Category filter
Configure iOS Per-App VPN in Hexnode UEM
TL;DR
Configure Per-App VPN under Policies > New Policy > Create a fully custom policy > iOS > Network > Per-App VPN, add the managed apps or app groups that must use the VPN, choose the provider type, and enter the connection settings for the required VPN client. Use Per-App VPN On Demand only where domain-based automatic connection is required.
Per-App VPN in Hexnode UEM routes network traffic through a VPN tunnel only for selected managed iOS applications instead of tunneling all device traffic. IT administrators use this policy to protect corporate app traffic while keeping personal app data outside the organization VPN. The Per-App VPN payload applies to apps installed and managed through Hexnode UEM, requires a supported VPN client app on the device, and supports iOS 7.0 and later. After the policy is configured and associated with target devices, the selected managed apps use the assigned VPN connection when they launch or send network traffic.
Core Benefits of Per-App VPN for iOS Devices
- Granular control: Per-App VPN separates corporate and personal traffic at the application level.
- Security: Internal-use managed apps can transmit data through a configured VPN tunnel while personal app traffic remains outside the tunnel.
- Automation: VPN On Demand can automatically establish a VPN tunnel for configured domains when supported by the device and authentication method.
- Flexibility: Different managed apps or app groups can be assigned to different VPN connections, such as separate VPN configurations for finance apps and marketing apps.
Prerequisites for Configuring Per-App VPN in Hexnode UEM
- Managed apps: Per-App VPN works only for applications installed and managed through Hexnode UEM.
- Application framework: Apps must be built with the Cocoa framework and use standard networking APIs.
- VPN client app: The required VPN client application, such as AnyConnect or OpenVPN, must be installed and managed by Hexnode UEM on the target iOS device.
- Supported OS: iOS 7.0 and later.
Configure Per-App VPN for iOS in Hexnode UEM
Use the Per-App VPN policy payload in the Hexnode UEM portal to assign managed apps or app groups to a VPN connection.
- Log in to the Hexnode UEM portal.
- Go to Policies > New Policy > Create a fully custom policy > iOS > Network > Per-App VPN, and click Configure.
- Click +Add to select the specific managed apps or app groups that must use the VPN.
- Select the Provider Type for the tunneling layer:
- App-proxy: Tunnels traffic at the application layer.
- Packet-tunnel: Tunnels traffic at the IP layer.
VPN Connection Parameters for iOS Per-App VPN
Hexnode UEM supports multiple Per-App VPN connection types for iOS devices. Each connection type has common settings and type-specific fields.
General Per-App VPN Settings
This table lists the common Per-App VPN connection settings available for supported iOS VPN connection types in Hexnode UEM.
| Setting | Description |
|---|---|
| Connection Type | Choose from IPSec (Cisco), Cisco AnyConnect, Juniper SSL, F5 SSL, SonicWALL Mobile Connect, Aruba VIA, Check Point Mobile VPN, or Open VPN. Make sure that the VPN client application is installed and managed by Hexnode UEM on the target devices. |
| Connection Name | Enter the name displayed for the VPN connection on the device. |
| Server | Enter the IP address or Fully Qualified Domain Name (FQDN) of the VPN server. |
| Account | Enter the username for authentication. This field supports the %name% and %email% Hexnode UEM wildcards. |
Configure Per-App VPN On Demand for iOS Domains
Per-App VPN On Demand enables Hexnode UEM administrators to specify domains that automatically trigger the VPN connection when Safari or supported system apps attempt to access them. Domain entries must use the format www\.domainname.com.
On Demand VPN requires an authentication method that does not need user interaction, such as certificate-based authentication, so the VPN connection can be established automatically.
