response. This key is valid only if the value of 'DomainAction' is 'ConnectIfNeeded'.

If `1`, the system sends all network traffic over VPN. Only applies to Cisco IPsec and L2TP VPN types.

Default: 0

Range: 0, 1

The VPN account user name. This key is for use with L2TP and PPTP networks.

If `TokenCard` is `1`, use this password for authentication. This key is for use with L2TP and PPTP networks.

If `1`, uses a token card such as an RSA SecurID card for connecting. This key is for use with L2TP networks.

Default: 0

Range: 0, 1

The IP address or host name of VPN server. This key is for use with L2TP and PPTP networks.

An array of authentication plugins. For use of RSA SecurID, this array should only have one value: `EAP-RSA`. This key is for use with L2TP and PPTP networks.

An array of authentication protocols. For use of RSA SecurID, this array should have one value, `EAP`. This key is for use with L2TP and PPTP networks.

If `1` and `CCPEnabled` is also `1`, enables CCPMPPE128 encryption.

Range: 0, 1

If `1` and `CCPEnabled` is also `1`, enables CCPMPPE40 encryption.

Range: 0, 1

If `1`, enables encryption on the connection. This key is for use with PPTP networks.

Range: 0, 1

If `1`, disconnects after an on demand connection idles.

Default: 0

Range: 0, 1

The length of time to wait before disconnecting an on demand connection

Range: EAP-RSA, EAP-TLS, EAP-KRB

Range: EAP

The IP address or host name of the VPN server.

The authentication method for L2TP and Cisco IPSec.

Default: "SharedSecret"

Range: SharedSecret, Certificate

The user name for the VPN account for Cisco IPSec.

The VPN account password for Cisco IPSec.

If `1`, enables Xauth for Cisco IPSec VPNs.

Range: 0, 1

A string that either has the value "Prompt" or isn't present.

Range: Prompt

The name of the group. For hybrid authentication, the string needs to end with "hybrid". Present only for Cisco IPSec if `AuthenticationMethod` is `SharedSecret`.

Present only if `AuthenticationMethod` is `SharedSecret`. The value is `KeyID`. The system uses this value for L2TP and Cisco IPSec VPNs.

Default: "KeyID"

Range: KeyID

The shared secret for this VPN account. Only use this with L2TP and Cisco IPSec VPNs and if the `AuthenticationMethod` key is to `SharedSecret`.

The UUID of the certificate payload within the same profile to use for the account credentials. Only use this with Cisco IPSec VPNs and if the `AuthenticationMethod` key is to `Certificate`.

If `true`, prompts for a PIN when connecting to Cisco IPSec VPNs.

Default: false

If `1`, disconnect after an on-demand connection idles.

Default: 0

Range: 0, 1

The length of time to wait before disconnecting an on-demand connection.

If `1`, enables bringing the VPN connection up on demand.

Default: 0

Range: 0, 1

Deprecated. A list of domain names. In iOS 7 and later, if this key is present, the system treats associated domain names as though they're associated with the `OnDemandMatchDomainsOnRetry` key. This behavior can be overridden by `OnDemandRules`.

Deprecated. A list of domain names. In iOS 7 and later, this key is deprecated (but still supported) in favor of `EvaluateConnection` actions in the `OnDemandRules` dictionaries.

Deprecated. A list of domain names. In iOS 7 and later, this field is deprecated (but still supported) in favor of `EvaluateConnection` actions in the `OnDemandRules` dictionaries.

The on-demand rules dictionary.

The action to take if this dictionary matches the current network. Possible values are: - `Allow`: Deprecated. Allow VPN On Demand to connect if triggered. - `Connect`: Unconditionally initiate a VPN connection on the next network attempt. - `Disconnect`: Tear down the VPN connection and don't reconnect on demand as long as this dictionary matches. - `EvaluateConnection`: Evaluate the ActionParameters array for each connection attempt. - `Ignore`: Leave any existing VPN connection up, but don't reconnect on demand as long as this dictionary matches. Only the `Disconnect` action is available on watchOS 10 and later.

Range: Allow, Connect, Disconnect, EvaluateConnection, Ignore

An array of dictionaries that provides rules similar to the `OnDemandRules` dictionary, but evaluated on each connection instead of when the network changes. This value is only for use with dictionaries in which the `Action` value is `EvaluateConnection`. The system evaluates these dictionaries in order and the first dictionary that matches determines the behavior. Not available in watchOS.

