<!--
{
  "availability" : [
    "iOS: 27.0.0 -",
    "iPadOS: 27.0.0 -",
    "macCatalyst: 27.0.0 -",
    "visionOS: 27.0.0 -"
  ],
  "documentType" : "symbol",
  "framework" : "DeviceManagement",
  "identifier" : "/documentation/DeviceManagement/NetworkVPNAlwaysOn",
  "metadataVersion" : "0.1.0",
  "role" : "Object",
  "symbol" : {
    "kind" : "Object",
    "modules" : [
      "Device Management"
    ],
    "preciseIdentifier" : "rmdm-declarations:NetworkVPNAlwaysOn"
  },
  "title" : "NetworkVPNAlwaysOn"
}
-->

# NetworkVPNAlwaysOn

The declaration to configure a VPN using the Always On sub-type.

```
object NetworkVPNAlwaysOn
```

## Discussion

Specify `com.apple.configuration.network.vpn.always-on` as the declaration type.

### Configuration availability

|||
|--------------------------------|--------------------------------------|
|Allowed in supervised enrollment|iOS, Shared iPad, visionOS            |
|Allowed in device enrollment    |iOS, Shared iPad, visionOS            |
|Allowed in user enrollment      |N/A                                   |
|Allowed in local enrollment     |iOS, Shared iPad, visionOS            |
|Allowed in system scope         |iOS, Shared iPad, visionOS            |
|Allowed in user scope           |N/A                                   |
|Apply                           |Only a single configuration is applied|

### Configuration example

This configuration sets up an always-on IKEv2 VPN for both Cellular and Wi-Fi interfaces using certificate authentication.

```json
{
    "Type": "com.apple.configuration.network.vpn.always-on",
    "Identifier": "EB13EE2B-5D63-4EBA-810F-5B81D07F5017",
    "ServerToken": "E180CA9A-F089-4FA3-BBDF-94CC159C4AE8",
    "Payload": {
        "VisibleName": "Always-On VPN",
        "UIToggleEnabled": false,
        "TunnelConfigurations": [
            {
                "ProtocolType": "IKEv2",
                "Interfaces": [
                    "Cellular",
                    "WiFi"
                ],
                "IKEV2": {
                    "HostName": "vpn.example.com",
                    "LocalIdentifier": "device@example.com",
                    "RemoteIdentifier": "vpn.example.com",
                    "Authentication": {
                        "Method": "Certificate",
                        "IdentityAssetReference": "CB3E6C7F-2318-437B-8A9E-D50C69376DE4"
                    }
                }
            }
        ]
    }
}
```

## Topics

### Objects

[`NetworkVPNAlwaysOnAllowedCaptiveNetworkPluginElementObject`](/documentation/DeviceManagement/NetworkVPNAlwaysOnAllowedCaptiveNetworkPluginElementObject)

The array of captive networking apps whose traffic is allowed outside the VPN tunnel, to perform captive network handling. Used only when `AllowAllCaptiveNetworkPlugins` is `false`.

[`NetworkVPNAlwaysOnApplicationExceptionElementObject`](/documentation/DeviceManagement/NetworkVPNAlwaysOnApplicationExceptionElementObject)

An array that contains an arbitrary number of apps whose connections occur outside the VPN.

[`NetworkVPNAlwaysOnDNSObject`](/documentation/DeviceManagement/NetworkVPNAlwaysOnDNSObject)

A dictionary to use for all VPN types.

[`NetworkVPNAlwaysOnProxiesObject`](/documentation/DeviceManagement/NetworkVPNAlwaysOnProxiesObject)

The dictionary to use to configure `Proxies` for use with `VPN`.

[`NetworkVPNAlwaysOnServiceExceptionElementObject`](/documentation/DeviceManagement/NetworkVPNAlwaysOnServiceExceptionElementObject)

An array that contains an arbitrary number of service exceptions.

[`NetworkVPNAlwaysOnTunnelConfigurationElementObject`](/documentation/DeviceManagement/NetworkVPNAlwaysOnTunnelConfigurationElementObject)

An array that contains an arbitrary number of tunnel configurations.


---

Copyright &copy; 2026 Apple Inc. All rights reserved. | [Terms of Use](https://www.apple.com/legal/internet-services/terms/site.html) | [Privacy Policy](https://www.apple.com/privacy/privacy-policy)