VPN: IKEv2

The IKEv2 VPN profile configuration enables you to configure IKEv2 VPN settings for devices when:

Note: Requires Device Enrollment.

Note: The fields and controls that appear in this dialog box will change according to the selections you make.

General


VPN Name	Enter the VPN name used to identify this account.
Always-On VPN	Select this option to enable Always-On VPN, which enables tunnel configuration options, service exception options, captive web-sheet options, and captive network plugin options. (Requires supervision and iOS 8.0 or later.)
Allow User to Disable Auto-Connection	Select this option to allow the user to disable auto-connection.
Use Same Tunnel Configuration for Cellular and WiFi	Select this option if you want to use the same tunnel configuration for cellular and WiFi.

General


VPN Server Hostname / IP Address	Enter the IP address or hostname of the VPN server.
Remote Identifier	Enter the remote identifier.
Local Identifier	Enter the identifier of the IKEv2 client.

Machine Authentication


Authentication Type	Select the type of authentication method for the VPN: Certificate or Shared Secret.
Shared Secret	Enter the shared secret used for IKE authentication.
Enable EAP	Select this option to enable EAP-only authentication.
EAP Authentication	Select the EAP authentication type.
Identity Certificate	Select the certificate within thye same profile to use as the account credential.
Certificate Type	Select the type of certificate used for IKEv2 machine authentication. If this field is specified and EAP is enabled, the Server Certificate Issuer Common Name field is required.
Server Certificate Issuer Common Name	Enter the common name of the server certificate issuer. This field enables IKE to send a certificate request based on this certificate issuer to the server. This field is required if Certificate Type is specified and EAP is enabled.
Server Certificate Common Name	Enter the common name of the server certificate. This name is used to validate the certificate sent by the IKE server. If this field is not set, the Remote Identifier is used to validate the certificate.
TLS Minimum Version	Select the minimum TLS version to be used with EAP-TLS authentication.
TLS Maximum Version	Select the maximum TLS version to be used with EAP-TLS authentication.
Domain	Enter the domain for authenticating the connection. Supports macros.
Account	Enter the user name used for EAP authentication. Supports macros.
Password	Enter the password used for EAP authentication.

Miscellaneous


Enable NAT Keepalive While Device Is Asleep	Select this option to enable NAT Keepalive offload. NAT Keepalive has an impact on the battery life since Keepalive packets will be offloaded to hardware while the device is asleep.
NAT Keepalive Interval	Enter the NAT Keepalive interval. This value controls the interval over which Keepalive offload packets are sent by the device.
Dead Peer Detection Rate	Select the rate for dead peer detection.
Disable Redirects	Select this option to disable IKEv2 redirects. If this option is not selected, the IKEv2 connection is redirected if a redirect request is received from the server.
Disable Mobility and Multihoming	Select this option to disable mobility and multihoming.
Use IPv4/IPv6 Internal Subnet Attributes	Select this option to have negotiations use IKEv2 configuration attributes INTERNAL_IP4_SUBNET and INTERNAL_IP6_SUBNET.
Enable Perfect Forward Secrecy	Select this option to enable perfect forward secrecy.
Enable Certificate Revocation Check	Select this option to perform a certificate revocation check for IKEv2 connections. This is a best-effort revocation check; server response timeouts won't cause it to fail.
Enable Cellular Fallback	When selected, this option enables a tunnel over cellular data to carry traffic that is eligible for WiFi Assist and also requires VPN. Enabling fallback requires that the server support multiple tunnels for a single user.

VPN On Demand


Enable VPN On Demand	Select this option to enable VPN On Demand.
VPN On Demand Actions	Click the + button to add a VPN On Demand action.
Disconnect On Idle	Select After Interval to disconnect after and on-demand connection idles.
After Interval	Select the length of time to wait before disconnecting an on-demand connection.

IKE Security Association Parameters


Encryption Algorithm	Select the encryption algorithm.
Integrity Algorithm	Select the integrity algorithm.
Diffie-Hellman Group	Select the Diffie-Hellman group.
Lifetime In Minutes	Enter the IKE security association lifetime in minutes. The value must be between 10 and 1440 minutes.

Child Security Association Parameters


Encryption Algorithm	Select the encryption algorithm.
Integrity Algorithm	Select the integrity algorithm.
Diffie-Hellman Group	Select the Diffie-Hellman group.
Lifetime In Minutes	Enter the child security association lifetime in minutes. The value must be between 10 and 1440 minutes.

Proxy


Proxy	Select how you want to configure proxies to be used with this configuration.
URL	Enter the URL that will be used to receive proxy settings.
Proxy Server	Enter the hostname or IP address of the proxy server.
Username	Enter the username for authenticating the connection. Supports macros.
Password	Enter the password for authenticating the connection.


Voice Mail	Select an option for the voice mail service.
AirPrint	Select an option for the AirPrint service.
Cellular Services	Select an option for the cellular services.
Allow Traffic from All Captive Web Sheets Outside the VPN Tunnel	Select this option to allow traffic from all captive web sheets outside the VPN tunnel.
Allow Traffic from All Captive Networking Apps Outside the VPN Tunnel	Select this option to allow traffic from all captive networking apps outside the VPN tunnel to perform captive network handling.
Captive Networking Applications	Click the + button to add applications you want to allow on the captive network.