Virtual Private Network(VPN)
A Virtual Private Network(VPN) as the name suggests establishes a logical private tunnel on the Internet, to ensure only authorized users can access confidential web resources of the organization, from any network. VPN ensures all the device-web resource communication happens on a secure channel preventing any kind of unauthorized access. VPN also boosts productivity as it ensures employees can work from anywhere, without worrying about lack of access to specific resource/data. With mobile devices extensively becoming a part of corporate productivity, it has become mandatory for IT admins to configure on VPN on mobile devices, which can be easily and efficiently done using MDM.
VPN profiles applied to devices provisioned as Profile Owner will ensure only the traffic from the apps distributed using MDM is routed through the VPN. VPN will not be applied to the apps outside the container.
Supported VPN types
The following VPN types are supported by MDM:
| VPN TYPE | KNOX-ENABLED SAMSUNG | NON-SAMSUNG | ADDITIONAL REQUIREMENT(S), IF ANY | ||
|---|---|---|---|---|---|
| LEGACY | PROFILE OWNER | DEVICE OWNER | |||
| PPTP | Supported from Android 4.3 |  |
|
|
None |
| L2TP PSK | Supported from Android 4.3 | |
|
|
None |
| IPSec XAuth PSK | Supported from Android 4.3 | |
|
|
None |
| IPSec IKEv2 PSK | Supported from Android 4.3 | |
|
|
None |
| Cisco AnyConnect | Supported from Android 6.0/Knox version 5.7 or more | |
 |
|
Cisco AnyConnect app must be installed on the device. Automate installation of this app |
| F5 SSL | Supported from Android 6.0/Knox version 5.7 or more | |
|
|
F5 Access app must be installed on the device. Automate installation of this app |
| Pulse Secure | Supported from Android 6.0/Knox version 5.7 or more | |
|
|
Pulse Secure app must be installed on the device. Automate installation of this app |
| Palo Alto | Supported from Android 6.0/Knox version 5.7 or more | |
|
|
Palo Alto app must be installed on the device. Automate installation of this app |
In addition to the plug in VPNs supported by default, you can also configure the following plug in VPNs
| VPN TYPE | KNOX-ENABLED SAMSUNG | NON-SAMSUNG |
|---|---|---|
| FortiClient IPSEC | |
|
| Barracuda/ CudaLaunch VPN | |
|
| KerioControl VPN | |
|
| Sonicwall NETExtender | |
|
Note: If you need support for other VPNs, you can raise your request here.
Profile Details
To configure a VPN policy, you need to configure certain common parameters and parameters specific to a VPN type. To know the parameters to be configured for a particular VPN type, click on the VPN type name from the tabs given
| Profile Specification | Description |
|---|---|
| COMMON PARAMETERS | |
| Connection Name | Specify the name, which needs to be displayed as the VPN name on the end user's mobile device |
| Connection Type | The VPN type, to be provisioned on the device |
| Server Name / IP Address | Host name or IP address of the VPN server |
| PPTP-SPECIFIC PARAMETERS | |
| User Name | The user to whom this VPN configuration is to be applied. Using the dynamic variable %username% fetches the user name from the enrollment details |
| Password | Specify the password to be used for authentication |
| Allow new addition of VPNs | Specify the additional VPNs can be configiured or not |
| Allow modification of configured VPNs | Specify whether the configured VPNs can be modified by device users or not |
| Profile Specification |
Description |
|---|---|
| COMMON PARAMETERS | |
| Connection Name | Specify the name, which needs to be displayed as the VPN name on the end user's mobile device |
| Connection Type | The VPN type, to be provisioned on the device |
| Server Name / IP Address | Host name or IP address of the VPN server |
| L2TP-SPECIFIC PARAMETERS | |
| User Name | The user to whom this VPN configuration is to be applied. Using the dynamic variable %username% fetches the user name from the enrollment details |
| Password | Specify the password to be used for authentication |
| Shared secret | Specify the pre-shared secret |
| Secret Key | Specify whether L2TP secret key is to be enabled or not. |
| L2TP Secret Key | Specify the L2TP secret key. |
| Allow new addition of VPNs | Specify the additional VPNs can be configiured or not |
| Allow modification of configured VPNs | Specify whether the configured VPNs can be modified by device users or not |
| Profile Specification | Description |
|---|---|
| COMMON PARAMETERS | |
| Connection Name | Specify the name, which needs to be displayed as the VPN name on the end user's mobile device |
| Connection Type | The VPN type, to be provisioned on the device |