An array of domain names. This rule matches if any of the domain names in the specified list matches any domain in the device's search domains list. The system supports a wildcard (`\*`) prefix. For example, `\*.example.com` matches against either `mydomain.example.com` or `yourdomain.example.com`.

An array of IP addresses. This rule matches if any of the network's specified DNS servers match any entry in the array. The system supports matching with a single wildcard. For example, `17.\*` matches any DNS server in the `17.0.0.0/8` subnet.

An interface type. If specified, this rule matches only if the primary network interface hardware matches the specified type.

Range: Ethernet, WiFi, Cellular

An array of SSIDs to match against the current network. If the network isn't a Wi-Fi network or if the SSID doesn't appear in this array, the match fails. Omit this key and the corresponding array to match against any SSID.

A URL to probe. This rule matches when this URL is successfully fetched (returns a `200` HTTP status code) without redirection. Not available in watchOS.

A dictionary that provides rules similar to the OnDemandRules dictionary, but evaluated on each connection instead of when the network changes. These dictionaries are evaluated in order, and the behavior is determined by the first dictionary that matches. The keys allowed in each dictionary are described below. Note: This array is used only for dictionaries in which EvaluateConnection is the Action value.

The domains to apply this evaluation.

Defines the VPN behavior for the specified domains. Allowed values are: * 'ConnectIfNeeded': The specified domains should trigger a VPN connection attempt if domain name resolution fails, such as when the DNS server indicates that it can't resolve the domain, responds with a redirection to a different server, or fails to respond (timeout). * 'NeverConnect': The specified domains should never trigger a VPN connection attempt.

Range: ConnectIfNeeded, NeverConnect

An array of IP addresses of DNS servers to use for resolving the specified domains. These servers don't need to be part of the device's current network configuration. If these DNS servers aren't reachable, the system establishes a VPN connection. These DNS servers need to be either internal DNS servers or trusted external DNS servers. This key is valid only if the value of 'DomainAction' is 'ConnectIfNeeded'.

An HTTP or HTTPS (preferred) URL to probe, using a GET request. If the URL's hostname can't be resolved, if the server is unreachable, or if the server doesn't respond with a 200 HTTP status code, the device establishes a VPN connection in response. This key is valid only if the value of 'DomainAction' is 'ConnectIfNeeded'.

The IP address or host name of the VPN server.

Identifier of the IKEv2 client.

The remote identifier.

The type of authentication method for the VPN. To enable EAP-only authentication, set this to `None` and `ExtendedAuthEnabled` to `1`. If this is `None` and the `ExtendedAuthEnabled` key isn't set, the authentication configuration defaults to `SharedSecret`.

Range: None, SharedSecret, Certificate

The type of `PayloadCertificateUUID` to use for IKEv2 machine authentication. If this key is included, the system requires a value for `ServerCertificateIssuerCommonName`.

Default: "RSA"

Range: RSA, ECDSA256, ECDSA384, ECDSA521, RSA-PSS

The UUID of the certificate payload within the same profile to use as the account credential. If the value of `AuthenticationMethod` is `Certificate`, the system sends this certificate out for IKEv2 machine authentication. If extended authentication (EAP) is used, the system sends this certificate out for EAP-TLS authentication.

The password to use for the account credentials. Only used if `AuthenticationMethod` is `Password`.

If the VPNSubType field contains the bundle identifier of an app that contains multiple VPN providers of the same type (app-proxy or packet-tunnel), then the system uses this field to choose which provider to use for this configuration. If the VPN provider uses a system extension, then this field is required.

If the VPN provider uses a system extension, then this field is required.

If `AuthenticationMethod` is `SharedSecret`, the device uses this value for IKE authentication.

If `1`, enables EAP-only authentication.

Default: 0

Range: 0, 1

The user name to use for authentication.

The password to use for authentication.

If `1`, enables VPN up on demand.

Default: 0

Range: 0, 1

If `1`, the system disables the Connect On Demand toggle in Settings for this configuration.

Default: 0

Range: 0, 1

A list of rules that determine when and how to use an OnDemand VPN.

One of the following: - `None`: No keepalive. - `Low`: Send keepalive every 30 minutes. - `Medium`: Send keepalive every 10 minutes. - `High`: Send keepalive every 1 minute. Not available in watchOS.

