Tunnel VPN configuration field description

The following table provides field descriptions for the Tunnel configuration. There are some variations in field names between MobileIron Core and MobileIron Cloud.

Table 1. Tunnel configuration field description

Item

Description

Name

Enter a name for the MobileIron Tunnel VPN profile.

Description

Enter a description for the profile.

Connection Type
(MobileIron Core)

Select MobileIron Tunnel.

Only fields relevant to MobileIron Tunnel are displayed.

Choose OS to create Tunnel Configuration
(MobileIron Cloud)

Select iOS/macOS.

Profile selection mode to use for this configuration
(MobileIron Cloud)

Select one of the following:

  • Sentry Profile Only: Select if Tunnel traffic goes only through Standalone Sentry only.

  • MobileIron Access Profile Only: Select if Tunnel traffic goes to Access only. Only authentication traffic is tunneled to Access. This option is available only if a MobileIron Access deployment is set up.

    NOTE: If MobileIron Access Profile Only is configured with per-app VPN packet tunnel provider type, only authentication traffic is tunneled to Access. All other traffic is dropped. If MobileIron Access Profile Only is configured with device-level VPN packet tunnel provider type, only authentication traffic is tunneled to Access. All other traffic goes directly to the destination.
  • MobileIron Sentry + Access Profile: Select if Tunnel VPN supports both traffic to Access for authentication to enterprise cloud resources and through Standalone Sentry to on-premise enterprise resources. This option is available only if a MobileIron Access as a service deployment is set up.

Legacy App Support (iOS only)

Not applicable for Tunnel for macOS.

VPN Sub Type
(MobileIron Cloud)

(Optional) Overrides the bundle identifier for a customized MobileIron Tunnel app.

Enable Access
(MobileIron Core)

This option is not supported for macOS.

Provider Type

app-proxy: This is the default setting. Use this setting for TCP tunneling only.

packet-tunnel: Select to allow Tunnel to also handle IP traffic.

NOTE: Per-device VPN automatically uses the packet-tunnel provider type.

Per-app VPN
(MobileIron Core)

The options are available if Provider Type is packet-tunnel. Otherwise, the options are grayed out. Device-level VPN is not available for app-proxy tunnel.

Yes: This is the default setting. Connectivity is established for an app, rather than the device.

No: Select to establish connectivity for the device, rather than just an app.

Sentry (Profile)

Core: Select the Standalone Sentry on which you created the TCP tunnel service.

Cloud: If you are configuring per app VPN, select the Standalone Sentry profile.

Sentry Service

Core: Select the TCP or IP service that the Safari browser or managed app will use.

Cloud: Select the Tunnel for iOS service that the Safari browser or managed app will use.
The field is not available if the profile mode is MobileIron Access Profile Only.

Only TCP services are available for selection if the provider type is app-proxy.

Only IP services are available for selection for the following:

  • The provider type is packet-tunnel.
  • The VPN is per device.

SCEP Identity

(MobileIron Cloud)

Select the Identity Certificate configuration you created for Tunnel.

The Identity Certificate is automatically selected if Sentry Profile Only or MobileIron Sentry + Access Profile is enabled.

Debug Info Recipient
(MobileIron Cloud)

Enter an email address for emailing debug logs.

Identity Certificate
(MobileIron Core)

Select the certificate setting you created.

If you are using user-provided certificates, select the user provided certificate you created for MobileIron Tunnel.

On Demand Rules (iOS 9 and later; macOS 10.13 and later) (MobileIron Core)

VPN On Demand rules are applied when the device's primary network interface changes, for example when the device switches to a different Wi-Fi network. Devices will drop the Tunnel VPN connection if an enterprise Wi-Fi is detected. If the network is not a Wi-Fi network or if its SSID does not appear in the list, the device will continue to use Tunnel VPN.