| Server Name / IP Address | Host name or IP address of the VPN server |
| IPSec XAuth-SPECIFIC PARAMETERS | |
| User Name | The user to whom this VPN configuration is to be applied. Using the dynamic variable %username% fetches the user name from the enrollment details |
| Password | Specify the password to be used for authentication |
| Shared secret | Specify the pre-shared secret |
| Allow new addition of VPNs | Specify the additional VPNs can be configiured or not |
| Allow modification of configured VPNs | Specify whether the configured VPNs can be modified by device users or not |
| IPSec Identifier | Name of the group on the VPN server, to which the user is assigned. |
| Profile Specification | Description |
|---|---|
| COMMON PARAMETERS | |
| Connection Name | Specify the name, which needs to be displayed as the VPN name on the end user's mobile device |
| Connection Type | The VPN type, to be provisioned on the device |
| Server Name / IP Address | Host name or IP address of the VPN server |
| IPSec IKEv2-SPECIFIC PARAMETERS | |
| User Name | The user to whom this VPN configuration is to be applied. Using the dynamic variable %username% fetches the user name from the enrollment details |
| Password | Specify the password to be used for authentication |
| Shared secret | Specify the pre-shared secret |
| Allow new addition of VPNs | Specify the additional VPNs can be configiured or not |
| Allow modification of configured VPNs | Specify whether the configured VPNs can be modified by device users or not |
| IPSec Identifier | Name of the group on the VPN server, to which the user is assigned. |
| Profile Specification | Description |
|---|---|
| COMMON PARAMETERS | |
| Connection Name | Specify the name, which needs to be displayed as the VPN name on the end user's mobile device |
| Connection Type | The VPN type, to be provisioned on the device |
| Server Name / IP Address | Host name or IP address of the VPN server |
| CISCO ANYCONNECT-SPECIFIC PARAMETERS | |
| Connection Protocol | Specify the protocol type to be used for establishing and/or maintaining the connection |
| Authentication Type | Specify the proctocol to govern the authentication during connection establishment |
| IKE Identity | Specify the infromation used to uniquely identify a user connection |
| FIPS mode | Specify whether the VPN connection/communication is governed by FIPS-compliant protocols. |
| Strict Mode | Specify whether Strict mode is to be enabled, for secure establishment of VPN connection |
| Allowed Apps | List of apps which can utilize this VPN connection |
| Identity Certificate | Specify the identity certificate to be used for certificate-based authentication. |
| Always On | By enabling this, force the configured VPN connection to always be on without the user having to start the configuration on every device restart. Always On can be configured only for devices provisioned as Device Owner. |
| VPN Lockdown | When the configured VPN is disconnected/unavailable, enable this to restrict access to other networks, including mobile data.VPN Lockdown can be configured only when Always On is enabled. |
| Profile Specification | Description |
|---|---|
| COMMON PARAMETERS | |
| Connection Name | Specify the name, which needs to be displayed as the VPN name on the end user's mobile device |
| Connection Type | The VPN type, to be provisioned on the device |
| Server Name / IP Address | Host name or IP address of the VPN server |
| F5 SSL-SPECIFIC PARAMETERS | |
| User Name | The user to whom this VPN configuration is to be applied. Using the dynamic variable %username% fetches the user name from the enrollment details |
| Password | Specify the password to be used for authentication |
| FIPS mode | Specify whether the VPN connection/communication is governed by FIPS-compliant protocols. |
| Allowed Apps | List of apps permitted to utilize this VPN connection |
| Identity Certificate | Specify the identity certificate to be used for certificate-based authentication. |
| Web logon mode | If enabled, it lets the device user connect to VPN through a web browser. |
| Client certificate password | Password for the client certificate, which is used for authentication. |
| Bypass Apps | List of apps which can bypass the VPN connection |
| Allow users to configure VPN | Enable/Disable configuring of VPN by users |
| Modify configured VPN | Enable/Disable modification of previously configured VPN by users |
| Restriction Message to be displayed | Specify the message shown to the users, on restriction |
| Always On | By enabling this, force the configured VPN connection to always be on without the user having to start the configuration on every device restart. Always On can be configured only for devices provisioned as Device Owner. |
| VPN Lockdown | When the configured VPN is disconnected/unavailable, enable this to restrict access to other networks, including mobile data.VPN Lockdown can be configured only when Always On is enabled. |
| Profile Specification | Description |
|---|---|
| COMMON PARAMETERS | |
| Connection Name | Specify the name, which needs to be displayed as the VPN name on the end user's mobile device |
| Connection Type | The VPN type, to be provisioned on the device |
| Server Name / IP Address | Host name or IP address of the VPN server |
| PULSE SECURE-SPECIFIC PARAMETERS | |
| User Name | The user to whom this VPN configuration is to be applied. Using the dynamic variable %username% fetches the user name from the enrollment details |
| Password | Specify the password to be used for authentication |
| Alternate user name | Specify the alternate user name, associated with the device user |
| Realm | Specify the authentication realm. An authentication realm specifies the criteria users must comply with, to use the VPN service. It is a grouping of authentication resources, including authentication server, authentication policy etc., This is usually done by the network administrators. |
| Role | Specify the user role. A user role is an entity defining user session parameters(such as session settings), personalization settings(such as bookmarks) and other enabled access features. For example, a user role may define whether or not a user can perform Web browsing. |
| Allowed Apps | List of apps permitted to utilize this VPN connection |
| Authentication Type | Specify the proctocol to govern the authentication during connection establishment |
| Action on Profile | Specify the whether the profile is to be created/deleted |
| Make this configuration default | Specify whether this profile is to be made default or not. |
| Route Type | Specify whether the VPN is to be applied to the device or to applications. |
| Machine Authentication | Enabling this automatically establishes connection on user login and the connection is maintained till the user logs off. |
| Identity Certificate | Specify the identity certificate to be used for certificate-based authentication. |
| Always On | By enabling this, force the configured VPN connection to always be on without the user having to start the configuration on every device restart. Always On can be configured only for devices provisioned as Device Owner. |
| VPN Lockdown | When the configured VPN is disconnected/unavailable, enable this to restrict access to other networks, including mobile data.VPN Lockdown can be configured only when Always On is enabled. |
| Profile Specification | Description |
|---|---|
| COMMON PARAMETERS | |
| Connection Name | Specify the name, which needs to be displayed as the VPN name on the end user's mobile device |
| Connection Type | The VPN type, to be provisioned on the device |
| Server Name / IP Address | Host name or IP address of the VPN server |
| PALO ALTO-SPECIFIC PARAMETERS | |
| User Name | The user to whom this VPN configuration is to be applied. Using the dynamic variable %username% fetches the user name from the enrollment details |
| Password | Specify the password to be used for authentication |
| Allowed Apps | List of apps permitted to utilize this VPN connection |
| Identity Certificate | Specify the identity certificate to be used for certificate-based authentication. |
| Client certificate password | Password for the client certificate, which is used for authentication. |
| Route Type | Specify whether the VPN is to be applied to the device or to applications. |
| Remove VPN profile, via restrictions | Enable/Disable restrictions removing the distributed VPN profile. |
| Always On | By enabling this, force the configured VPN connection to always be on without the user having to start the configuration on every device restart. Always On can be configured only for devices provisioned as Device Owner. |
| VPN Lockdown | When the configured VPN is disconnected/unavailable, enable this to restrict access to other networks, including mobile data.VPN Lockdown can be configured only when Always On is enabled. |
If the VPN app you want to configure is not listed in the available options, you can select the Other VPN App option. This allows you to manually choose a VPN app directly from the App Repository.
Note: Before you can associate a VPN profile with the app, make sure that:
- The VPN app is added to the App Repository.