Default: "Medium"

Range: None, Low, Medium, High

Common Name of the server certificate issuer. If set, this field causes IKE to send a certificate request based on this certificate issuer to the server. This key is required if the `CertificateType` key is included and the `ExtendedAuthEnabled` key is `1`.

The common name of the server certificate. The system uses this name to validate the certificate sent by the IKE server. If not set, the system uses the remote identifier to validate the certificate.

The minimum TLS version to use with EAP-TLS authentication.

Default: "1.0"

Range: 1.0, 1.1, 1.2, 1.3

The maximum TLS version to use with EAP-TLS authentication.

Default: "1.2"

Range: 1.0, 1.1, 1.2, 1.3

If `1`, negotiations should use IKEv2 Configuration Attribute `INTERNAL_IP4_SUBNET` and `INTERNAL_IP6_SUBNET`.

Default: 0

Range: 0, 1

If `1`, the system disables MOBIKE.

Default: 0

Range: 0, 1

If `1`, the system disables IKEv2 redirect. If not set, the system redirects an IKEv2 connection when it receives a redirect request from the server.

Default: 0

Range: 0, 1

If `1`, the VPN disconnects automatically after a period defined by `DisconnectOnIdleTimer`.

Default: 0

Range: 0, 1

Only used if `DisconnectOnIdle` is `1`. The number of seconds before the VPN disconnects. On watchOS, maximum allowed value is 15 seconds

If `1`, enables NAT keepalive offload for Always On VPN IKEv2 connections. The device sends keepalive packets to maintain NAT mappings for IKEv2 connections that have a NAT on the path. It sends keepalive packets at regular intervals when the device is awake. If `NATKeepAliveOffloadEnable` is `1`, the system offloads keepalive packets to hardware while the device is asleep. NAT keepalive offload has an impact on the battery life due to the extra workload during sleep. The default interval for the keepalive offload packets is 20 seconds over Wi-Fi and 110 seconds over Cellular interface. The default NAT keepalive works well on networks with small NAT mapping timeouts but imposes a potential battery impact. If a network has larger NAT mapping timeouts, larger keepalive intervals may be safely used to minimize battery impact. Modify the keepalive interval through the `NATKeepAliveInterval` key.

Default: 1

Range: 0, 1

The NAT Keepalive interval for Always On VPN IKEv2 connections. This value controls the interval that the device sends keepalive offload packets. The minimum value is 20 seconds. If no key is specified, the default is 20 seconds over Wi-Fi and 110 seconds over a cellular interface.

Default: 20

If `1`, enables Perfect Forward Secrecy (PFS) for IKEv2 Connections.

Default: 0

Range: 0, 1

If `1`, the system performs a certificate revocation check for IKEv2 connections. This is a best-effort revocation check and server response timeouts won't cause it to fail.

Default: 0

Range: 0, 1

If `1`, the system enables a tunnel over cellular data to carry traffic that's eligible for Wi-Fi Assist and also requires VPN. Enabling fallback requires that the server support multiple tunnels for a single user. Not available in watchOS.

Default: 0

Range: 0, 1

The Maximum Transmission Unit (MTU) specifies the maximum size in bytes of each packet that the system sends over the IKEv2 VPN interface.

Default: 1280

Range: 1280 – 1400

If the value of this key is `app-proxy`, the VPN service tunnels traffic at the application layer. If the value of this key is `packet-tunnel`, the VPN service tunnels traffic at the IP layer.

Default: "packet-tunnel"

Range: packet-tunnel, app-proxy

If `1`, then the system routes all network traffic through the VPN, with some controllable exclusions, such as `ExcludeLocalNetworks`, `ExcludeCellularServices`, and `ExcludeAPNs` properties. The system always excludes the following traffic from the tunnel: - Traffic necessary for connecting and maintaining the device's network connection, such as DHCP. - Traffic necessary for connecting to captive networks. - Certain cellular services traffic that's not routable over the internet and is instead directly routed to the cellular network. See the `ExcludeCellularServices` field for more information. - Network communication with a companion device such as a watchOS device.

Default: 0

Range: 0, 1

If `1`, all the VPN's non-default routes take precedence over any locally-defined routes. If `IncludeAllNetworks` is `1`, the system ignores `EnforceRoutes`.

