<!--
{
  "availability" : [
    "iOS: 27.0.0 -",
    "iPadOS: 27.0.0 -",
    "macCatalyst: 27.0.0 -",
    "macOS: 27.0.0 -",
    "tvOS: 27.0.0 -",
    "visionOS: 27.0.0 -"
  ],
  "documentType" : "symbol",
  "framework" : "DeviceManagement",
  "identifier" : "/documentation/DeviceManagement/NetworkVPNIKEV2",
  "metadataVersion" : "0.1.0",
  "role" : "Object",
  "symbol" : {
    "kind" : "Object",
    "modules" : [
      "Device Management"
    ],
    "preciseIdentifier" : "rmdm-declarations:NetworkVPNIKEV2"
  },
  "title" : "NetworkVPNIKEV2"
}
-->

# NetworkVPNIKEV2

The declaration to configure a VPN using the IKEv2 sub-type.

```
object NetworkVPNIKEV2
```

## Discussion

Specify `com.apple.configuration.network.vpn.ikev2` as the declaration type.

### Configuration availability

|||
|--------------------------------|----------------------------------------------|
|Allowed in supervised enrollment|iOS, macOS, Shared iPad, tvOS, visionOS       |
|Allowed in device enrollment    |iOS, Shared iPad, tvOS, visionOS              |
|Allowed in user enrollment      |N/A                                           |
|Allowed in local enrollment     |iOS, macOS, Shared iPad, tvOS, visionOS       |
|Allowed in system scope         |iOS, macOS, Shared iPad, tvOS, visionOS       |
|Allowed in user scope           |macOS                                         |
|Apply                           |Multiple configurations are applied separately|

### Configuration examples

**Shared secret:**

This configuration sets up an IKEv2 VPN using a shared-secret credential asset for authentication.

```json
{
    "Type": "com.apple.configuration.network.vpn.ikev2",
    "Identifier": "EB13EE2B-5D63-4EBA-810F-5B81D07F5017",
    "ServerToken": "E180CA9A-F089-4FA3-BBDF-94CC159C4AE8",
    "Payload": {
        "VisibleName": "Corporate IKEv2 VPN",
        "HostName": "vpn.example.com",
        "LocalIdentifier": "device@example.com",
        "RemoteIdentifier": "vpn.example.com",
        "Authentication": {
            "Method": "SharedSecret",
            "CredentialsAssetReference": "64BF8F5C-8CFD-40AA-9082-A0B594D4E100"
        }
    }
}
```

**Certificate:**

This configuration sets up an IKEv2 VPN using certificate-based machine authentication and EAP-MSCHAPv2 for extended user authentication.

```json
{
    "Type": "com.apple.configuration.network.vpn.ikev2",
    "Identifier": "2A3B4C5D-6E7F-8A9B-0C1D-2E3F4A5B6C7D",
    "ServerToken": "F1E2D3C4-B5A6-7890-ABCD-EF1234567890",
    "Payload": {
        "VisibleName": "Corporate IKEv2 VPN (Certificate)",
        "HostName": "vpn.example.com",
        "LocalIdentifier": "device@example.com",
        "RemoteIdentifier": "vpn.example.com",
        "Authentication": {
            "Method": "Certificate",
            "IdentityAssetReference": "CB3E6C7F-2318-437B-8A9E-D50C69376DE4",
            "IdentityCertificateType": "RSA",
            "ExtendedAuth": {
                "Enabled": true,
                "CredentialsAssetReference": "64BF8F5C-8CFD-40AA-9082-A0B594D4E100",
                "ServerCertificateIssuerCommonName": "Example Corp CA",
                "TLSMinimumVersion": "1.2"
            }
        }
    }
}
```

## Topics

### Objects

[`NetworkVPNIKEV2AuthenticationObject`](/documentation/DeviceManagement/NetworkVPNIKEV2AuthenticationObject)

Settings that control authentication.

[`NetworkVPNIKEV2DNSObject`](/documentation/DeviceManagement/NetworkVPNIKEV2DNSObject)

A dictionary to use for all VPN types.

[`NetworkVPNIKEV2IdleObject`](/documentation/DeviceManagement/NetworkVPNIKEV2IdleObject)

Specifies details about how the system handles idle VPN connections.

[`NetworkVPNIKEV2NetworkRoutingObject`](/documentation/DeviceManagement/NetworkVPNIKEV2NetworkRoutingObject)

Specifies details about how the VPN routes different types of network traffic.

[`NetworkVPNIKEV2OnDemandObject`](/documentation/DeviceManagement/NetworkVPNIKEV2OnDemandObject)

Specifies details about how the system controls on-demand VPN.

[`NetworkVPNIKEV2PostQuantumKeyExchangeObject`](/documentation/DeviceManagement/NetworkVPNIKEV2PostQuantumKeyExchangeObject)

Post Quantum Key Exchange settings.

[`NetworkVPNIKEV2ProviderObject`](/documentation/DeviceManagement/NetworkVPNIKEV2ProviderObject)

Specifies details about the provider.

[`NetworkVPNIKEV2ProxiesObject`](/documentation/DeviceManagement/NetworkVPNIKEV2ProxiesObject)

The dictionary to use to configure `Proxies` for use with `VPN`.

[`NetworkVPNIKEV2SecurityAssociationParametersObject`](/documentation/DeviceManagement/NetworkVPNIKEV2SecurityAssociationParametersObject)

These parameters apply to Child Security Association unless `ChildSecurityAssociationParameters` is specified.


---

Copyright &copy; 2026 Apple Inc. All rights reserved. | [Terms of Use](https://www.apple.com/legal/internet-services/terms/site.html) | [Privacy Policy](https://www.apple.com/privacy/privacy-policy)