# Configure iOS Per-App VPN in Hexnode UEM Per-App VPN in Hexnode UEM routes network traffic through a VPN tunnel only for selected managed iOS applications instead of tunneling all device traffic. IT administrators use this policy to protect corporate app traffic while keeping personal app data outside the organization VPN. The Per-App VPN payload applies to apps installed and managed through Hexnode UEM, requires a supported VPN client app on the device, and supports iOS 7.0 and later. After the policy is configured and associated with target devices, the selected managed apps use the assigned VPN connection when they launch or send network traffic. Core Benefits of Per-App VPN for iOS Devices -------------------------------------------- - **Granular control:** Per-App VPN separates corporate and personal traffic at the application level. - **Security:** Internal-use managed apps can transmit data through a configured VPN tunnel while personal app traffic remains outside the tunnel. - **Automation:** VPN On Demand can automatically establish a VPN tunnel for configured domains when supported by the device and authentication method. - **Flexibility:** Different managed apps or app groups can be assigned to different VPN connections, such as separate VPN configurations for finance apps and marketing apps. Prerequisites for Configuring Per-App VPN in Hexnode UEM -------------------------------------------------------- - **Managed apps:** Per-App VPN works only for applications installed and managed through Hexnode UEM. - **Application framework:** Apps must be built with the Cocoa framework and use standard networking APIs. - **VPN client app:** The required VPN client application, such as AnyConnect or OpenVPN, must be installed and managed by Hexnode UEM on the target iOS device. - **Supported OS:** iOS 7.0 and later. Configure Per-App VPN for iOS in Hexnode UEM -------------------------------------------- Use the Per-App VPN policy payload in the Hexnode UEM portal to assign managed apps or app groups to a VPN connection. 1. Log in to the **Hexnode UEM portal**. 2. Go to **Policies > New Policy > Create a fully custom policy > iOS > Network > Per-App VPN**, and click **Configure**. 3. Click **+Add** to select the specific managed apps or app groups that must use the VPN. 4. Select the **Provider Type** for the tunneling layer: - **App-proxy:** Tunnels traffic at the application layer. - **Packet-tunnel:** Tunnels traffic at the IP layer. VPN Connection Parameters for iOS Per-App VPN --------------------------------------------- Hexnode UEM supports multiple Per-App VPN connection types for iOS devices. Each connection type has common settings and type-specific fields. ### General Per-App VPN Settings This table lists the common Per-App VPN connection settings available for supported iOS VPN connection types in Hexnode UEM. General settings for iOS Per-App VPN connectionsSettingDescriptionConnection TypeChoose from IPSec (Cisco), Cisco AnyConnect, Juniper SSL, F5 SSL, SonicWALL Mobile Connect, Aruba VIA, Check Point Mobile VPN, or Open VPN. Make sure that the VPN client application is installed and managed by Hexnode UEM on the target devices.Connection NameEnter the name displayed for the VPN connection on the device.ServerEnter the IP address or Fully Qualified Domain Name (FQDN) of the VPN server.AccountEnter the username for authentication. This field supports the **%name%** and **%email%** [Hexnode UEM wildcards](https://www.hexnode.com/mobile-device-management/help/how-to-pass-device-and-user-information-using-the-wildcards-supported-by-hexnode-mdm/).Configure Per-App VPN On Demand for iOS Domains ----------------------------------------------- Per-App VPN On Demand enables Hexnode UEM administrators to specify domains that automatically trigger the VPN connection when Safari or supported system apps attempt to access them. Domain entries must use the format **www\.domainname.com**. On Demand VPN requires an authentication method that does not need user interaction, such as certificate-based authentication, so the VPN connection can be established automatically. This table explains the iOS domain categories that can trigger Per-App VPN On Demand in Hexnode UEM. Per-App VPN On Demand domain categoriesDomain CategoryDescriptionSafari DomainsAutomatically activates the VPN when the configured domains are accessed in the Safari browser.Calendar DomainsTriggers the VPN connection for specified Calendar service domains.Contacts DomainsStarts the VPN when the Contacts app initiates network communication with these domains.Mail DomainsTriggers the VPN when the Mail app communicates with the specified domains.SMB DomainsSpecifies Server Message Block (SMB) domains accessible through this VPN. Warning Per-App VPN On Demand for configured domains may not work as expected on certain devices. Proxy Settings for iOS Per-App VPN ---------------------------------- A proxy server acts as an intermediary for network traffic and can hide the device’s actual IP address from destination services. Hexnode UEM supports three proxy configuration options for Per-App VPN. - **None:** Do not configure a proxy server. - **Manual:** - **Server:** Enter the proxy server IP address or hostname. - **Port:** Specify the required proxy port. - **Authentication:** Provide the username for the proxy. - **Password:** Enter the associated password. - **Automatic:** Enter the **Proxy Server URL** to connect automatically. Connection Type-Specific Parameters for iOS Per-App VPN ------------------------------------------------------- ### IPSec (Cisco) - **Password:** Enter the password for server authentication. - **Group name:** Enter the group identifier of the connection. - **Shared secret:** Enter the secret used to establish the connection. - **Use hybrid authentication:** Use the group name, shared secret, and a server-side certificate. This option is disabled by default. - **Prompt for password:** When enabled, users are prompted to enter their passwords manually. ### Cisco AnyConnect and Juniper SSL - **Group (AnyConnect):** Enter the group identifier for the Cisco AnyConnect server. - **Realm (Juniper):** Enter the authentication realm for the Juniper SSL VPN. - **Role (Juniper):** Enter the user access level or role defined on the Juniper server. - **User Authentication:** Select **Password** or **Certificate**. - **Password:** If **Password** is selected, provide the required credentials for authentication. - **Credential:** If certificate authentication is used, select a certificate previously added under **iOS > Security > Certificates** in the same policy. ### F5 SSL, Aruba VIA, Check Point Mobile VPN, and Open VPN - **User Authentication:** Choose **Password** or **Certificate**. Password is the default option. - **Password/Certificate:** Enter the password or select a certificate uploaded in the **Certificates** subtab of the policy. ### SonicWALL Mobile Connect - **Login Group or Domain:** Specify the security appliance login group that the device must connect to. - **User Authentication:** Choose **Password** or **Certificate**. - **Password:** If **Password** is selected, provide the password required to authenticate the user. - **Certificate:** Select the digital certificate to be used for secure authentication under **iOS > Security > Certificates**. What Happens on the iOS Device After Policy Association ------------------------------------------------------- After the Per-App VPN policy is associated with the target iOS device, the configured VPN connection activates automatically when the configured app or domain condition is met. - An associated managed application is launched. - An associated managed application sends traffic in the background. - A configured On Demand domain is accessed by the corresponding supported app or system service. Troubleshooting iOS Per-App VPN in Hexnode UEM ---------------------------------------------- - **VPN is not associated with a reinstalled managed app:** If a managed app is uninstalled and reinstalled, remove the policy from the device and associate it again so the VPN configuration links to the app. - **VPN connection fails for a managed app:** Confirm that the required VPN client app, such as AnyConnect or OpenVPN, is installed and managed by Hexnode UEM. Also verify that the VPN server FQDN or IP address is reachable. - **Per-App VPN On Demand does not trigger:** Verify that a certificate is used for authentication. On Demand rules may fail with password-based authentication because the connection cannot complete a silent login.