Default: 0

Range: 0, 1

If `1` and either `IncludeAllNetworks` or `EnforceRoutes` are `1`, then the system routes local network traffic outside of the VPN. The default for this value is `0` on macOS and `1` on iOS.

Range: 0, 1

If `1` and `IncludeAllNetworks` is `1`, the system excludes internet-routable network traffic for cellular services (VoLTE, Wi-Fi Calling, IMS, MMS, Visual Voicemail, etc.) from the tunnel. Note that some cellular carriers route cellular services traffic directly to the carrier network, bypassing the internet. Such cellular services traffic is always excluded from the tunnel.

Default: 1

Range: 0, 1

If `1` and `IncludeAllNetworks` is `1`, the system excludes network traffic for the Apple Push Notification service (APNs) from the tunnel.

Default: 1

Range: 0, 1

If set to `1` and `IncludeAllNetworks` is set to `1`, the device excludes network traffic used for communicating with devices connected via USB or Wi-Fi from the tunnel.

Default: 1

Range: 0, 1

The Post-quantum Pre-shared key (PPK) the device uses for this VPN. This key is is used with VPN servers that support RFC 8784. If this key is present `PPKIdentifier` must also be present.

The identifier for the Post-quantum Pre-shared key (PPK) the device uses for this VPN. This key is is used with VPN servers that support RFC 8784. If this key is present `PPK` must also be present.

If set to `1`, the VPN doesn't establish a connection if the server doesn't support RFC 8784 or doesn't accept the PPK identifier specified in `PPKIdentifier`. The device ignores this key if `PPK` and `PPKIdentifier` aren't present.

Default: 1

Range: 0, 1

If set to `0`, the VPN doesn't establish a connection if the server does not support or doesn't allow post-quantum key exchanges. Thd device ignores this key if `PostQuantumKeyExchangeMethods` isn't present in `IKESecurityAssociationParameters` or `ChildSecurityAssociationParameters`.

Default: 0

Range: 0, 1

If set to `1`, the device doesn't allow DES, 3DES, and Diffie-Hellman groups less than 14. Also the device requires the encryption algorithm specified for the IKE SA to be at least as cryptographically strong as the algorithm specified for the child SA. The device rejects this profile payload if these requirements aren't met.

Default: 0

Range: 0, 1

These parameters apply to Child Security Association unless `ChildSecurityAssociationParameters` is specified.

The `ChildSecurityAssociationParameters` dictionaries.

The action to take if this dictionary matches the current network. Possible values are: - `Allow`: Deprecated. Allow VPN On Demand to connect if triggered. - `Connect`: Unconditionally initiate a VPN connection on the next network attempt. - `Disconnect`: Tear down the VPN connection and don't reconnect on demand as long as this dictionary matches. - `EvaluateConnection`: Evaluate the ActionParameters array for each connection attempt. - `Ignore`: Leave any existing VPN connection up, but don't reconnect on demand as long as this dictionary matches. Only the `Disconnect` action is available on watchOS 10 and later.

Range: Allow, Connect, Disconnect, EvaluateConnection, Ignore

An array of dictionaries that provides rules similar to the `OnDemandRules` dictionary, but evaluated on each connection instead of when the network changes. This value is only for use with dictionaries in which the `Action` value is `EvaluateConnection`. The system evaluates these dictionaries in order and the first dictionary that matches determines the behavior. Not available in watchOS.

An array of domain names. This rule matches if any of the domain names in the specified list matches any domain in the device's search domains list. The system supports a wildcard (`\*`) prefix. For example, `\*.example.com` matches against either `mydomain.example.com` or `yourdomain.example.com`.

An array of IP addresses. This rule matches if any of the network's specified DNS servers match any entry in the array. The system supports matching with a single wildcard. For example, `17.\*` matches any DNS server in the `17.0.0.0/8` subnet.

An interface type. If specified, this rule matches only if the primary network interface hardware matches the specified type.

Range: Ethernet, WiFi, Cellular

An array of SSIDs to match against the current network. If the network isn't a Wi-Fi network or if the SSID doesn't appear in this array, the match fails. Omit this key and the corresponding array to match against any SSID.

A URL to probe. This rule matches when this URL is successfully fetched (returns a `200` HTTP status code) without redirection. Not available in watchOS.