This table explains the iOS domain categories that can trigger Per-App VPN On Demand in Hexnode UEM.
| Domain Category | Description |
|---|---|
| Safari Domains | Automatically activates the VPN when the configured domains are accessed in the Safari browser. |
| Calendar Domains | Triggers the VPN connection for specified Calendar service domains. |
| Contacts Domains | Starts the VPN when the Contacts app initiates network communication with these domains. |
| Mail Domains | Triggers the VPN when the Mail app communicates with the specified domains. |
| SMB Domains | Specifies Server Message Block (SMB) domains accessible through this VPN. |
Per-App VPN On Demand for configured domains may not work as expected on certain devices.
Proxy Settings for iOS Per-App VPN
A proxy server acts as an intermediary for network traffic and can hide the device’s actual IP address from destination services. Hexnode UEM supports three proxy configuration options for Per-App VPN.
- None: Do not configure a proxy server.
- Manual:
- Server: Enter the proxy server IP address or hostname.
- Port: Specify the required proxy port.
- Authentication: Provide the username for the proxy.
- Password: Enter the associated password.
- Automatic: Enter the Proxy Server URL to connect automatically.
Connection Type-Specific Parameters for iOS Per-App VPN
IPSec (Cisco)
- Password: Enter the password for server authentication.
- Group name: Enter the group identifier of the connection.
- Shared secret: Enter the secret used to establish the connection.
- Use hybrid authentication: Use the group name, shared secret, and a server-side certificate. This option is disabled by default.
- Prompt for password: When enabled, users are prompted to enter their passwords manually.
Cisco AnyConnect and Juniper SSL
- Group (AnyConnect): Enter the group identifier for the Cisco AnyConnect server.
- Realm (Juniper): Enter the authentication realm for the Juniper SSL VPN.
- Role (Juniper): Enter the user access level or role defined on the Juniper server.
- User Authentication: Select Password or Certificate.
- Password: If Password is selected, provide the required credentials for authentication.
- Credential: If certificate authentication is used, select a certificate previously added under iOS > Security > Certificates in the same policy.
F5 SSL, Aruba VIA, Check Point Mobile VPN, and Open VPN
- User Authentication: Choose Password or Certificate. Password is the default option.
- Password/Certificate: Enter the password or select a certificate uploaded in the Certificates subtab of the policy.
SonicWALL Mobile Connect
- Login Group or Domain: Specify the security appliance login group that the device must connect to.
- User Authentication: Choose Password or Certificate.
- Password: If Password is selected, provide the password required to authenticate the user.
- Certificate: Select the digital certificate to be used for secure authentication under iOS > Security > Certificates.
What Happens on the iOS Device After Policy Association
After the Per-App VPN policy is associated with the target iOS device, the configured VPN connection activates automatically when the configured app or domain condition is met.
- An associated managed application is launched.
- An associated managed application sends traffic in the background.
- A configured On Demand domain is accessed by the corresponding supported app or system service.
Troubleshooting iOS Per-App VPN in Hexnode UEM
- VPN is not associated with a reinstalled managed app: If a managed app is uninstalled and reinstalled, remove the policy from the device and associate it again so the VPN configuration links to the app.
- VPN connection fails for a managed app: Confirm that the required VPN client app, such as AnyConnect or OpenVPN, is installed and managed by Hexnode UEM. Also verify that the VPN server FQDN or IP address is reachable.
- Per-App VPN On Demand does not trigger: Verify that a certificate is used for authentication. On Demand rules may fail with password-based authentication because the connection cannot complete a silent login.
Frequently Asked Questions
Can unmanaged apps use Per-App VPN in Hexnode UEM?
No. Per-App VPN in Hexnode UEM applies only to apps installed and managed through Hexnode UEM.
Does Per-App VPN stay connected all the time?
No. Per-App VPN establishes the tunnel when the selected managed app sends traffic or when a configured On Demand domain is accessed by the corresponding supported app or system service.
Where should certificates be uploaded for Per-App VPN authentication?
Add certificates under Policies > [select an existing policy] > Manage > Modify > iOS > Security > Certificates in the same policy used for the Per-App VPN configuration.