Note The Following:  

  • A matching rule is not required. The Default Rule is applied if a matching rule is not defined.
  • If you select Evaluate Connection, a matching rule is not required.
  • You can create up to 10 On Demand matching rules.
  • For each matching rule you can create up to 50 Type and Value pairs.
IMPORTANT: An Ethernet on-demand rule is only applicable to macOS devices. If the rule is pushed to iOS device, the rule may cause issues with Tunnel behavior and how traffic through Tunnel is handled. Therefore, MobileIron strongly recommends using separate Tunnel VPN configurations for iOS and macOS.

Add +

Click to add a new On Demand matching rule.

On Demand Action

Select one of the following actions to apply to the matching rule:

  • Connect
  • Disconnect

Matching Rules

For each On Demand matching rule to which the action is applied enter the type and value pair.

Add +

Click to add a new On Demand matching rule.

A dialog box appears.

Type

Select the following key type:

  • SSID

Value

Enter a list of SSIDs to match the enterprise Wi-Fi. If the network is not a Wi-Fi network or if its SSID does not appear in the list, the match will fail.

TIP: To add multiple SSIDs, create a separate SSID Type-Value pair for each SSID.

Description

Enter additional information about this matching rule.

OK

Click to add the On Demand Action and the associated Matching Rules.

Default Rule

The default rule (action) is applied to a connection that does not match any of the matching rules.

On Demand Action

From the drop down list, select Connect.

Safari Domains

The device user can access servers ending with these domains in Safari.

A MobileIron Tunnel configuration is only applied to a managed app. Therefore, a managed app with the MobileIron Tunnel configuration must be installed on the device for the device user to access the domains from Safari.

NOTE: If the device resolves the destination domain, then Tunnel is not launched.

Safari Domain

Enter a domain name.

Only alphanumeric characters and periods (.) are supported.

Description

Enter a description for the domain.

Add New

Click to add a domain.

Calendar Domains (iOS 13 and later; macOS 10.15 and later)

A Tunnel VPN connection is automatically established for these domains.

Only available for per-app VPN.

Calendar Domain

Enter a domain name.

Only alphanumeric characters and periods (.) are supported.

Description

Enter a description for the domain.

Add New

Click to add a domain.

Contact Domains (iOS 13 and later; macOS 10.15 and later)

A Tunnel VPN connection is automatically established for these domains.

Only available for per-app VPN.

Contact Domain

Enter a domain name.

Only alphanumeric characters and periods (.) are supported.

Description

Enter a description for the domain.

Add New

Click to add a domain.

Mail Domains (iOS 13 and later; macOS 10.15 and later)

A Tunnel VPN connection is automatically established for these domains.

Only available for per-app VPN.

Mail Domain

Enter a domain name.

Only alphanumeric characters and periods (.) are supported.

Description

Enter a description for the domain.

Add New

Click to add a domain.

Included Routes (Added Routes)

Only available for device-level VPN. Configured routes are set to the TUN interface. If routes are not configured, Tunnel uses 0.0.0.0/0.

Enter list of IPv4 addresses in CIDR format.

For multiple values, enter a semicolon separated list.

DNS Resolver IPs

Only for packet-tunnel provider type.

Enter a domain name server (DNS) to resolve the IP address. IPv4 only.

For multiple values, enter a semicolon separated list. Ensure that the DNS is routable if the default route in not used.

If DNS is not configured, the Sentry DNS is used.

DNS Search Domain List

Only for packet-tunnel provider type.

Enter DNS search domains for resolving the domain names. IPv4 only.

For multiple values, enter a semicolon separated list.

Match Domain List

Only for packet-tunnel provider type.

Enter domains for which a proxy connection is used. IPv4 only.

For multiple values, enter a semicolon separated list.

Only for the domains configured here, Tunnel checks the DNS configured in DNS Resolver IPs to resolve the domains. DNS look up for all other domains goes directly to the device network's DNS server. If no domains are configured here, Tunnel checks the VPN's DNS to resolve all domains.

Custom Data

Enter Key Value pair to configure the MobileIron Tunnel VPN disconnect, debug, and timeout behavior.

See Key-value pairs for Tunnel for macOS.