VPN

com.apple.vpn.managed

The payload that configures a VPN.

iOS 4.0+macOS 10.7+tvOS 17.0+visionOS 1.0+

Configuration Keys (13)

Showing 13 of 13 keys

Key	Type	Description	Default	Range
`VPNType`string Type required	string	The type of the VPN, which defines which settings are appropriate for this VPN payload. If the type is `VPN` or `TransparentProxy`, then the system requires a value for `VPNSubType`. `TransparentProxy` is only available in macOS. `L2TP` and `IPSec` aren't available in tvOS. `AlwaysOn` is only available on iOS and `AlwaysOn` doesn't support Apple Watch pairing. For a previously paired Apple Watch, all phone-watch communications cease when `AlwaysOn` is enabled. Not available in watchOS.	Default: —	Range: VPN, L2TP, IPSec, IKEv2, AlwaysOn, TransparentProxy
`VPNSubType`string VPN subtype	string	An identifier for a vendor-specified configuration dictionary when the value for `VPNType` is `VPN`. If `VPNType` is `VPN`, the system requires this field. If the configuration targets a VPN solution that uses a VPN plugin, then this field contains the bundle identifier of the plugin. Here are some examples: - Cisco AnyConnect: `com.cisco.anyconnect.applevpn.plugin` - Juniper SSL: `net.juniper.sslvpn` - F5 SSL: `com.f5.F5-Edge-Client.vpnplugin` - SonicWALL Mobile Connect: `com.sonicwall.SonicWALL-SSLVPN.vpnplugin` - ``Aruba VIA: `com.arubanetworks.aruba-via.vpnplugin` If the configuration targets a VPN solution that uses a network extension provider, then this field contains the bundle identifier of the app that contains the provider. Contact the VPN solution vendor for the value of the identifier. If `VPNType` is `IKEv2`, then the `VPNSubType` field is optional and reserved for future use. If it's specified, it needs to contain an empty string. Not available in watchOS.	Default: —	Range: —
`UserDefinedName`string User defined name required	string	The description of the VPN connection that the system displays on the device. Not available in watchOS.	Default: —	Range: —
`VendorConfig`dict Vendor configuration dictionary	dict	The vendor-specific configuration dictionary, which the system reads only when `VPNSubType` has a value. Not available in watchOS.	Default: —	Range: —
`Realm`string Realm	string	The Kerberos realm name, which needs to be properly capitalized. Valid only for Juniper SSL and Pulse Secure. Not available in watchOS.	Default: —	Range: —
`Role`string Role	string	The role to select when connecting to the server. Valid only for Juniper SSL and Pulse Secure. Not available in watchOS.	Default: —	Range: —
`Group`string Group	string	The group to connect to on the head end. Valid for Cisco AnyConnect and Cisco Legacy AnyConnect. Not available in watchOS.	Default: —	Range: —
`LoginGroupOrDomain`string Login group or domain	string	The login group or domain. Valid only for SonicWALL Mobile Connect. Not available in watchOS.	Default: —	Range: —
`VPN`dict VPN	dict	The dictionary to use when `VPNType` is `VPN`.	Default: —	Range: —
`AuthName`string Account username	string	The VPN account username.	Default: —	Range: —
`AuthPassword`string Account password	string	The VPN account password. Only use this if `AuthenticationMethod` is set to `Password`.	Default: —	Range: —
`RemoteAddress`string RemoteAddress required	string	The IP address or hostname of the VPN server.	Default: —	Range: —
`AuthenticationMethod`string Authentication method	string	The authentication method to use.	Default: "Password"	Range: Password, Certificate, Password+Certificate
`PayloadCertificateUUID`string Certificate UUID	string	The UUID of the certificate payload within the same profile to use for account credentials.	Default: —	Range: —
`ProviderBundleIdentifier`string Provider bundle identifier	string	The bundle identifier for the VPN provider. Not available in watchOS.	Default: —	Range: —
`ProviderDesignatedRequirement`string Provider designated requirement macOS 10.15+ · not on iOS, visionOS	string	If the VPN provider uses a system extension, this field is required. Not available in watchOS.	Default: —	Range: —
`DisconnectOnIdle`integer Enable disconnect on idle	integer	If `1`, disconnects after an on-demand connection idles.	Default: 0	Range: 0, 1
`DisconnectOnIdleTimer`integer Disconnect on idle time	integer	The length of time to wait, in seconds, before disconnecting an on-demand connection. In watchOS, the maximum allowed value is `15`.	Default: —	Range: —
`ProviderType`string	string	The type of VPN service. If the value is `app-proxy`, the service tunnels traffic at the app level. If the value is `packet-tunnel`, the service tunnels traffic at the IP layer. Not available in watchOS.	Default: "packet-tunnel"	Range: packet-tunnel, app-proxy
`IncludeAllNetworks`integer Include all networks iOS 14.0+ · macOS 10.15+ · not on tvOS	integer	If `1``, routes all traffic through the VPN, with some exclusions. Several of the exclusions can be controlled with the `ExcludeLocalNetworks`, `ExcludeCellularServices`, `ExcludeAPNs` and `ExcludeDeviceCommunication` properties. The system always excludes the following traffic from the tunnel: - Traffic necessary for connecting and maintaining the device's network connection, such as DHCP. - Traffic necessary for connecting to captive networks. - Certain cellular services traffic that's not routable over the internet and is instead directly routed to the cellular network. See the ExcludeCellularServices property for more details. - Network communication with a companion device such as a watchOS device. Not available in watchOS.	Default: 0	Range: 0, 1
`EnforceRoutes`integer Enforce routes iOS 14.2+ · macOS 11.0+	integer	If `1`, all the VPN's non-default routes take precedence over any locally defined routes. If `IncludeAllNetworks` is `1`, the system ignores the value of `EnforceRoutes`. Not available in watchOS.	Default: 0	Range: 0, 1
`ExcludeLocalNetworks`integer Exclude local networks iOS 14.2+ · macOS 10.15+ · not on tvOS	integer	If `1` and `IncludeAllNetworks` is `1`, routes all local network traffic outside the VPN. Not available in watchOS.	Default: —	Range: 0, 1
`ExcludeCellularServices`integer Exclude cellular services iOS 16.4+ · macOS 13.3+ · not on tvOS	integer	If `1` and `IncludeAllNetworks` is `1`, then the system excludes internet-routable network traffic for cellular services (VoLTE, Wi-Fi Calling, IMS, MMS, Visual Voicemail, etc.) from the tunnel. Note that some cellular carriers route cellular services traffic directly to the carrier network, bypassing the internet. Such cellular services traffic is always excluded from the tunnel. Not available in watchOS.	Default: 1	Range: 0, 1
`ExcludeAPNs`integer Exclude APNs iOS 16.4+ · macOS 13.3+ · not on tvOS	integer	If `1` and `IncludeAllNetworks` is `1`, then the system excludes the network traffic for the Apple Push Notification service (APNs) from the tunnel. Not available in watchOS.	Default: 1	Range: 0, 1
`ExcludeDeviceCommunication`integer Exclude device communication iOS 17.4+ · macOS 14.4+ · visionOS 1.1+ · not on tvOS	integer	If set to `1` and `IncludeAllNetworks` is set to `1`, the device excludes network traffic used for communicating with devices connected via USB or Wi-Fi from the tunnel.	Default: 1	Range: 0, 1
`OnDemandEnabled`integer Enable VPN on demand	integer	If `1`, enables VPN On Demand.	Default: 0	Range: 0, 1
`OnDemandUserOverrideDisabled`integer Prevent users from toggling VPN on demand iOS 14.0+ · not on macOS	integer	If `1`, the device disables the Connect On Demand toggle in Settings for this configuration. Not available in watchOS.	Default: 0	Range: 0, 1
`OnDemandMatchDomainsAlways`array On demand match domains always iOS · deprecated 7.0 deprecated	array	A list of domain names. The system treats associated domain names as though they're associated with the `OnDemandMatchDomainsOnRetry` key. This behavior can be overridden by `OnDemandRules`. In iOS 7 and later, this key is deprecated (but still supported) in favor of `EvaluateConnection` actions in the `OnDemandRules` dictionaries. Not available in watchOS.	Default: —	Range: —
`MatchDomainAlwaysElement`string Match domain always element	string	—	Default: —	Range: —
`OnDemandMatchDomainsNever`array On demand match domains never iOS · deprecated 7.0 deprecated	array	A list of domain names. If the host name ends with one of these domain names, the system doesn't start the VPN automatically. The system uses this value to exclude a subdomain within an included domain. In iOS 7 and later, this key is deprecated (but still supported) in favor of `EvaluateConnection` actions in the `OnDemandRules` dictionaries. Not available in watchOS.	Default: —	Range: —
`MatchDomainNeverElement`string Match domain never element	string	—	Default: —	Range: —
`OnDemandMatchDomainsOnRetry`array On demand match domains on retry iOS · deprecated 7.0 deprecated	array	A list of domain names. If the host name ends with one of these domain names and a DNS query for that domain name fails, the system starts the VPN automatically. In iOS 7 and later, this key is deprecated (but still supported) in favor of `EvaluateConnection` actions in the `OnDemandRules` dictionaries. Not available in watchOS.	Default: —	Range: —
`MatchDomainOnRetryElement`string Match domain on retry element	string	—	Default: —	Range: —
`OnDemandRules`array On demand rules	array	An array of dictionaries defining On Demand Rules.	Default: —	Range: —
`OnDemandRulesElement`dict On demand rules element	dict	—	Default: —	Range: —
`Action`string On demand action required	string	The action to take if this dictionary matches the current network. Possible values are: - `Allow`: Deprecated. Allow VPN On Demand to connect if triggered. - `Connect`: Unconditionally initiate a VPN connection on the next network attempt. - `Disconnect`: Tear down the VPN connection and don't reconnect on demand as long as this dictionary matches. - `EvaluateConnection`: Evaluate the ActionParameters array for each connection attempt. - `Ignore`: Leave any existing VPN connection up, but don't reconnect on demand as long as this dictionary matches. Only the `Disconnect` action is available on watchOS 10 and later.	Default: —	Range: Allow, Connect, Disconnect, EvaluateConnection, Ignore
`ActionParameters`array Action parameters	array	An array of dictionaries that provides rules similar to the `OnDemandRules` dictionary, but evaluated on each connection instead of when the network changes. This value is only for use with dictionaries in which the `Action` value is `EvaluateConnection`. The system evaluates these dictionaries in order and the first dictionary that matches determines the behavior. Not available in watchOS.	Default: —	Range: —
`ActionParameter`dict Action parameter	dict	A dictionary that provides rules similar to the OnDemandRules dictionary, but evaluated on each connection instead of when the network changes. These dictionaries are evaluated in order, and the behavior is determined by the first dictionary that matches. The keys allowed in each dictionary are described below. Note: This array is used only for dictionaries in which EvaluateConnection is the Action value.	Default: —	Range: —
`Domains`array Domains required	array	The domains to apply this evaluation.	Default: —	Range: —
`DomainsElement`string Domains element	string	—	Default: —	Range: —
`DomainAction`string Domain action required	string	Defines the VPN behavior for the specified domains. Allowed values are: * 'ConnectIfNeeded': The specified domains should trigger a VPN connection attempt if domain name resolution fails, such as when the DNS server indicates that it can't resolve the domain, responds with a redirection to a different server, or fails to respond (timeout). * 'NeverConnect': The specified domains should never trigger a VPN connection attempt.	Default: —	Range: ConnectIfNeeded, NeverConnect
`RequiredDNSServers`array Required DNS servers	array	An array of IP addresses of DNS servers to use for resolving the specified domains. These servers don't need to be part of the device's current network configuration. If these DNS servers aren't reachable, the system establishes a VPN connection. These DNS servers need to be either internal DNS servers or trusted external DNS servers. This key is valid only if the value of 'DomainAction' is 'ConnectIfNeeded'.	Default: —	Range: —
`RequiredDNSServersElement`string Required DNS servers element	string	—	Default: —	Range: —
`RequiredURLStringProbe`string Required URL string probe	string	An HTTP or HTTPS (preferred) URL to probe, using a GET request. If the URL's hostname can't be resolved, if the server is unreachable, or if the server doesn't respond with a 200 HTTP status code, the device establishes a VPN connection in response. This key is valid only if the value of 'DomainAction' is 'ConnectIfNeeded'.	Default: —	Range: —
`DNSDomainMatch`array DNS domain match	array	An array of domain names. This rule matches if any of the domain names in the specified list matches any domain in the device's search domains list. The system supports a wildcard (`\`) prefix. For example, `\.example.com` matches against either `mydomain.example.com` or `yourdomain.example.com`.	Default: —	Range: —
`DNSDomainMatchElement`string DNS domain match element	string	—	Default: —	Range: —
`DNSServerAddressMatch`array DNS server address match	array	An array of IP addresses. This rule matches if any of the network's specified DNS servers match any entry in the array. The system supports matching with a single wildcard. For example, `17.\*` matches any DNS server in the `17.0.0.0/8` subnet.	Default: —	Range: —
`DNSServerAddressMatchElement`string DNS server address match element	string	—	Default: —	Range: —
`InterfaceTypeMatch`string Interface type match	string	An interface type. If specified, this rule matches only if the primary network interface hardware matches the specified type.	Default: —	Range: Ethernet, WiFi, Cellular
`SSIDMatch`array SSID match	array	An array of SSIDs to match against the current network. If the network isn't a Wi-Fi network or if the SSID doesn't appear in this array, the match fails. Omit this key and the corresponding array to match against any SSID.	Default: —	Range: —
`SSIDMatchElement`string SSID match element	string	—	Default: —	Range: —
`URLStringProbe`string URL string probe	string	A URL to probe. This rule matches when this URL is successfully fetched (returns a `200` HTTP status code) without redirection. Not available in watchOS.	Default: —	Range: —
`IPv4`dict IPv4 settings not on tvOS	dict	The dictionary that contains IPv4 settings. Not available in watchOS.	Default: —	Range: —
`OverridePrimary`integer Override primary connection	integer	If `1`, the system sends all network traffic over VPN. Only applies to Cisco IPsec and L2TP VPN types.	Default: 0	Range: 0, 1
`PPP`dict PPP not on tvOS	dict	The dictionary to use when `VPNType` is `L2TP` or `PTPP`. Not available in watchOS.	Default: —	Range: —
`AuthName`string Account username	string	The VPN account user name. This key is for use with L2TP and PPTP networks.	Default: —	Range: —
`AuthPassword`string Account password	string	If `TokenCard` is `1`, use this password for authentication. This key is for use with L2TP and PPTP networks.	Default: —	Range: —
`TokenCard`integer Use token card	integer	If `1`, uses a token card such as an RSA SecurID card for connecting. This key is for use with L2TP networks.	Default: 0	Range: 0, 1
`CommRemoteAddress`string Remote address	string	The IP address or host name of VPN server. This key is for use with L2TP and PPTP networks.	Default: —	Range: —
`AuthEAPPlugins`array EAP plugins	array	An array of authentication plugins. For use of RSA SecurID, this array should only have one value: `EAP-RSA`. This key is for use with L2TP and PPTP networks.	Default: —	Range: —
`EAPPluginElement`string EAP plugin	string	—	Default: —	Range: EAP-RSA, EAP-TLS, EAP-KRB
`AuthProtocol`array Protocol	array	An array of authentication protocols. For use of RSA SecurID, this array should have one value, `EAP`. This key is for use with L2TP and PPTP networks.	Default: —	Range: —
`AuthProtocolElement`string Auth protocol	string	—	Default: —	Range: EAP
`CCPMPPE40Enabled`integer Enable CCPMPPE40	integer	If `1` and `CCPEnabled` is also `1`, enables CCPMPPE128 encryption.	Default: —	Range: 0, 1
`CCPMPPE128Enabled`integer Enable CCPMPPE128	integer	If `1` and `CCPEnabled` is also `1`, enables CCPMPPE40 encryption.	Default: —	Range: 0, 1
`CCPEnabled`integer Enable CCP	integer	If `1`, enables encryption on the connection. This key is for use with PPTP networks.	Default: —	Range: 0, 1
`DisconnectOnIdle`integer Enable disconnect on idle	integer	If `1`, disconnects after an on demand connection idles.	Default: 0	Range: 0, 1
`DisconnectOnIdleTimer`integer Disconnect on idle time	integer	The length of time to wait before disconnecting an on demand connection	Default: —	Range: —
`IPSec`dict IPSec settings not on tvOS	dict	The dictionary that contains IPSec settings. Not available in watchOS.	Default: —	Range: —
`RemoteAddress`string Remote address	string	The IP address or host name of the VPN server.	Default: —	Range: —
`AuthenticationMethod`string Authentication method	string	The authentication method for L2TP and Cisco IPSec.	Default: "SharedSecret"	Range: SharedSecret, Certificate
`XAuthName`string Username	string	The user name for the VPN account for Cisco IPSec.	Default: —	Range: —
`XAuthPassword`string Password	string	The VPN account password for Cisco IPSec.	Default: —	Range: —
`XAuthEnabled`integer XAUTH enabled	integer	If `1`, enables Xauth for Cisco IPSec VPNs.	Default: —	Range: 0, 1
`XAuthPasswordEncryption`string XAUTH password encryption	string	A string that either has the value "Prompt" or isn't present.	Default: —	Range: Prompt
`LocalIdentifier`string Local identifier	string	The name of the group. For hybrid authentication, the string needs to end with "hybrid". Present only for Cisco IPSec if `AuthenticationMethod` is `SharedSecret`.	Default: —	Range: —
`LocalIdentifierType`string Local identifier type	string	Present only if `AuthenticationMethod` is `SharedSecret`. The value is `KeyID`. The system uses this value for L2TP and Cisco IPSec VPNs.	Default: "KeyID"	Range: KeyID
`SharedSecret`data Shared secret	data	The shared secret for this VPN account. Only use this with L2TP and Cisco IPSec VPNs and if the `AuthenticationMethod` key is to `SharedSecret`.	Default: —	Range: —
`PayloadCertificateUUID`string Certificate UUID	string	The UUID of the certificate payload within the same profile to use for the account credentials. Only use this with Cisco IPSec VPNs and if the `AuthenticationMethod` key is to `Certificate`.	Default: —	Range: —
`PromptForVPNPIN`boolean Prompt for PIN	boolean	If `true`, prompts for a PIN when connecting to Cisco IPSec VPNs.	Default: false	Range: —
`DisconnectOnIdle`integer Enable disconnect on idle	integer	If `1`, disconnect after an on-demand connection idles.	Default: 0	Range: 0, 1
`DisconnectOnIdleTimer`integer Disconnect on idle time	integer	The length of time to wait before disconnecting an on-demand connection.	Default: —	Range: —
`OnDemandEnabled`integer Enable VPN on demand	integer	If `1`, enables bringing the VPN connection up on demand.	Default: 0	Range: 0, 1
`OnDemandMatchDomainsAlways`array On demand match domains always iOS · deprecated 7.0 deprecated	array	Deprecated. A list of domain names. In iOS 7 and later, if this key is present, the system treats associated domain names as though they're associated with the `OnDemandMatchDomainsOnRetry` key. This behavior can be overridden by `OnDemandRules`.	Default: —	Range: —
`MatchDomainAlwaysElement`string Match domain always element	string	—	Default: —	Range: —
`OnDemandMatchDomainsNever`array On demand match domains never iOS · deprecated 7.0 deprecated	array	Deprecated. A list of domain names. In iOS 7 and later, this key is deprecated (but still supported) in favor of `EvaluateConnection` actions in the `OnDemandRules` dictionaries.	Default: —	Range: —
`MatchDomainNeverElement`string Match domain never element	string	—	Default: —	Range: —
`OnDemandMatchDomainsOnRetry`array On demand match domains on retry iOS · deprecated 7.0 deprecated	array	Deprecated. A list of domain names. In iOS 7 and later, this field is deprecated (but still supported) in favor of `EvaluateConnection` actions in the `OnDemandRules` dictionaries.	Default: —	Range: —
`MatchDomainOnRetryElement`string Match domain on retry element	string	—	Default: —	Range: —
`OnDemandRules`array On demand rules	array	The on-demand rules dictionary.	Default: —	Range: —
`OnDemandRulesElement`dict On demand rules element	dict	—	Default: —	Range: —
`Action`string On demand action required	string	The action to take if this dictionary matches the current network. Possible values are: - `Allow`: Deprecated. Allow VPN On Demand to connect if triggered. - `Connect`: Unconditionally initiate a VPN connection on the next network attempt. - `Disconnect`: Tear down the VPN connection and don't reconnect on demand as long as this dictionary matches. - `EvaluateConnection`: Evaluate the ActionParameters array for each connection attempt. - `Ignore`: Leave any existing VPN connection up, but don't reconnect on demand as long as this dictionary matches. Only the `Disconnect` action is available on watchOS 10 and later.	Default: —	Range: Allow, Connect, Disconnect, EvaluateConnection, Ignore
`ActionParameters`array Action parameters	array	An array of dictionaries that provides rules similar to the `OnDemandRules` dictionary, but evaluated on each connection instead of when the network changes. This value is only for use with dictionaries in which the `Action` value is `EvaluateConnection`. The system evaluates these dictionaries in order and the first dictionary that matches determines the behavior. Not available in watchOS.	Default: —	Range: —
`ActionParameter`dict Action parameter	dict	A dictionary that provides rules similar to the OnDemandRules dictionary, but evaluated on each connection instead of when the network changes. These dictionaries are evaluated in order, and the behavior is determined by the first dictionary that matches. The keys allowed in each dictionary are described below. Note: This array is used only for dictionaries in which EvaluateConnection is the Action value.	Default: —	Range: —
`Domains`array Domains required	array	The domains to apply this evaluation.	Default: —	Range: —
`DomainsElement`string Domains element	string	—	Default: —	Range: —
`DomainAction`string Domain action required	string	Defines the VPN behavior for the specified domains. Allowed values are: * 'ConnectIfNeeded': The specified domains should trigger a VPN connection attempt if domain name resolution fails, such as when the DNS server indicates that it can't resolve the domain, responds with a redirection to a different server, or fails to respond (timeout). * 'NeverConnect': The specified domains should never trigger a VPN connection attempt.	Default: —	Range: ConnectIfNeeded, NeverConnect
`RequiredDNSServers`array Required DNS servers	array	An array of IP addresses of DNS servers to use for resolving the specified domains. These servers don't need to be part of the device's current network configuration. If these DNS servers aren't reachable, the system establishes a VPN connection. These DNS servers need to be either internal DNS servers or trusted external DNS servers. This key is valid only if the value of 'DomainAction' is 'ConnectIfNeeded'.	Default: —	Range: —
`RequiredDNSServersElement`string Required DNS servers element	string	—	Default: —	Range: —
`RequiredURLStringProbe`string Required URL string probe	string	An HTTP or HTTPS (preferred) URL to probe, using a GET request. If the URL's hostname can't be resolved, if the server is unreachable, or if the server doesn't respond with a 200 HTTP status code, the device establishes a VPN connection in response. This key is valid only if the value of 'DomainAction' is 'ConnectIfNeeded'.	Default: —	Range: —
`DNSDomainMatch`array DNS domain match	array	An array of domain names. This rule matches if any of the domain names in the specified list matches any domain in the device's search domains list. The system supports a wildcard (`\`) prefix. For example, `\.example.com` matches against either `mydomain.example.com` or `yourdomain.example.com`.	Default: —	Range: —
`DNSDomainMatchElement`string DNS domain match element	string	—	Default: —	Range: —
`DNSServerAddressMatch`array DNS server address match	array	An array of IP addresses. This rule matches if any of the network's specified DNS servers match any entry in the array. The system supports matching with a single wildcard. For example, `17.\*` matches any DNS server in the `17.0.0.0/8` subnet.	Default: —	Range: —
`DNSServerAddressMatchElement`string DNS server address match element	string	—	Default: —	Range: —
`InterfaceTypeMatch`string Interface type match	string	An interface type. If specified, this rule matches only if the primary network interface hardware matches the specified type.	Default: —	Range: Ethernet, WiFi, Cellular
`SSIDMatch`array SSID match	array	An array of SSIDs to match against the current network. If the network isn't a Wi-Fi network or if the SSID doesn't appear in this array, the match fails. Omit this key and the corresponding array to match against any SSID.	Default: —	Range: —
`SSIDMatchElement`string SSID match element	string	—	Default: —	Range: —
`URLStringProbe`string URL string probe	string	A URL to probe. This rule matches when this URL is successfully fetched (returns a `200` HTTP status code) without redirection. Not available in watchOS.	Default: —	Range: —
`IKEv2`dict IKEv2 watchOS 10.0+	dict	The dictionary to use when `VPNType` is `IKEv2`.	Default: —	Range: —
`RemoteAddress`string RemoteAddress required	string	The IP address or host name of the VPN server.	Default: —	Range: —
`LocalIdentifier`string LocalIdentifier required	string	Identifier of the IKEv2 client.	Default: —	Range: —
`RemoteIdentifier`string RemoteIdentifier required	string	The remote identifier.	Default: —	Range: —
`AuthenticationMethod`string AuthenticationMethod required	string	The type of authentication method for the VPN. To enable EAP-only authentication, set this to `None` and `ExtendedAuthEnabled` to `1`. If this is `None` and the `ExtendedAuthEnabled` key isn't set, the authentication configuration defaults to `SharedSecret`.	Default: —	Range: None, SharedSecret, Certificate
`CertificateType`string Certificate type	string	The type of `PayloadCertificateUUID` to use for IKEv2 machine authentication. If this key is included, the system requires a value for `ServerCertificateIssuerCommonName`.	Default: "RSA"	Range: RSA, ECDSA256, ECDSA384, ECDSA521, RSA-PSS
`PayloadCertificateUUID`string PayloadCertificateUUID	string	The UUID of the certificate payload within the same profile to use as the account credential. If the value of `AuthenticationMethod` is `Certificate`, the system sends this certificate out for IKEv2 machine authentication. If extended authentication (EAP) is used, the system sends this certificate out for EAP-TLS authentication.	Default: —	Range: —
`Password`string Account password	string	The password to use for the account credentials. Only used if `AuthenticationMethod` is `Password`.	Default: —	Range: —
`ProviderBundleIdentifier`string Provider bundle identifier	string	If the VPNSubType field contains the bundle identifier of an app that contains multiple VPN providers of the same type (app-proxy or packet-tunnel), then the system uses this field to choose which provider to use for this configuration. If the VPN provider uses a system extension, then this field is required.	Default: —	Range: —
`ProviderDesignatedRequirement`string Provider designated requirement macOS 10.15+ · not on iOS, visionOS	string	If the VPN provider uses a system extension, then this field is required.	Default: —	Range: —
`SharedSecret`string SharedSecret	string	If `AuthenticationMethod` is `SharedSecret`, the device uses this value for IKE authentication.	Default: —	Range: —
`ExtendedAuthEnabled`integer ExtendedAuthEnabled	integer	If `1`, enables EAP-only authentication.	Default: 0	Range: 0, 1
`AuthName`string AuthName	string	The user name to use for authentication.	Default: —	Range: —
`AuthPassword`string AuthPassword	string	The password to use for authentication.	Default: —	Range: —
`OnDemandEnabled`integer Enable VPN on demand	integer	If `1`, enables VPN up on demand.	Default: 0	Range: 0, 1
`OnDemandUserOverrideDisabled`integer Prevent users from toggling VPN on demand iOS 14.0+ · not on macOS	integer	If `1`, the system disables the Connect On Demand toggle in Settings for this configuration.	Default: 0	Range: 0, 1
`OnDemandRules`array On demand rules	array	A list of rules that determine when and how to use an OnDemand VPN.	Default: —	Range: —
`OnDemandRulesElement`dict On demand rules element	dict	—	Default: —	Range: —
`Action`string On demand action required	string	The action to take if this dictionary matches the current network. Possible values are: - `Allow`: Deprecated. Allow VPN On Demand to connect if triggered. - `Connect`: Unconditionally initiate a VPN connection on the next network attempt. - `Disconnect`: Tear down the VPN connection and don't reconnect on demand as long as this dictionary matches. - `EvaluateConnection`: Evaluate the ActionParameters array for each connection attempt. - `Ignore`: Leave any existing VPN connection up, but don't reconnect on demand as long as this dictionary matches. Only the `Disconnect` action is available on watchOS 10 and later.	Default: —	Range: Allow, Connect, Disconnect, EvaluateConnection, Ignore
`ActionParameters`array Action parameters	array	An array of dictionaries that provides rules similar to the `OnDemandRules` dictionary, but evaluated on each connection instead of when the network changes. This value is only for use with dictionaries in which the `Action` value is `EvaluateConnection`. The system evaluates these dictionaries in order and the first dictionary that matches determines the behavior. Not available in watchOS.	Default: —	Range: —
`ActionParameter`dict Action parameter	dict	A dictionary that provides rules similar to the OnDemandRules dictionary, but evaluated on each connection instead of when the network changes. These dictionaries are evaluated in order, and the behavior is determined by the first dictionary that matches. The keys allowed in each dictionary are described below. Note: This array is used only for dictionaries in which EvaluateConnection is the Action value.	Default: —	Range: —
`Domains`array Domains required	array	The domains to apply this evaluation.	Default: —	Range: —
`DomainsElement`string Domains element	string	—	Default: —	Range: —
`DomainAction`string Domain action required	string	Defines the VPN behavior for the specified domains. Allowed values are: * 'ConnectIfNeeded': The specified domains should trigger a VPN connection attempt if domain name resolution fails, such as when the DNS server indicates that it can't resolve the domain, responds with a redirection to a different server, or fails to respond (timeout). * 'NeverConnect': The specified domains should never trigger a VPN connection attempt.	Default: —	Range: ConnectIfNeeded, NeverConnect
`RequiredDNSServers`array Required DNS servers	array	An array of IP addresses of DNS servers to use for resolving the specified domains. These servers don't need to be part of the device's current network configuration. If these DNS servers aren't reachable, the system establishes a VPN connection. These DNS servers need to be either internal DNS servers or trusted external DNS servers. This key is valid only if the value of 'DomainAction' is 'ConnectIfNeeded'.	Default: —	Range: —
`RequiredDNSServersElement`string Required DNS servers element	string	—	Default: —	Range: —
`RequiredURLStringProbe`string Required URL string probe	string	An HTTP or HTTPS (preferred) URL to probe, using a GET request. If the URL's hostname can't be resolved, if the server is unreachable, or if the server doesn't respond with a 200 HTTP status code, the device establishes a VPN connection in response. This key is valid only if the value of 'DomainAction' is 'ConnectIfNeeded'.	Default: —	Range: —
`DNSDomainMatch`array DNS domain match	array	An array of domain names. This rule matches if any of the domain names in the specified list matches any domain in the device's search domains list. The system supports a wildcard (`\`) prefix. For example, `\.example.com` matches against either `mydomain.example.com` or `yourdomain.example.com`.	Default: —	Range: —
`DNSDomainMatchElement`string DNS domain match element	string	—	Default: —	Range: —
`DNSServerAddressMatch`array DNS server address match	array	An array of IP addresses. This rule matches if any of the network's specified DNS servers match any entry in the array. The system supports matching with a single wildcard. For example, `17.\*` matches any DNS server in the `17.0.0.0/8` subnet.	Default: —	Range: —
`DNSServerAddressMatchElement`string DNS server address match element	string	—	Default: —	Range: —
`InterfaceTypeMatch`string Interface type match	string	An interface type. If specified, this rule matches only if the primary network interface hardware matches the specified type.	Default: —	Range: Ethernet, WiFi, Cellular
`SSIDMatch`array SSID match	array	An array of SSIDs to match against the current network. If the network isn't a Wi-Fi network or if the SSID doesn't appear in this array, the match fails. Omit this key and the corresponding array to match against any SSID.	Default: —	Range: —
`SSIDMatchElement`string SSID match element	string	—	Default: —	Range: —
`URLStringProbe`string URL string probe	string	A URL to probe. This rule matches when this URL is successfully fetched (returns a `200` HTTP status code) without redirection. Not available in watchOS.	Default: —	Range: —
`DeadPeerDetectionRate`string Dead peer detection rate not on watchOS	string	One of the following: - `None`: No keepalive. - `Low`: Send keepalive every 30 minutes. - `Medium`: Send keepalive every 10 minutes. - `High`: Send keepalive every 1 minute. Not available in watchOS.	Default: "Medium"	Range: None, Low, Medium, High
`ServerCertificateIssuerCommonName`string ServerCertificateIssuerCommonName	string	Common Name of the server certificate issuer. If set, this field causes IKE to send a certificate request based on this certificate issuer to the server. This key is required if the `CertificateType` key is included and the `ExtendedAuthEnabled` key is `1`.	Default: —	Range: —
`ServerCertificateCommonName`string ServerCertificateCommonName	string	The common name of the server certificate. The system uses this name to validate the certificate sent by the IKE server. If not set, the system uses the remote identifier to validate the certificate.	Default: —	Range: —
`TLSMinimumVersion`string TLS minimum version iOS 11.0+ · macOS 10.13+	string	The minimum TLS version to use with EAP-TLS authentication.	Default: "1.0"	Range: 1.0, 1.1, 1.2, 1.3
`TLSMaximumVersion`string TLS maximum version iOS 11.0+ · macOS 10.13+	string	The maximum TLS version to use with EAP-TLS authentication.	Default: "1.2"	Range: 1.0, 1.1, 1.2, 1.3
`UseConfigurationAttributeInternalIPSubnet`integer Use IPv4 / IPv6 internal subnet attributes iOS 9.0+	integer	If `1`, negotiations should use IKEv2 Configuration Attribute `INTERNAL_IP4_SUBNET` and `INTERNAL_IP6_SUBNET`.	Default: 0	Range: 0, 1
`DisableMOBIKE`integer Disable mobility and multihoming iOS 9.0+	integer	If `1`, the system disables MOBIKE.	Default: 0	Range: 0, 1
`DisableRedirect`integer Disable redirect iOS 9.0+	integer	If `1`, the system disables IKEv2 redirect. If not set, the system redirects an IKEv2 connection when it receives a redirect request from the server.	Default: 0	Range: 0, 1
`DisconnectOnIdle`integer Enable disconnect on idle	integer	If `1`, the VPN disconnects automatically after a period defined by `DisconnectOnIdleTimer`.	Default: 0	Range: 0, 1
`DisconnectOnIdleTimer`integer Disconnect on idle time	integer	Only used if `DisconnectOnIdle` is `1`. The number of seconds before the VPN disconnects. On watchOS, maximum allowed value is 15 seconds	Default: —	Range: —
`NATKeepAliveOffloadEnable`integer NAT keep alive offload enable iOS 9.0+	integer	If `1`, enables NAT keepalive offload for Always On VPN IKEv2 connections. The device sends keepalive packets to maintain NAT mappings for IKEv2 connections that have a NAT on the path. It sends keepalive packets at regular intervals when the device is awake. If `NATKeepAliveOffloadEnable` is `1`, the system offloads keepalive packets to hardware while the device is asleep. NAT keepalive offload has an impact on the battery life due to the extra workload during sleep. The default interval for the keepalive offload packets is 20 seconds over Wi-Fi and 110 seconds over Cellular interface. The default NAT keepalive works well on networks with small NAT mapping timeouts but imposes a potential battery impact. If a network has larger NAT mapping timeouts, larger keepalive intervals may be safely used to minimize battery impact. Modify the keepalive interval through the `NATKeepAliveInterval` key.	Default: 1	Range: 0, 1
`NATKeepAliveInterval`integer NAT keepalive interval iOS 9.0+	integer	The NAT Keepalive interval for Always On VPN IKEv2 connections. This value controls the interval that the device sends keepalive offload packets. The minimum value is 20 seconds. If no key is specified, the default is 20 seconds over Wi-Fi and 110 seconds over a cellular interface.	Default: 20	Range: —
`EnablePFS`integer Enable perfect forward secrecy iOS 9.0+	integer	If `1`, enables Perfect Forward Secrecy (PFS) for IKEv2 Connections.	Default: 0	Range: 0, 1
`EnableCertificateRevocationCheck`integer Enable certificate revocation check iOS 9.0+	integer	If `1`, the system performs a certificate revocation check for IKEv2 connections. This is a best-effort revocation check and server response timeouts won't cause it to fail.	Default: 0	Range: 0, 1
`EnableFallback`integer Enable fallback iOS 13.0+ · not on macOS, watchOS	integer	If `1`, the system enables a tunnel over cellular data to carry traffic that's eligible for Wi-Fi Assist and also requires VPN. Enabling fallback requires that the server support multiple tunnels for a single user. Not available in watchOS.	Default: 0	Range: 0, 1
`MTU`integer Maximum transmission unit iOS 14.0+ · macOS 11.0+	integer	The Maximum Transmission Unit (MTU) specifies the maximum size in bytes of each packet that the system sends over the IKEv2 VPN interface.	Default: 1280	Range: 1280 – 1400
`ProviderType`string	string	If the value of this key is `app-proxy`, the VPN service tunnels traffic at the application layer. If the value of this key is `packet-tunnel`, the VPN service tunnels traffic at the IP layer.	Default: "packet-tunnel"	Range: packet-tunnel, app-proxy
`IncludeAllNetworks`integer Include all networks iOS 14.0+ · macOS 10.15+ · not on tvOS, watchOS	integer	If `1`, then the system routes all network traffic through the VPN, with some controllable exclusions, such as `ExcludeLocalNetworks`, `ExcludeCellularServices`, and `ExcludeAPNs` properties. The system always excludes the following traffic from the tunnel: - Traffic necessary for connecting and maintaining the device's network connection, such as DHCP. - Traffic necessary for connecting to captive networks. - Certain cellular services traffic that's not routable over the internet and is instead directly routed to the cellular network. See the `ExcludeCellularServices` field for more information. - Network communication with a companion device such as a watchOS device.	Default: 0	Range: 0, 1
`EnforceRoutes`integer Enforce routes iOS 14.2+ · macOS 11.0+ · not on watchOS	integer	If `1`, all the VPN's non-default routes take precedence over any locally-defined routes. If `IncludeAllNetworks` is `1`, the system ignores `EnforceRoutes`.	Default: 0	Range: 0, 1
`ExcludeLocalNetworks`integer Exclude local networks iOS 14.2+ · macOS 10.15+ · not on tvOS, watchOS	integer	If `1` and either `IncludeAllNetworks` or `EnforceRoutes` are `1`, then the system routes local network traffic outside of the VPN. The default for this value is `0` on macOS and `1` on iOS.	Default: —	Range: 0, 1
`ExcludeCellularServices`integer Exclude cellular services iOS 16.4+ · macOS 13.3+ · not on tvOS, watchOS	integer	If `1` and `IncludeAllNetworks` is `1`, the system excludes internet-routable network traffic for cellular services (VoLTE, Wi-Fi Calling, IMS, MMS, Visual Voicemail, etc.) from the tunnel. Note that some cellular carriers route cellular services traffic directly to the carrier network, bypassing the internet. Such cellular services traffic is always excluded from the tunnel.	Default: 1	Range: 0, 1
`ExcludeAPNs`integer Exclude APNs iOS 16.4+ · macOS 13.3+ · not on tvOS, watchOS	integer	If `1` and `IncludeAllNetworks` is `1`, the system excludes network traffic for the Apple Push Notification service (APNs) from the tunnel.	Default: 1	Range: 0, 1
`ExcludeDeviceCommunication`integer Exclude device communication iOS 17.4+ · macOS 14.4+ · visionOS 1.1+ · not on tvOS, watchOS	integer	If set to `1` and `IncludeAllNetworks` is set to `1`, the device excludes network traffic used for communicating with devices connected via USB or Wi-Fi from the tunnel.	Default: 1	Range: 0, 1
`PPK`data Post-quantum pre-shared key iOS 18.0+ · macOS 15.0+ · tvOS 18.0+ · watchOS 11.0+ · visionOS 2.0+	data	The Post-quantum Pre-shared key (PPK) the device uses for this VPN. This key is is used with VPN servers that support RFC 8784. If this key is present `PPKIdentifier` must also be present.	Default: —	Range: —
`PPKIdentifier`string Post-quantum pre-shared key identifier iOS 18.0+ · macOS 15.0+ · tvOS 18.0+ · watchOS 11.0+ · visionOS 2.0+	string	The identifier for the Post-quantum Pre-shared key (PPK) the device uses for this VPN. This key is is used with VPN servers that support RFC 8784. If this key is present `PPK` must also be present.	Default: —	Range: —
`PPKMandatory`integer Post-quantum pre-shared key mandatory iOS 18.0+ · macOS 15.0+ · tvOS 18.0+ · watchOS 11.0+ · visionOS 2.0+	integer	If set to `1`, the VPN doesn't establish a connection if the server doesn't support RFC 8784 or doesn't accept the PPK identifier specified in `PPKIdentifier`. The device ignores this key if `PPK` and `PPKIdentifier` aren't present.	Default: 1	Range: 0, 1
`AllowPostQuantumKeyExchangeFallback`integer Allow post-quantum key exchange fallback iOS 26.0+ · macOS 26.0+ · tvOS 26.0+ · watchOS 26.0+ · visionOS 26.0+	integer	If set to `0`, the VPN doesn't establish a connection if the server does not support or doesn't allow post-quantum key exchanges. Thd device ignores this key if `PostQuantumKeyExchangeMethods` isn't present in `IKESecurityAssociationParameters` or `ChildSecurityAssociationParameters`.	Default: 0	Range: 0, 1
`EnforceStrictAlgorithmSelection`integer Enforce strict algorithm selection iOS 18.5+ · macOS 15.5+ · tvOS 18.5+ · watchOS 11.5+ · visionOS 2.5+	integer	If set to `1`, the device doesn't allow DES, 3DES, and Diffie-Hellman groups less than 14. Also the device requires the encryption algorithm specified for the IKE SA to be at least as cryptographically strong as the algorithm specified for the child SA. The device rejects this profile payload if these requirements aren't met.	Default: 0	Range: 0, 1
`IKESecurityAssociationParameters`dict IKESecurityAssociationParameters	dict	These parameters apply to Child Security Association unless `ChildSecurityAssociationParameters` is specified.	Default: —	Range: —
`EncryptionAlgorithm`string EncryptionAlgorithm	string	The encryption algorithm. In watchOS and tvOS, the default value is `AES-256-GCM`. `DES` and `3DES` are available only in iOS, macOS, and visionOS prior to iOS 26, macOS 26, and visionOS 26.	Default: "AES-256"	Range: DES, 3DES, AES-128, AES-256, AES-128-GCM, AES-256-GCM, ChaCha20Poly1305
`IntegrityAlgorithm`string IntegrityAlgorithm	string	The integrity algorithm. `SHA1-96` and `SHA1-160` are available only in iOS, macOS, and visionOS prior to iOS 26, macOS 26, and visionOS 26.	Default: "SHA2-256"	Range: SHA1-96, SHA1-160, SHA2-256, SHA2-384, SHA2-512
`DiffieHellmanGroup`integer DiffieHellmanGroup	integer	The Diffie-Hellman group. For `AlwaysOn` VPN in iOS 14.2 and later, the minimum allowed value is `14`. `1`, `2`, and `5` are available only in iOS, macOS, and visionOS prior to iOS 26, macOS 26, and visionOS 26.	Default: 14	Range: 1, 2, 5, 14, 15, 16, 17, 18, 19, 20, 21, 31, 32
`PostQuantumKeyExchangeMethods`array Post-quantum key exchange methods iOS 26.0+ · macOS 26.0+ · tvOS 16.0+ · watchOS 26.0+ · visionOS 26.0+	array	An array of integers representing postquantum key exchange methods the device uses during SA establishment and rekey. You can specify up to seven items, which correspond to ADDKE1 - ADDKE7 from RFC 9370.	Default: —	Range: —
`PostQuantumKeyExchangeMethod`integer Post-quantum key exchange method	integer	—	Default: —	Range: 0, 36, 37
`LifeTimeInMinutes`integer LifeTimeInMinutes	integer	The SA lifetime (rekey interval) in minutes.	Default: 1440	Range: 10 – 1440
`ChildSecurityAssociationParameters`dict ChildSecurityAssociationParameters	dict	The `ChildSecurityAssociationParameters` dictionaries.	Default: —	Range: —
`EncryptionAlgorithm`string EncryptionAlgorithm	string	The encryption algorithm. In watchOS and tvOS, the default value is `AES-256-GCM`. `DES` and `3DES` are available only in iOS, macOS, and visionOS prior to iOS 26, macOS 26, and visionOS 26.	Default: "AES-256"	Range: DES, 3DES, AES-128, AES-256, AES-128-GCM, AES-256-GCM, ChaCha20Poly1305
`IntegrityAlgorithm`string IntegrityAlgorithm	string	The integrity algorithm. `SHA1-96` and `SHA1-160` are available only in iOS, macOS, and visionOS prior to iOS 26, macOS 26, and visionOS 26.	Default: "SHA2-256"	Range: SHA1-96, SHA1-160, SHA2-256, SHA2-384, SHA2-512
`DiffieHellmanGroup`integer DiffieHellmanGroup	integer	The Diffie-Hellman group. For `AlwaysOn` VPN in iOS 14.2 and later, the minimum allowed value is `14`. `1`, `2`, and `5` are available only in iOS, macOS, and visionOS prior to iOS 26, macOS 26, and visionOS 26.	Default: 14	Range: 1, 2, 5, 14, 15, 16, 17, 18, 19, 20, 21, 31, 32
`PostQuantumKeyExchangeMethods`array Post-quantum key exchange methods iOS 26.0+ · macOS 26.0+ · tvOS 16.0+ · watchOS 26.0+ · visionOS 26.0+	array	An array of integers representing postquantum key exchange methods the device uses during SA establishment and rekey. You can specify up to seven items, which correspond to ADDKE1 - ADDKE7 from RFC 9370.	Default: —	Range: —
`PostQuantumKeyExchangeMethod`integer Post-quantum key exchange method	integer	—	Default: —	Range: 0, 36, 37
`LifeTimeInMinutes`integer LifeTimeInMinutes	integer	The SA lifetime (rekey interval) in minutes.	Default: 1440	Range: 10 – 1440
`DNS`dict DNS watchOS 10.0+	dict	A dictionary to use for all VPN types.	Default: —	Range: —
`DNSProtocol`string DNS protocol iOS 14.0+ · macOS 11.0+ required	string	The transport protocol to communicate with the DNS server.	Default: —	Range: Cleartext, HTTPS, TLS
`ServerURL`string Server URL iOS 14.0+ · macOS 11.0+	string	The URI template of a DNS-over-HTTPS server, as defined in RFC 8484, which needs to use the `https://` scheme. The system uses the hostname or address in the URL to validate the server certificate. If `ServerAddresses` isn't specified, the system uses the hostname or address in the URL to determine the server addresses. This key is required if the `DNSProtocol` is `HTTPS`.	Default: —	Range: —
`ServerName`string Server name iOS 14.0+ · macOS 11.0+	string	The hostname of a DNS-over-TLS server to validate the server certificate, as defined in RFC 7858. If `ServerAddresses` isn't specified, the system uses the hostname to determine the server addresses. This key is required if the `DNSProtocol` is `TLS`.	Default: —	Range: —
`ServerAddresses`array DNS server addresses iOS 10.0+ · macOS 10.12+ required	array	The array of DNS server IP address strings. These IP addresses can be a mixture of IPv4 and IPv6 addresses.	Default: —	Range: —
`ServerAddressesElement`string Server address element	string	—	Default: —	Range: —
`SearchDomains`array DNS search domains iOS 10.0+ · macOS 10.12+	array	The list of domain strings used to fully qualify single-label host names.	Default: —	Range: —
`SearchDomainsElement`string Search domains element	string	—	Default: —	Range: —
`DomainName`string Domain name iOS 10.0+ · macOS 10.12+	string	The primary domain of the tunnel.	Default: —	Range: —
`SupplementalMatchDomains`array Supplemental match domains iOS 10.0+ · macOS 10.12+	array	The list of domain strings used to determine which DNS queries use the DNS resolver settings in `ServerAddresses`. The system uses this key to create a split DNS configuration where it resolves only hosts in certain domains using the tunnel's DNS resolver. The system uses the default resolver for hosts that aren't in one of the domains in this list. If `SupplementalMatchDomains` contains the empty string it becomes the default domain. Split-tunnel configurations can direct all DNS queries to the VPN DNS servers before the primary DNS servers. If the VPN tunnel becomes the network's default route, the servers listed in `ServerAddresses` become the default resolver and the system ignores the `SupplementalMatchDomains` list.	Default: —	Range: —
`SupplementalMatchDomainsElement`string Supplemental match domains element	string	—	Default: —	Range: —
`SupplementalMatchDomainsNoSearch`integer Supplemental match domains no search iOS 10.0+ · macOS 10.12+	integer	If `0`, append the domains in the `SupplementalMatchDomains` list to the resolver's list of search domains.	Default: 0	Range: 0, 1
`PayloadCertificateUUID`string DNS certificate UUID iOS 16.0+ · macOS 13.0+	string	That UUID that points to an identity certificate payload. The system uses this identity to authenticate the user to the DNS resolver.	Default: —	Range: —
`Proxies`dict Proxies watchOS 10.0+	dict	The dictionary to use to configure `Proxies` for use with `VPN`.	Default: —	Range: —
`ProxyAutoConfigEnable`integer Proxy AutoConfig enable	integer	If `true`, enables automatic proxy configuration.	Default: —	Range: 0, 1
`ProxyAutoDiscoveryEnable`integer Proxy auto discovery enable	integer	If `true`, enables proxy auto discovery.	Default: 1	Range: 0, 1
`ProxyAutoConfigURLString`string Proxy server URL	string	The URL to the location of the proxy auto-configuration file. Used only when `ProxyAutoConfigEnable` is `true`.	Default: —	Range: —
`SupplementalMatchDomains`array Supplemental match domains	array	An array of domains that defines which hosts use proxy settings for hosts.	Default: —	Range: —
`SupplementalMatchDomainsElement`string Supplemental match domains element	string	—	Default: —	Range: —
`HTTPEnable`integer Enable HTTP	integer	If `1`, enables proxy for HTTP traffic.	Default: 0	Range: 0, 1
`HTTPProxy`string HTTP proxy	string	The host name of the HTTP proxy.	Default: —	Range: —
`HTTPPort`integer HTTP port	integer	The port number of the HTTP proxy. This field is required if `HTTPProxy` is specified.	Default: —	Range: 0 – 65535
`HTTPProxyUsername`string HTTP ProxyUsername	string	The user name used for authentication.	Default: —	Range: —
`HTTPProxyPassword`string HTTP ProxyPassword	string	The password used for authentication.	Default: —	Range: —
`HTTPSEnable`integer Enable HTTPS	integer	If `true`, enables proxy for HTTPS traffic.	Default: 0	Range: 0, 1
`HTTPSProxy`string HTTPS proxy	string	The host name of the HTTPS proxy.	Default: —	Range: —
`HTTPSPort`integer HTTPS port	integer	The port number of the HTTPS proxy. This field is required if `HTTPSProxy` is specified.	Default: —	Range: 0 – 65535
`AlwaysOn`dict AlwaysOn iOS 8.0+ · not on macOS, tvOS	dict	The dictionary to use when `VPNType` is `AlwaysOn`. Not available in tvOS or watchOS.	Default: —	Range: —
`UIToggleEnabled`integer UI toggle enabled	integer	If `1`, allows the user to disable the VPN configuration.	Default: 0	Range: 0, 1
`TunnelConfigurations`array TunnelConfigurations required	array	An array that contains an arbitrary number of tunnel configurations.	Default: —	Range: —
`TunnelConfigurationElement`dict A TunnelConfiguration element	dict	—	Default: —	Range: —
`ProtocolType`string Protocol type required	string	The type of connection, which needs to be `IKEv2`.	Default: —	Range: IKEv2
`Interfaces`array Interfaces	array	The interfaces to apply this configuration to.	Default: —	Range: —
`InterfacesElement`string Interfaces element	string	—	Default: —	Range: Cellular, WiFi
`ServiceExceptions`array ServiceExceptions	array	An array that contains an arbitrary number of service exceptions.	Default: —	Range: —
`ServiceExceptionElement`dict A ServiceException element	dict	—	Default: —	Range: —
`ServiceName`string Service name required	string	The name of a service that's exempt from Always On VPN. `CellularServices` is available in iOS 11.3 and later; it exempts `VoLTE`, `IMS` and `MMS`. Always On VPN exempts WiFiCalling in iOS 13.4 and later. `DeviceCommunication` is available in iOS 17.4 and later; it exempts network traffic used for communicating with devices connected via USB or Wi-Fi.	Default: —	Range: VoiceMail, AirPrint, CellularServices, DeviceCommunication
`Action`string Action required	string	The action to take with network connections from the named service.	Default: —	Range: Allow, Drop
`ApplicationExceptions`array ApplicationExceptions iOS 13.6+	array	An array that contains an arbitrary number of apps whose connections occur outside the VPN.	Default: —	Range: —
`ApplicationExceptionElement`dict A ApplicationException element	dict	—	Default: —	Range: —
`BundleIdentifier`string Bundle identifier required	string	The app's bundle identifier.	Default: —	Range: —
`LimitToProtocols`array LimitToProtocols	array	Limit the exception to only the specified list of protocols, with support for `UDP` only.	Default: —	Range: —
`LimitToProtocolElement`string LimitToProtocol element	string	—	Default: —	Range: UDP
`AllowCaptiveWebSheet`integer Allow captive web sheet	integer	If `1`, allows traffic from Captive Web Sheet outside the VPN tunnel.	Default: 0	Range: 0, 1
`AllowAllCaptiveNetworkPlugins`integer Allow all captive network plugins	integer	If `1`, allows traffic from all captive networking apps outside the VPN tunnel to perform captive network handling.	Default: 0	Range: 0, 1
`AllowedCaptiveNetworkPlugins`array AllowedCaptiveNetworkPlugins	array	The array of captive networking apps whose traffic is allowed outside the VPN tunnel, to perform captive network handling. Used only when `AllowAllCaptiveNetworkPlugins` is `false`.	Default: —	Range: —
`AllowedCaptiveNetworkPluginElement`dict An AllowedCaptiveNetworkPlugin element	dict	—	Default: —	Range: —
`BundleIdentifier`string Bundle identifier required	string	The bundle identifier for the app that's allowed on the captive network.	Default: —	Range: —
`TransparentProxy`dict TransparentProxy macOS 14.0+ · not on iOS, tvOS, visionOS	dict	The dictionary to use when `VPNType` is `TransparentProxy`.	Default: —	Range: —
`AuthenticationMethod`string Authentication method	string	The type of authentication method to use: `Password`, `Certificate`, or `Password+Certificate`.	Default: "Password"	Range: Password, Certificate, Password+Certificate
`DisconnectOnIdle`integer Enable disconnect on idle	integer	If `1`, the VPN disconnects automatically disconnect after a period defined by `DisconnectOnIdleTimer`.	Default: 0	Range: 0, 1
`DisconnectOnIdleTimer`integer Disconnect on idle time	integer	The number of seconds before the VPN disconnects. This value is only used if `DisconnectOnIdle` is `1`.	Default: —	Range: —
`EnforceRoutes`integer Enforce routes	integer	If `1`, then all the VPN's non-default routes take precedence over any locally-defined routes. If `IncludeAllNetworks` is `1`, the system ignores the value of `EnforceRoutes`.	Default: 0	Range: 0, 1
`OnDemandEnabled`integer Enable VPN on demand	integer	If `1`, the system brings up the VPN on demand.	Default: 0	Range: 0, 1
`OnDemandRules`array On demand rules	array	Determines when and how the system uses an OnDemand VPN.	Default: —	Range: —
`OnDemandRulesElement`dict On demand rules element	dict	—	Default: —	Range: —
`Action`string On demand action required	string	The action to take if this dictionary matches the current network. Possible values are: - `Allow`: Deprecated. Allow VPN On Demand to connect if triggered. - `Connect`: Unconditionally initiate a VPN connection on the next network attempt. - `Disconnect`: Tear down the VPN connection and don't reconnect on demand as long as this dictionary matches. - `EvaluateConnection`: Evaluate the ActionParameters array for each connection attempt. - `Ignore`: Leave any existing VPN connection up, but don't reconnect on demand as long as this dictionary matches. Only the `Disconnect` action is available on watchOS 10 and later.	Default: —	Range: Allow, Connect, Disconnect, EvaluateConnection, Ignore
`ActionParameters`array Action parameters	array	An array of dictionaries that provides rules similar to the `OnDemandRules` dictionary, but evaluated on each connection instead of when the network changes. This value is only for use with dictionaries in which the `Action` value is `EvaluateConnection`. The system evaluates these dictionaries in order and the first dictionary that matches determines the behavior. Not available in watchOS.	Default: —	Range: —
`ActionParameter`dict Action parameter	dict	A dictionary that provides rules similar to the OnDemandRules dictionary, but evaluated on each connection instead of when the network changes. These dictionaries are evaluated in order, and the behavior is determined by the first dictionary that matches. The keys allowed in each dictionary are described below. Note: This array is used only for dictionaries in which EvaluateConnection is the Action value.	Default: —	Range: —
`Domains`array Domains required	array	The domains to apply this evaluation.	Default: —	Range: —
`DomainsElement`string Domains element	string	—	Default: —	Range: —
`DomainAction`string Domain action required	string	Defines the VPN behavior for the specified domains. Allowed values are: * 'ConnectIfNeeded': The specified domains should trigger a VPN connection attempt if domain name resolution fails, such as when the DNS server indicates that it can't resolve the domain, responds with a redirection to a different server, or fails to respond (timeout). * 'NeverConnect': The specified domains should never trigger a VPN connection attempt.	Default: —	Range: ConnectIfNeeded, NeverConnect
`RequiredDNSServers`array Required DNS servers	array	An array of IP addresses of DNS servers to use for resolving the specified domains. These servers don't need to be part of the device's current network configuration. If these DNS servers aren't reachable, the system establishes a VPN connection. These DNS servers need to be either internal DNS servers or trusted external DNS servers. This key is valid only if the value of 'DomainAction' is 'ConnectIfNeeded'.	Default: —	Range: —
`RequiredDNSServersElement`string Required DNS servers element	string	—	Default: —	Range: —
`RequiredURLStringProbe`string Required URL string probe	string	An HTTP or HTTPS (preferred) URL to probe, using a GET request. If the URL's hostname can't be resolved, if the server is unreachable, or if the server doesn't respond with a 200 HTTP status code, the device establishes a VPN connection in response. This key is valid only if the value of 'DomainAction' is 'ConnectIfNeeded'.	Default: —	Range: —
`DNSDomainMatch`array DNS domain match	array	An array of domain names. This rule matches if any of the domain names in the specified list matches any domain in the device's search domains list. The system supports a wildcard (`\`) prefix. For example, `\.example.com` matches against either `mydomain.example.com` or `yourdomain.example.com`.	Default: —	Range: —
`DNSDomainMatchElement`string DNS domain match element	string	—	Default: —	Range: —
`DNSServerAddressMatch`array DNS server address match	array	An array of IP addresses. This rule matches if any of the network's specified DNS servers match any entry in the array. The system supports matching with a single wildcard. For example, `17.\*` matches any DNS server in the `17.0.0.0/8` subnet.	Default: —	Range: —
`DNSServerAddressMatchElement`string DNS server address match element	string	—	Default: —	Range: —
`InterfaceTypeMatch`string Interface type match	string	An interface type. If specified, this rule matches only if the primary network interface hardware matches the specified type.	Default: —	Range: Ethernet, WiFi, Cellular
`SSIDMatch`array SSID match	array	An array of SSIDs to match against the current network. If the network isn't a Wi-Fi network or if the SSID doesn't appear in this array, the match fails. Omit this key and the corresponding array to match against any SSID.	Default: —	Range: —
`SSIDMatchElement`string SSID match element	string	—	Default: —	Range: —
`URLStringProbe`string URL string probe	string	A URL to probe. This rule matches when this URL is successfully fetched (returns a `200` HTTP status code) without redirection. Not available in watchOS.	Default: —	Range: —
`PayloadCertificateUUID`string PayloadCertificateUUID	string	The UUID of the identity certificate as the account credential. If `AuthenticationMethod` is `Certificate`, and extended authentication (EAP) isn't used, the device sends this certificate for IKE client authentication. If extended authentication is used, this certificate can be used for EAP-TLS.	Default: —	Range: —
`Password`string Account password	string	The password to use for the account credentials. Only used if `AuthenticationMethod` is `Password`.	Default: —	Range: —
`ProviderBundleIdentifier`string Provider bundle identifier	string	If the VPNSubType field contains the bundle identifier of an app that contains multiple VPN providers of the same type (app-proxy or packet-tunnel), then the system uses this field to choose which provider to use for this configuration. If the VPN provider uses a system extension, then this field is required.	Default: —	Range: —
`ProviderDesignatedRequirement`string Provider designated requirement	string	If the VPN provider uses a system extension, then this field is required.	Default: —	Range: —
`ProviderType`string	string	If the value of this key is `app-proxy`, the VPN service tunnels traffic at the application layer. If the value of this key is `packet-tunnel`, the VPN service tunnels traffic at the IP layer.	Default: "packet-tunnel"	Range: packet-tunnel, app-proxy
`Order`integer Order	integer	A positive integer.	Default: —	Range: —