Network:VPN:IKEV2 ()

New in iOS 27.0, macOS 27.0, tvOS 27.0, visionOS 27.0

The declaration to configure a VPN using the IKEv2 sub-type.

iOS(27.0)macOS(27.0)tvOS(27.0)visionOS(27.0)

Branch: seed_OS_27_0

Settings (104)

Setting	Type	Required	Default	Manual Install	Supported OS
Visible name VisibleName The name of the VPN connection that the system displays on the device.	string	required	—	✓Yes	iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+)
Host name HostName The IP address or hostname of the VPN server.	string	required	—	✓Yes	iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+)
Local identifier LocalIdentifier Identifier of the IKEv2 client.	string	required	—	✓Yes	iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+)
Remote identifier RemoteIdentifier The remote identifier.	string	required	—	✓Yes	iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+)
Authentication details Authentication Settings that control authentication. 5 subkeys	dictionary	required	—	✓Yes	iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+)
└─ Authentication method Method The type of authentication method for the VPN. To enable EAP-only authentication, set this to `None` and `ExtendedAuthEnabled` to `true`. If this is `None` and the `ExtendedAuthEnabled` key isn't set, the authentication configuration defaults to `SharedSecret`.	string	required	—	✓Yes	iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+)
└─ Credentials asset reference CredentialsAssetReference The identifier of an asset declaration that contains the credentials (password) to authenticate with the VPN server. Required when `Authentication.Method` is set to `SharedSecret`.	string	optional	—	✓Yes	iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+)
└─ Certificate type IdentityCertificateType The type of key used by the identity set in the `IdentityAssetReference` to use for IKEv2 machine authentication. If this key is included, the system requires a value for `ServerCertificateIssuerCommonName`.	string	optional	`RSA`	✓Yes	iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+)
└─ Identity asset reference IdentityAssetReference The identifier of a credential asset declaration that contains the identity that this account requires to authenticate with the VPN server. If the value of `AuthenticationMethod` is `Certificate`, the system sends this certificate out for IKEv2 machine authentication. If extended authentication (EAP) is used, the system sends this certificate out for EAP-TLS authentication. Required when `Authentication.Method` is set to `Certificate`.	string	optional	—	✓Yes	iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+)
└─ Extended authentication (EAP) ExtendedAuth Specifies details about how the VPN routes different types of network traffic. 6 subkeys	dictionary	optional	—	✓Yes	iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+)
└─ └─ Enabled Enabled If `true`, enables EAP-only authentication.	boolean	optional	`false`	✓Yes	iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+)
└─ └─ Credentials asset reference CredentialsAssetReference The identifier of an asset declaration that contains the credentials (user name and password) to authenticate with the VPN server. Required when `Enabled` is set to `true`. Implies the use of EAP-MSCHAPv2.	string	optional	—	✓Yes	iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+)
└─ └─ Server certificate issuer common name ServerCertificateIssuerCommonName Common Name of the server certificate issuer. If set, this field causes IKE to send a certificate request based on this certificate issuer to the server. This key is required if the `IdentityCertificateType` key is included and the `ExtendedAuth.Enabled` key is `true`.	string	optional	—	✓Yes	iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+)
└─ └─ Server certificate common name ServerCertificateCommonName The common name of the server certificate. The system uses this name to validate the certificate sent by the IKE server. If not set, the system uses the remote identifier to validate the certificate.	string	optional	—	✓Yes	iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+)
└─ └─ TLS minimum version TLSMinimumVersion The minimum TLS version to use with EAP-TLS authentication.	string	optional	`1.0`	✓Yes	iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+)
└─ └─ TLS maximum version TLSMaximumVersion The maximum TLS version to use with EAP-TLS authentication.	string	optional	`1.2`	✓Yes	iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+)
Provider details Provider Specifies details about the provider. 2 subkeys	dictionary	optional	—	✓Yes	iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+)
└─ Type Type The type of VPN service. If the value is `app-proxy`, the service tunnels traffic at the app level. If the value is `packet-tunnel`, the service tunnels traffic at the IP layer.	string	optional	`packet-tunnel`	✓Yes	iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+)
└─ Composed identifier ComposedIdentifier In iOS, tvOS, and visionOS, the identifier is a bundle ID, for example, "com.example.app". In macOS, the identifier is a composed identifier. The format of the composed identifier is either "Bundle-ID" or "Bundle-ID {Designated-Requirement}". "Bundle-ID" is the bundle identifier string of the provider. "Designated-Requirement" is the designated requirement string from the code signature of the provider. For example, "com.example.app" for the bundle ID format, or "com.example.app {anchor apple generic}" for the designated requirement format.	string	optional	—	✓Yes	iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+)
Network routing details NetworkRouting Specifies details about how the VPN routes different types of network traffic. 6 subkeys	dictionary	optional	—	✗No
└─ Enforce routes EnforceRoutes If `true`, all the VPN's non-default routes take precedence over any locally defined routes. If `IncludeAllNetworks` is `true`, the system ignores the value of `EnforceRoutes`.	boolean	optional	`false`	✓Yes	iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+)
└─ Include all networks IncludeAllNetworks If `true`, routes all traffic through the VPN, with some exclusions. Several of the exclusions can be controlled with the `ExcludeLocalNetworks`, `ExcludeCellularServices`, `ExcludeAPNs` and `ExcludeDeviceCommunication` properties. The following traffic is always excluded from the tunnel: - Traffic necessary for connecting and maintaining the device's network connection, such as DHCP. - Traffic necessary for connecting to captive networks. - Certain cellular services traffic that's not routable over the internet and is instead directly routed to the cellular network. See the ExcludeCellularServices property for more details.	boolean	optional	`false`	✓Yes	iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+)
└─ Exclude local networks ExcludeLocalNetworks If `true` and `IncludeAllNetworks` is `true`, routes all local network traffic outside the VPN.	boolean	optional	—	✓Yes	iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+)
└─ Exclude cellular services ExcludeCellularServices If `true` and `IncludeAllNetworks` is `true`, then the system excludes internet-routable network traffic for cellular services (VoLTE, Wi-Fi Calling, IMS, MMS, Visual Voicemail, etc.) from the tunnel. Note that some cellular carriers route cellular services traffic directly to the carrier network, bypassing the internet. Such cellular services traffic is always excluded from the tunnel.	boolean	optional	`true`	✓Yes	iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+)
└─ Exclude APNs ExcludeAPNs If `true` and `IncludeAllNetworks` is `true`, then the system excludes the network traffic for the Apple Push Notification service (APNs) from the tunnel.	boolean	optional	`true`	✓Yes	iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+)
└─ Exclude device communication ExcludeDeviceCommunication If set to `true` and `IncludeAllNetworks` is set to `true`, the device excludes network traffic used for communicating with devices connected via USB or Wi-Fi from the tunnel.	boolean	optional	`true`	✓Yes	iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+)
Disconnect on idle settings. Idle Specifies details about how the system handles idle VPN connections. 3 subkeys	dictionary	optional	—	✓Yes	iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+)
└─ Enable disconnect on idle Disconnect If `true`, disconnects after an on-demand connection idles.	boolean	optional	`false`	✓Yes	iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+)
└─ Disconnect on idle time Timer The length of time to wait, in seconds, before disconnecting an on-demand connection.	integer	optional	—	✓Yes	iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+)
└─ Dead peer detection rate DeadPeerDetectionRate One of the following: - `None`: No keepalive. - `Low`: Send keepalive every 30 minutes. - `Medium`: Send keepalive every 10 minutes. - `High`: Send keepalive every 1 minute.	string	optional	`Medium`	✓Yes	iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+)
On demand details OnDemand Specifies details about how the system controls on-demand VPN. 3 subkeys	dictionary	optional	—	✓Yes	iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+)
└─ Enable VPN on demand Enabled If `true`, enables VPN On Demand.	boolean	optional	`false`	✓Yes	iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+)
└─ Prevent users from toggling VPN on demand DisableUserOverride If `true`, the device disables the Connect On Demand toggle in Settings for this configuration.	boolean	optional	`false`	✗No
└─ On demand rules Rules An array of dictionaries defining On Demand Rules. 1 subkey	array	optional	—	✓Yes	iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+)
└─ └─ Rules element RulesElement 7 subkeys	dictionary		—	✓Yes	iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+)
└─ └─ └─ On demand action Action The action to take if this dictionary matches the current network. Possible values are: - `Allow`: Deprecated. Allow VPN On Demand to connect if triggered. - `Connect`: Unconditionally initiate a VPN connection on the next network attempt. - `Disconnect`: Tear down the VPN connection and don't reconnect on demand as long as this dictionary matches. - `EvaluateConnection`: Evaluate the ActionParameters array for each connection attempt. - `Ignore`: Leave any existing VPN connection up, but don't reconnect on demand as long as this dictionary matches.	string	required	—	✓Yes	iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+)
└─ └─ └─ Action parameters ActionParameters An array of dictionaries that provides rules similar to the `OnDemandRules` dictionary, but evaluated on each connection instead of when the network changes. This value is only for use with dictionaries in which the `Action` value is `EvaluateConnection`. The system evaluates these dictionaries in order and the first dictionary that matches determines the behavior. 1 subkey	array	optional	—	✓Yes	iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+)
└─ └─ └─ └─ [Structure continues recursively] ↻ This structure continues with 1 subkey (deeply nested - 1 subkey). See Apple's documentation for the complete structure.			—	✓Yes	iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+)
└─ └─ └─ DNS domain match DNSDomainMatch An array of domain names. This rule matches if any of the domain names in the specified list matches any domain in the device's search domains list. The system supports a wildcard (``) prefix. For example, `.example.com` matches against either `mydomain.example.com` or `yourdomain.example.com`. 1 subkey	array	optional	—	✓Yes	iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+)
└─ └─ └─ └─ [Structure continues recursively] ↻ This structure continues with 1 subkey (deeply nested - 1 subkey). See Apple's documentation for the complete structure.			—	✓Yes	iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+)
└─ └─ └─ DNS server address match DNSServerAddressMatch An array of IP addresses. This rule matches if any of the network's specified DNS servers match any entry in the array. The system supports matching with a single wildcard. For example, `17.*` matches any DNS server in the `17.0.0.0/8` subnet. 1 subkey	array	optional	—	✓Yes	iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+)
└─ └─ └─ └─ [Structure continues recursively] ↻ This structure continues with 1 subkey (deeply nested - 1 subkey). See Apple's documentation for the complete structure.			—	✓Yes	iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+)
└─ └─ └─ Interface type match InterfaceTypeMatch An interface type. If specified, this rule matches only if the primary network interface hardware matches the specified type.	string	optional	—	✓Yes	iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+)
└─ └─ └─ SSID match SSIDMatch An array of SSIDs to match against the current network. If the network isn't a Wi-Fi network or if the SSID doesn't appear in this array, the match fails. Omit this key and the corresponding array to match against any SSID. 1 subkey	array	optional	—	✓Yes	iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+)
└─ └─ └─ └─ [Structure continues recursively] ↻ This structure continues with 1 subkey (deeply nested - 1 subkey). See Apple's documentation for the complete structure.			—	✓Yes	iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+)
└─ └─ └─ URL string probe URLStringProbe A URL to probe. This rule matches when this URL is successfully fetched (returns a `200` HTTP status code) without redirection.	string	optional	—	✓Yes	iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+)
Use IPv4 / IPv6 internal subnet attributes UseConfigurationAttributeInternalIPSubnet If `true`, negotiations should use IKEv2 Configuration Attribute `INTERNAL_IP4_SUBNET` and `INTERNAL_IP6_SUBNET`.	boolean	optional	`false`	✓Yes	iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+)
Disable mobility and multihoming DisableMOBIKE If `true`, the system disables MOBIKE.	boolean	optional	`false`	✓Yes	iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+)
Disable redirect DisableRedirect If `true`, the system disables IKEv2 redirect. If not set, the system redirects an IKEv2 connection when it receives a redirect request from the server.	boolean	optional	`false`	✓Yes	iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+)
Enable NAT keep alive offload EnableNATKeepAliveOffload If `true`, enables NAT keepalive offload for Always On VPN IKEv2 connections. The device sends keepalive packets to maintain NAT mappings for IKEv2 connections that have a NAT on the path. It sends keepalive packets at regular intervals when the device is awake. If `NATKeepAliveOffloadEnable` is `true`, the system offloads keepalive packets to hardware while the device is asleep. NAT keepalive offload has an impact on the battery life due to the extra workload during sleep. The default interval for the keepalive offload packets is 20 seconds over Wi-Fi and 110 seconds over Cellular interface. The default NAT keepalive works well on networks with small NAT mapping timeouts but imposes a potential battery impact. If a network has larger NAT mapping timeouts, larger keepalive intervals may be safely used to minimize battery impact. Modify the keepalive interval through the `NATKeepAliveInterval` key.	boolean	optional	`true`	✓Yes	iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+)
NAT keepalive interval NATKeepAliveInterval The NAT Keepalive interval for Always On VPN IKEv2 connections. This value controls the interval that the device sends keepalive offload packets. The minimum value is 20 seconds. If no key is specified, the default is 20 seconds over Wi-Fi and 110 seconds over a cellular interface.	integer	optional	`20`	✓Yes	iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+)
Enable perfect forward secrecy EnablePFS If `true`, enables Perfect Forward Secrecy (PFS) for IKEv2 Connections.	boolean	optional	`false`	✓Yes	iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+)
Enable certificate revocation check EnableCertificateRevocationCheck If `true`, the system performs a certificate revocation check for IKEv2 connections. This is a best-effort revocation check and server response timeouts won't cause it to fail.	boolean	optional	`false`	✓Yes	iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+)
Enable fallback EnableFallback If `true`, the system enables a tunnel over cellular data to carry traffic that's eligible for Wi-Fi Assist and also requires VPN. Enabling fallback requires that the server support multiple tunnels for a single user.	boolean	optional	`false`	✗No
Maximum transmission unit MTU The Maximum Transmission Unit (MTU) specifies the maximum size in bytes of each packet that the system sends over the IKEv2 VPN interface. Range: 1280 - 1400	integer	optional	`1280`	✓Yes	iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+)
Enforce strict algorithm selection EnforceStrictAlgorithmSelection If set to `true`, the device doesn't allow DES, 3DES, and Diffie-Hellman groups less than 14. Also the device requires the encryption algorithm specified in `IKESecurityAssociationParameters` to be at least as cryptographically strong as the algorithm specified in `ChildSecurityAssociationParameters`. The device rejects this configuration if these requirements aren't met.	boolean	optional	`false`	✓Yes	iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+)
Post quantum key exchange PostQuantumKeyExchange Post Quantum Key Exchange settings. 4 subkeys	dictionary	optional	—	✓Yes	iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+)
└─ Post-quantum pre-shared key PPK The Post-quantum Pre-shared key (PPK) the device uses for this VPN. This key is is used with VPN servers that support RFC 8784. If this key is present `PPKIdentifier` must also be present.	data	optional	—	✓Yes	iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+)
└─ Post-quantum pre-shared key identifier PPKIdentifier The identifier for the Post-quantum Pre-shared key (PPK) the device uses for this VPN. This key is is used with VPN servers that support RFC 8784. If this key is present `PPK` must also be present.	string	optional	—	✓Yes	iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+)
└─ Post-quantum pre-shared key mandatory PPKMandatory If set to `true`, the VPN doesn't establish a connection if the server doesn't support RFC 8784 or doesn't accept the PPK identifier specified in `PPKIdentifier`. The device ignores this key if `PPK` and `PPKIdentifier` aren't present.	boolean	optional	`true`	✓Yes	iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+)
└─ Allow post-quantum key exchange fallback AllowFallback If set to `false`, the VPN doesn't establish a connection if the server doesn't support or doesn't allow post-quantum key exchanges. Thd device ignores this key if `PostQuantumKeyExchangeMethods` isn't present in `IKESecurityAssociationParameters` or `ChildSecurityAssociationParameters`.	boolean	optional	`false`	✓Yes	iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+)
IKE security association parameters IKESecurityAssociationParameters These parameters apply to Child Security Association unless `ChildSecurityAssociationParameters` is specified. 5 subkeys	dictionary	optional	—	✓Yes	iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+)
└─ Encryption algorithm EncryptionAlgorithm The encryption algorithm. On tvOS, the default value is `AES-256-GCM`.	string	optional	`AES-256`	✓Yes	iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+)
└─ Integrity algorithm IntegrityAlgorithm The integrity algorithm.	string	optional	`SHA2-256`	✓Yes	iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+)
└─ Diffie hellman group DiffieHellmanGroup The Diffie-Hellman group. For `AlwaysOn` VPN, the minimum allowed value is `14`.	integer	optional	`14`	✓Yes	iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+)
└─ Post-quantum key exchange methods PostQuantumKeyExchangeMethods An array of integers representing postquantum key exchange methods the device uses during SA establishment and rekey. You can specify up to seven items, which correspond to ADDKE1 - ADDKE7 from RFC 9370. 1 subkey	array	optional	—	✓Yes	iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+)
└─ └─ Post-quantum key exchange method PostQuantumKeyExchangeMethod	integer		—	✓Yes	iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+)
└─ Life time in minutes LifeTimeInMinutes The SA lifetime (rekey interval) in minutes. Range: 10 - 1440	integer	optional	`1440`	✓Yes	iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+)
Child security association parameters ChildSecurityAssociationParameters The `ChildSecurityAssociationParameters` dictionaries. 5 subkeys	dictionary	optional	—	✓Yes	iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+)
└─ Encryption algorithm EncryptionAlgorithm The encryption algorithm. On tvOS, the default value is `AES-256-GCM`.	string	optional	`AES-256`	✓Yes	iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+)
└─ Integrity algorithm IntegrityAlgorithm The integrity algorithm.	string	optional	`SHA2-256`	✓Yes	iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+)
└─ Diffie hellman group DiffieHellmanGroup The Diffie-Hellman group. For `AlwaysOn` VPN, the minimum allowed value is `14`.	integer	optional	`14`	✓Yes	iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+)
└─ Post-quantum key exchange methods PostQuantumKeyExchangeMethods An array of integers representing postquantum key exchange methods the device uses during SA establishment and rekey. You can specify up to seven items, which correspond to ADDKE1 - ADDKE7 from RFC 9370. 1 subkey	array	optional	—	✓Yes	iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+)
└─ └─ Post-quantum key exchange method PostQuantumKeyExchangeMethod	integer		—	✓Yes	iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+)
└─ Life time in minutes LifeTimeInMinutes The SA lifetime (rekey interval) in minutes. Range: 10 - 1440	integer	optional	`1440`	✓Yes	iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+)
DNS DNS A dictionary to use for all VPN types. 9 subkeys	dictionary	optional	—	✓Yes	iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+)
└─ DNS protocol Protocol The transport protocol to communicate with the DNS server.	string	required	—	✓Yes	iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+)
└─ Server URL ServerURL The URI template of a DNS-over-HTTPS server, as defined in RFC 8484, which needs to use the `https://` scheme. The system uses the hostname or address in the URL to validate the server certificate. If `ServerAddresses` isn't specified, the system uses the hostname or address in the URL to determine the server addresses. This key is required if the `DNSProtocol` is `HTTPS`.	string	optional	—	✓Yes	iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+)
└─ Server name ServerName The hostname of a DNS-over-TLS server to validate the server certificate, as defined in RFC 7858. If `ServerAddresses` isn't specified, the system uses the hostname to determine the server addresses. This key is required if the `DNSProtocol` is `TLS`.	string	optional	—	✓Yes	iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+)
└─ DNS server addresses ServerAddresses The array of DNS server IP address strings. These IP addresses can be a mixture of IPv4 and IPv6 addresses. 1 subkey	array	required	—	✓Yes	iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+)
└─ └─ Server address element ServerAddressesElement	string		—	✓Yes	iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+)
└─ DNS search domains SearchDomains The list of domain strings used to fully qualify single-label host names. 1 subkey	array	optional	—	✓Yes	iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+)
└─ └─ Search domains element SearchDomainsElement	string		—	✓Yes	iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+)
└─ Domain name DomainName The primary domain of the tunnel.	string	optional	—	✓Yes	iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+)
└─ Supplemental match domains SupplementalMatchDomains The list of domain strings used to determine which DNS queries use the DNS resolver settings in `ServerAddresses`. The system uses this key to create a split DNS configuration where it resolves only hosts in certain domains using the tunnel's DNS resolver. The system uses the default resolver for hosts that aren't in one of the domains in this list. If `SupplementalMatchDomains` contains the empty string it becomes the default domain. Split-tunnel configurations can direct all DNS queries to the VPN DNS servers before the primary DNS servers. If the VPN tunnel becomes the network's default route, the servers listed in `ServerAddresses` become the default resolver and the system ignores the `SupplementalMatchDomains` list. 1 subkey	array	optional	—	✓Yes	iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+)
└─ └─ Supplemental match domains element SupplementalMatchDomainsElement	string		—	✓Yes	iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+)
└─ Supplemental match domains no search SupplementalMatchDomainsNoSearch If `true`, don't append the domains in the `SupplementalMatchDomains` list to the resolver's list of search domains.	boolean	optional	`false`	✓Yes	iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+)
└─ Identity asset reference IdentityAssetReference The identifier of a credential asset declaration that contains the identity that the system uses to authenticate the user to the DNS resolver.	string	optional	—	✓Yes	iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+)
Proxies Proxies The dictionary to use to configure `Proxies` for use with `VPN`. 5 subkeys	dictionary	optional	—	✓Yes	iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+)
└─ Proxy auto config enable AutoConfigEnable If `true`, enables automatic proxy configuration.	boolean	optional	`false`	✓Yes	iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+)
└─ Proxy auto discovery enable AutoDiscoveryEnable If `true`, enables proxy auto discovery.	boolean	optional	`true`	✓Yes	iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+)
└─ Proxy server URL AutoConfigURLString The URL to the location of the proxy auto-configuration file. Used only when `ProxyAutoConfigEnable` is `true`.	string	optional	—	✓Yes	iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+)
└─ Supplemental match domains SupplementalMatchDomains An array of domains that defines which hosts use proxy settings for hosts. 1 subkey	array	optional	—	✓Yes	iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+)
└─ └─ Supplemental match domains element SupplementalMatchDomainsElement	string		—	✓Yes	iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+)
└─ Protocol Protocol The dictionary to use to configure HTTP servers for `Proxies` for use with `VPN`. 3 subkeys	dictionary	optional	—	✓Yes	iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+)
└─ └─ HTTP protocol HTTP The dictionary to use to configure the HTTP (non-TLS) server. 3 subkeys	dictionary	optional	—	✓Yes	iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+)
└─ └─ └─ Enable HTTP Enable If `true`, enables proxy for HTTP traffic.	boolean	optional	`false`	✓Yes	iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+)
└─ └─ └─ HTTP host name HostName The host name of the HTTP proxy.	string	optional	—	✓Yes	iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+)
└─ └─ └─ HTTP port Port The port number of the HTTP proxy. This field is required if `HostName` is specified. Range: 0 - 65535	integer	optional	—	✓Yes	iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+)
└─ └─ HTTPS protocol HTTPS The dictionary to use to configure the HTTPS (TLS) server. 3 subkeys	dictionary	optional	—	✓Yes	iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+)
└─ └─ └─ Enable HTTPS Enable If `true`, enables proxy for HTTPS traffic.	boolean	optional	`false`	✓Yes	iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+)
└─ └─ └─ HTTPS host name HostName The host name of the HTTPS proxy.	string	optional	—	✓Yes	iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+)
└─ └─ └─ HTTPS port Port The port number of the HTTPS proxy. This field is required if `HostName` is specified. Range: 0 - 65535	integer	optional	—	✓Yes	iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+)
└─ └─ Credentials asset reference CredentialsAssetReference The identifier of an asset declaration that contains the credentials (user name and password) to authenticate with the proxy server.	string	optional	—	✓Yes	iOS (27.0+)macOS (27.0+)tvOS (27.0+)visionOS (27.0+)

Network:VPN:IKEV2 ()

Settings (104)

Apple MDM & DDM Policy Explorer

Policy categories

Common policy keys