A dictionary that provides rules similar to the OnDemandRules dictionary, but evaluated on each connection instead of when the network changes. These dictionaries are evaluated in order, and the behavior is determined by the first dictionary that matches. The keys allowed in each dictionary are described below. Note: This array is used only for dictionaries in which EvaluateConnection is the Action value.

The domains to apply this evaluation.

Defines the VPN behavior for the specified domains. Allowed values are: * 'ConnectIfNeeded': The specified domains should trigger a VPN connection attempt if domain name resolution fails, such as when the DNS server indicates that it can't resolve the domain, responds with a redirection to a different server, or fails to respond (timeout). * 'NeverConnect': The specified domains should never trigger a VPN connection attempt.

Range: ConnectIfNeeded, NeverConnect

An array of IP addresses of DNS servers to use for resolving the specified domains. These servers don't need to be part of the device's current network configuration. If these DNS servers aren't reachable, the system establishes a VPN connection. These DNS servers need to be either internal DNS servers or trusted external DNS servers. This key is valid only if the value of 'DomainAction' is 'ConnectIfNeeded'.

An HTTP or HTTPS (preferred) URL to probe, using a GET request. If the URL's hostname can't be resolved, if the server is unreachable, or if the server doesn't respond with a 200 HTTP status code, the device establishes a VPN connection in response. This key is valid only if the value of 'DomainAction' is 'ConnectIfNeeded'.

The encryption algorithm. In watchOS and tvOS, the default value is `AES-256-GCM`. `DES` and `3DES` are available only in iOS, macOS, and visionOS prior to iOS 26, macOS 26, and visionOS 26.

Default: "AES-256"

Range: DES, 3DES, AES-128, AES-256, AES-128-GCM, AES-256-GCM, ChaCha20Poly1305

The integrity algorithm. `SHA1-96` and `SHA1-160` are available only in iOS, macOS, and visionOS prior to iOS 26, macOS 26, and visionOS 26.

Default: "SHA2-256"

Range: SHA1-96, SHA1-160, SHA2-256, SHA2-384, SHA2-512

The Diffie-Hellman group. For `AlwaysOn` VPN in iOS 14.2 and later, the minimum allowed value is `14`. `1`, `2`, and `5` are available only in iOS, macOS, and visionOS prior to iOS 26, macOS 26, and visionOS 26.

Default: 14

Range: 1, 2, 5, 14, 15, 16, 17, 18, 19, 20, 21, 31, 32

An array of integers representing postquantum key exchange methods the device uses during SA establishment and rekey. You can specify up to seven items, which correspond to ADDKE1 - ADDKE7 from RFC 9370.

The SA lifetime (rekey interval) in minutes.

Default: 1440

Range: 10 – 1440

Range: 0, 36, 37

The encryption algorithm. In watchOS and tvOS, the default value is `AES-256-GCM`. `DES` and `3DES` are available only in iOS, macOS, and visionOS prior to iOS 26, macOS 26, and visionOS 26.

Default: "AES-256"

Range: DES, 3DES, AES-128, AES-256, AES-128-GCM, AES-256-GCM, ChaCha20Poly1305

The integrity algorithm. `SHA1-96` and `SHA1-160` are available only in iOS, macOS, and visionOS prior to iOS 26, macOS 26, and visionOS 26.

Default: "SHA2-256"

Range: SHA1-96, SHA1-160, SHA2-256, SHA2-384, SHA2-512

The Diffie-Hellman group. For `AlwaysOn` VPN in iOS 14.2 and later, the minimum allowed value is `14`. `1`, `2`, and `5` are available only in iOS, macOS, and visionOS prior to iOS 26, macOS 26, and visionOS 26.

Default: 14

Range: 1, 2, 5, 14, 15, 16, 17, 18, 19, 20, 21, 31, 32

An array of integers representing postquantum key exchange methods the device uses during SA establishment and rekey. You can specify up to seven items, which correspond to ADDKE1 - ADDKE7 from RFC 9370.

The SA lifetime (rekey interval) in minutes.

Default: 1440

Range: 10 – 1440

Range: 0, 36, 37

The transport protocol to communicate with the DNS server.

Range: Cleartext, HTTPS, TLS

The URI template of a DNS-over-HTTPS server, as defined in RFC 8484, which needs to use the `https://` scheme. The system uses the hostname or address in the URL to validate the server certificate. If `ServerAddresses` isn't specified, the system uses the hostname or address in the URL to determine the server addresses. This key is required if the `DNSProtocol` is `HTTPS`.

The hostname of a DNS-over-TLS server to validate the server certificate, as defined in RFC 7858. If `ServerAddresses` isn't specified, the system uses the hostname to determine the server addresses. This key is required if the `DNSProtocol` is `TLS`.

The array of DNS server IP address strings. These IP addresses can be a mixture of IPv4 and IPv6 addresses.

The list of domain strings used to fully qualify single-label host names.

The primary domain of the tunnel.

The list of domain strings used to determine which DNS queries use the DNS resolver settings in `ServerAddresses`. The system uses this key to create a split DNS configuration where it resolves only hosts in certain domains using the tunnel's DNS resolver. The system uses the default resolver for hosts that aren't in one of the domains in this list. If `SupplementalMatchDomains` contains the empty string it becomes the default domain. Split-tunnel configurations can direct all DNS queries to the VPN DNS servers before the primary DNS servers. If the VPN tunnel becomes the network's default route, the servers listed in `ServerAddresses` become the default resolver and the system ignores the `SupplementalMatchDomains` list.

If `0`, append the domains in the `SupplementalMatchDomains` list to the resolver's list of search domains.

Default: 0

Range: 0, 1

That UUID that points to an identity certificate payload. The system uses this identity to authenticate the user to the DNS resolver.

If `true`, enables automatic proxy configuration.

Range: 0, 1

If `true`, enables proxy auto discovery.

Default: 1

Range: 0, 1

The URL to the location of the proxy auto-configuration file. Used only when `ProxyAutoConfigEnable` is `true`.

An array of domains that defines which hosts use proxy settings for hosts.

If `1`, enables proxy for HTTP traffic.

Default: 0

Range: 0, 1

The host name of the HTTP proxy.

The port number of the HTTP proxy. This field is required if `HTTPProxy` is specified.

Range: 0 – 65535

The user name used for authentication.

The password used for authentication.

If `true`, enables proxy for HTTPS traffic.

Default: 0

Range: 0, 1

The host name of the HTTPS proxy.

The port number of the HTTPS proxy. This field is required if `HTTPSProxy` is specified.

Range: 0 – 65535

If `1`, allows the user to disable the VPN configuration.

Default: 0

Range: 0, 1

An array that contains an arbitrary number of tunnel configurations.

An array that contains an arbitrary number of service exceptions.

An array that contains an arbitrary number of apps whose connections occur outside the VPN.

If `1`, allows traffic from Captive Web Sheet outside the VPN tunnel.

Default: 0

Range: 0, 1

If `1`, allows traffic from all captive networking apps outside the VPN tunnel to perform captive network handling.

Default: 0

Range: 0, 1

The array of captive networking apps whose traffic is allowed outside the VPN tunnel, to perform captive network handling. Used only when `AllowAllCaptiveNetworkPlugins` is `false`.

The type of connection, which needs to be `IKEv2`.

Range: IKEv2

The interfaces to apply this configuration to.

Range: Cellular, WiFi

The name of a service that's exempt from Always On VPN. `CellularServices` is available in iOS 11.3 and later; it exempts `VoLTE`, `IMS` and `MMS`. Always On VPN exempts WiFiCalling in iOS 13.4 and later. `DeviceCommunication` is available in iOS 17.4 and later; it exempts network traffic used for communicating with devices connected via USB or Wi-Fi.

Range: VoiceMail, AirPrint, CellularServices, DeviceCommunication

The action to take with network connections from the named service.

Range: Allow, Drop

The app's bundle identifier.

Limit the exception to only the specified list of protocols, with support for `UDP` only.

Range: UDP

The bundle identifier for the app that's allowed on the captive network.

The type of authentication method to use: `Password`, `Certificate`, or `Password+Certificate`.

Default: "Password"

Range: Password, Certificate, Password+Certificate

If `1`, the VPN disconnects automatically disconnect after a period defined by `DisconnectOnIdleTimer`.

Default: 0

Range: 0, 1

The number of seconds before the VPN disconnects. This value is only used if `DisconnectOnIdle` is `1`.

If `1`, then all the VPN's non-default routes take precedence over any locally-defined routes. If `IncludeAllNetworks` is `1`, the system ignores the value of `EnforceRoutes`.

