As one of the business feature the upcoming iOS 7, Apple has announced the ability to configure VPN on application basis. However, details about this feature are hard to find on the web. I am wondering, if this configuration will be something that can be done on the Device itself, or if it has to be something that has to be set up by an IT administrator in the network?

  • Once this is out of beta - we'll gladly reopen this. Until then - you can see the meta threads below for some options to get help in the interim. – bmike Aug 25 '13 at 16:33
  • @bmike Granted, it is in beta. But the information I asked about is something that Apple officially introduced and from the answers of the meta link you provided this means: there is no need to put this on hold. – Krumelur Aug 25 '13 at 17:01
  • Please edit in a link to Apple's non-NDA announcement and I'll gladly have a look at this. I've started a meta thread to discuss this specific instance to discuss this specific question and whether it can work for the site before general release of iOS 7. – bmike Aug 25 '13 at 17:18
  • Why was this closed? Whether or not Apple wants it discussed is of no importance at all. There may even be potential answerers who are not bound by the NDA. – Craig McMahon Sep 12 '13 at 2:32
  • We can move the discussion about site operation to Ask Different Meta as Craig raises one of the reasons many people have stated they don't want NDA encumbered questions on the site. – bmike Sep 18 '13 at 17:25

Here's how I understand it. Mobile apps that run on iOS 7 can indeed be set up to (either manually or automatically) connect via VPN, but the devices have to be managed with OS X 10.9 as the backend VPN server and MDM. This is intended to separate the corporate connection (which may be carrying sensitive data) from the personal one.

Functionally, a payload (XML file) will be pushed to the iOS device. The VPN payload is designated by specifying com.apple.vpn.managed as the PayloadType value. The VPN payload contains VPN connection information, but relevant to VPN-By-App, the OnDemandMatchAppEnabled key is enabled:

If true, the Per-App VPN connection starts automatically when apps linked to this Per-App VPN service initiate network communication.

Additionally, there is a VPNUUID key:

A globally-unique identifier for this VPN configuration. This identifier is used to configure apps so that they use the Per-App VPN service for all of their network communication.

And a SafariDomains key:

This array contains strings, each of which is a domain that should trigger this VPN connection in Safari.

So, the short answer to your question is Yes.

  • I wish it was that simple :).Identifier is com.apple.vpn.managed.applayer and beyond that even apple guys do'nt seems to have any clue how this works. Native iOS VPN client does not support it. My app keeps throwing error. "App layer VPN is required" – user62386 Nov 13 '13 at 19:10
  • To clarify the response above, OS X 10.9 is not required to manage a mobile device nor is it required to handle the VPN. Per-App VPN configuration is handled through the MDM API's (Profiles). Thus, any of the MDM providers that can configure a device for Per-App VPN. The requirement is that the device is under management through an MDM system which can consist of an OS X 10.9 Server running Profile Manager. – james_fuller Dec 17 '13 at 14:44
  • While setting Safari Domains, I get the below error: my-iPad profiled[2634] <Error>: MKBDeviceLockAssertion: MKBDeviceLockAssertion (asserttype:3) my-iPad profiled[2634] <Notice>: (Error) MC: Could not add Safari App VPN rules my-iPad profiled[2634] <Notice>: (Error) MC: Rolling back installation of profile – Manmay Jul 21 '14 at 8:49
  • Old question, but would you know if you can whitelist specific domains in the perAppVPN - I guess via the payload? – Tiago Oct 20 '16 at 11:02

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .