Skip to main content
Skyhigh Security

Configure a Standard VPN for iOS

NOTE: The partner name formerly known as Airwatch is now VMware Workspace ONE UEM. So, this topic has been updated with relevant information. However, the screenshots still refer to Airwatch, which will be updated in future releases.

Log in to the VMware Workspace ONE UEM MDM Portal

Login to the admin portal of VMware Workspace ONE UEM MDM to push the VPN profile to your iPhone profile.

You will be logged in to the admin portal of VMware Workspace ONE UEM.

clipboard_e775904f764844d325759531ff2b99790.png

**Before you proceed further, please make sure to integrate your respective PKI infrastructure with VMware Workspace ONE UEM for managing your device certificate(s).
Adding a Device Certificate and server certificate in the device through MDM.

Go to DevicesProfilesAddAdd ProfileApple iOS 

Give a name to 'General' and fill up respective fields.
Select 'Deployment' type

  • Managed: To automatically download those profiles in the device.
  • Manual: To manually download this profile in the device. To download manually , user will get a notification in the 'Hub' app and clicking on this notification will redirect to messages screen of the app. From that screen user can select any of the messages and download the profiles which are available.

Now select a profile, 'Credentials' to add device certificate and server certificate to your device.You can add multiple certificates in a single profile. Click on the (+) button to add or (-) to delete.

clipboard_e5536c114c4a95ed4d3c647761ad01b02.png

Add a VPN Profile to the Device

Go to DevicesProfilesAddAdd ProfileApple iOS

Give a name to 'General' and fi ll up respective fields.

Select a profile of ' VPN' and click on 'Configure '. These are the configurations need to setup for VPN profile

Connection Info

For example, the following are the values used in Dev/QA testing:

Fields Values
Connection Name* VPN Configuration
Connection Type* IKEv2
Always On False
(Make it false, otherwise device will be in supervised mode)
Server*

c<customer ID>.smcs.skyhigh.cloud
You can get this information from the certificate page.

The following information is required to configure an SMCS app in the MDM of your choice.

VPN gateway address: c<customer ID >.smcs.skyhigh.cloud

Note: For Private Access configuration, make sure to set VPN server address to pa-vpn.mcafee-cloud.com

Local Identifier*

Client_Key1

(This string is CN (Common Name) and SAN-(Subject Alternate Name) of client certificate 

Remote Identifier*

vpn.skyhigh.cloud

(This string is CN (Common Name) and SAN-(Subject Alternate Name) of server certificate

Note: Use vpn.mcafee-cloud.com for Private Access configuration.

Machine Authentication

Certificate

(select 'certificate' here)

Credential

Certificate #1

(if there is no certificate, please follow #3.1 Step )

Server Certificate Issuer Common Name

VPN Server Root CA

(This string is CN-Common Name of server root certificate)

Note: This field is not required for Private Access configuration.

Server Certificate Common Name

vpn.skyhigh.cloud

(This string is CN-Common Name of server root certificate)

Note: This field is not required for Private Access configuration.

Enable EAP True
EAP Authentication

Certificate

(select 'certificate' here)

TLS Minimum Version iOS 11 OS Default
TLS Maximum Version iOS 11 OS Default
Credential

Certificate #1

(Select the same 'Certificate' which added in 'Credentials')

Dead Peer Detection Interval Every 10 minutes
SA Parameters
IKE2 & Child
Encryption Algorithm AES-256
Integrity Algorithm SHA2-256
Diffie Hellman Group 2
Lifetime in minutes 1440

 

clipboard_ebaae96ca0af8eb5b2212a21e5bb6da61.png

Add Your Credentials

Select 'Credentials' from the same profile. (you may have to scroll down the menu on the right)
Click on 'Configure' to add new credentials.
Add your Device certificate file here.

clipboard_e22e6dccc1633b7c3e3e7163922aeefd0.png

Save and Publish Click on 'Save and Publish' to save the profile.

Now click on 'Publish' to publish the profile.

Respective devices will get updated with the published profile.

  • Was this article helpful?