- The app is distributed to the target devices.
- This ensures that the VPN configuration can be successfully applied and managed on the devices.
The Other VPN app connection type lets administrators configure any third-party VPN app (that is not natively supported as a built-in connection type) for managed Android devices. The selected VPN app must be available in the App Repository and distributed to the devices. The actual VPN parameters (server, authentication etc.,) are supplied to the VPN app through its App Configuration.
Third-Party Apps (Always On VPN Required)
For apps such as FortiClient VPN and Harmony MTD, to enable Always on VPN while configuring the VPN profile.
- Navigate to Device Mgmt > Profiles and create or edit an Android VPN profile.
- Under Connection Settings, provide the Connection name.
- Set Connection type to Other VPN app.
- In Choose the VPN app, select the required third-party VPN app from the App Repository.
- Enable the Always on VPN option.
- Configure Lockdown Mode based on your requirement. Enable it to block non-VPN traffic when the VPN is disconnected.
- Click Save, then Publish the profile to target devices.
Note: Always on VPN is supported only on devices provisioned as Device Owner.
| Profile Specification | Description |
|---|---|
| CONNECTION SETTINGS | |
| Connection Name | Specify the name, which needs to be displayed as the VPN name on the end user's mobile device. |
| Connection Type | Select Other VPN app as the connection type, to configure a third-party VPN app that is not listed as a built-in connection type. |
| Choose the VPN app | Specify the app name or bundle identifier of the third-party VPN app to be used. The chosen app must be available in the App Repository and distributed to the devices. The VPN-specific parameters (server, authentication, etc.,) must be supplied to the app through its App Configuration. |
| Always on VPN | By enabling this, force the configured VPN connection to always be on without the user having to start the configuration on every device restart. Always On VPN can be configured only for devices provisioned as Device Owner. |
| Lockdown Mode | When enabled, restricts access to other networks (including mobile data) whenever the configured VPN is disconnected or unavailable. Lockdown Mode can be configured only when Always on VPN is enabled. |
| Select apps to exclude from VPN Lockdown | This option is available only when VPN Lockdown is enabled. You can select the apps that should be excluded from VPN Lockdown. |
Always On VPN:
Enabling Always On VPN helps maintain a persistent connection between the managed devices and their organizational network, without the need for the users to manually connect to the VPN every time. Always On VPN can be configured only for devices provisioned as Device Owner.
When Always On VPN is enabled, the VPN connects automatically once the profile is distributed and reconnects after every device restart. However, if the end user disconnects the VPN manually from the VPN app, MDM cannot re-establish the connection, as MDM only applies the configuration to the VPN app and the disconnection behavior is handled by the VPN app itself.
Note: If you want to prevent end users from accessing other networks when the VPN is manually disconnected or unavailable, enable the VPN Lockdown option along with Always On VPN.
Identity certificate
An Identity certificate can be uploaded to secure VPN. The device must be password protected for this to function. The following VPN vendors allow securing VPN using a certificate:
- Cisco Any Connect
- F5SSL
- Pulse Secure
To configure certificate,
- Create a VPN profile.
- Select the Connection type.
- Under Authentication settings, select 'certificate based authentication' and upload the required certificate.
- If your organization needs support for any other VPN vendors, please add it here
VPN Lockdown
The VPN Lockdown feature helps ensure that your device communicates only through the configured VPN. When the VPN is disconnected or unavailable, enabling VPN Lockdown restricts access to all other networks, including mobile data, Wi-Fi, or any other internet connections. This prevents data from being transmitted outside the secure VPN tunnel, ensuring compliance and security for sensitive corporate resources. VPN Lockdown can be enabled only if Always On VPN is turned on.
Per-App VPN
With per-app VPN, admins can specify which apps should use the VPN. Multiple apps can be added within the same profile. This option is supported only for four connection types: Cisco AnyConnect, Palo Alto, F5 SSL, and Pulse Secure.
FAQ
How to enable Always on VPN for third-party apps?
Go to the Other VPN app section, choose the third-party VPN app, and enable Always on VPN in the profile.