Default: 0

Range: 0, 1

If `1`, the system brings up the VPN on demand.

Default: 0

Range: 0, 1

Determines when and how the system uses an OnDemand VPN.

The UUID of the identity certificate as the account credential. If `AuthenticationMethod` is `Certificate`, and extended authentication (EAP) isn't used, the device sends this certificate for IKE client authentication. If extended authentication is used, this certificate can be used for EAP-TLS.

The password to use for the account credentials. Only used if `AuthenticationMethod` is `Password`.

If the VPNSubType field contains the bundle identifier of an app that contains multiple VPN providers of the same type (app-proxy or packet-tunnel), then the system uses this field to choose which provider to use for this configuration. If the VPN provider uses a system extension, then this field is required.

If the VPN provider uses a system extension, then this field is required.

If the value of this key is `app-proxy`, the VPN service tunnels traffic at the application layer. If the value of this key is `packet-tunnel`, the VPN service tunnels traffic at the IP layer.

Default: "packet-tunnel"

Range: packet-tunnel, app-proxy

A positive integer.

The action to take if this dictionary matches the current network. Possible values are: - `Allow`: Deprecated. Allow VPN On Demand to connect if triggered. - `Connect`: Unconditionally initiate a VPN connection on the next network attempt. - `Disconnect`: Tear down the VPN connection and don't reconnect on demand as long as this dictionary matches. - `EvaluateConnection`: Evaluate the ActionParameters array for each connection attempt. - `Ignore`: Leave any existing VPN connection up, but don't reconnect on demand as long as this dictionary matches. Only the `Disconnect` action is available on watchOS 10 and later.

Range: Allow, Connect, Disconnect, EvaluateConnection, Ignore

An array of dictionaries that provides rules similar to the `OnDemandRules` dictionary, but evaluated on each connection instead of when the network changes. This value is only for use with dictionaries in which the `Action` value is `EvaluateConnection`. The system evaluates these dictionaries in order and the first dictionary that matches determines the behavior. Not available in watchOS.

An array of domain names. This rule matches if any of the domain names in the specified list matches any domain in the device's search domains list. The system supports a wildcard (`\*`) prefix. For example, `\*.example.com` matches against either `mydomain.example.com` or `yourdomain.example.com`.

An array of IP addresses. This rule matches if any of the network's specified DNS servers match any entry in the array. The system supports matching with a single wildcard. For example, `17.\*` matches any DNS server in the `17.0.0.0/8` subnet.

An interface type. If specified, this rule matches only if the primary network interface hardware matches the specified type.

Range: Ethernet, WiFi, Cellular

An array of SSIDs to match against the current network. If the network isn't a Wi-Fi network or if the SSID doesn't appear in this array, the match fails. Omit this key and the corresponding array to match against any SSID.

A URL to probe. This rule matches when this URL is successfully fetched (returns a `200` HTTP status code) without redirection. Not available in watchOS.

A dictionary that provides rules similar to the OnDemandRules dictionary, but evaluated on each connection instead of when the network changes. These dictionaries are evaluated in order, and the behavior is determined by the first dictionary that matches. The keys allowed in each dictionary are described below. Note: This array is used only for dictionaries in which EvaluateConnection is the Action value.

The domains to apply this evaluation.

Defines the VPN behavior for the specified domains. Allowed values are: * 'ConnectIfNeeded': The specified domains should trigger a VPN connection attempt if domain name resolution fails, such as when the DNS server indicates that it can't resolve the domain, responds with a redirection to a different server, or fails to respond (timeout). * 'NeverConnect': The specified domains should never trigger a VPN connection attempt.

Range: ConnectIfNeeded, NeverConnect

An array of IP addresses of DNS servers to use for resolving the specified domains. These servers don't need to be part of the device's current network configuration. If these DNS servers aren't reachable, the system establishes a VPN connection. These DNS servers need to be either internal DNS servers or trusted external DNS servers. This key is valid only if the value of 'DomainAction' is 'ConnectIfNeeded'.

An HTTP or HTTPS (preferred) URL to probe, using a GET request. If the URL's hostname can't be resolved, if the server is unreachable, or if the server doesn't respond with a 200 HTTP status code, the device establishes a VPN connection in response. This key is valid only if the value of 'DomainAction' is 'ConnectIfNeeded'.