Ivanti Tunnel VPN configuration field description

The following table provides field descriptions for the Ivanti Tunnel configuration. There are some variations in field names between Ivanti EPMM and Ivanti Neurons for MDM.

**Table 1.** ivanti tunnel configuration field description
Item	Description
Name	Enter a name for the Ivanti Tunnel VPN profile.
Description	Enter a description for the profile.
Connection Type (Ivanti EPMM)	Select Ivanti Tunnel. Only fields relevant to Ivanti Tunnel are displayed.
Choose OS to create Ivanti Tunnel Configuration (Ivanti Neurons for MDM)	Select iOS/macOS.
Profile selection mode to use for this configuration (Ivanti Neurons for MDM)	Select one of the following: Sentry Profile Only: Select if Tunnel traffic goes only through Standalone Sentry only. Access Profile Only: Select if Tunnel traffic goes to Access only. Only authentication traffic is tunneled to Access. This option is available only if an Access deployment is set up. If Access Profile Only is configured with per-app VPN packet tunnel provider type, only authentication traffic is tunneled to Access. All other traffic is dropped. If Access Profile Only is configured with device-level VPN packet tunnel provider type, only authentication traffic is tunneled to Access. All other traffic goes directly to the destination. Sentry + Access Profile: Select if Tunnel VPN supports both traffic to Access for authentication to enterprise cloud resources and through Standalone Sentry to on-premise enterprise resources. This option is available only if an Access as a service deployment is set up.
Legacy App Support (iOS only)	Not applicable for Ivanti Tunnel for macOS.
VPN Sub Type (Ivanti Neurons for MDM)	(Optional) Overrides the bundle identifier for a customized Ivanti Tunnel app.
Enable Access (Ivanti EPMM)	This option is not supported for macOS.
Provider Type	app-proxy: This is the default setting. Use this setting for TCP tunneling only. packet-tunnel: Select to allow Ivanti Tunnel to also handle IP traffic. Per-device VPN automatically uses the packet-tunnel provider type.
Per-app VPN (Ivanti EPMM)	The options are available if Provider Type is packet-tunnel. Otherwise, the options are grayed out. Device-level VPN is not available for app-proxy tunnel. Yes: This is the default setting. Connectivity is established for an app, rather than the device. No: Select to establish connectivity for the device, rather than just an app.
Sentry (Profile)	Ivanti EPMM: Select the Standalone Sentry on which you created the TCP tunnel service. Ivanti Neurons for MDM: If you are configuring per app VPN, select the Standalone Sentry profile.
Sentry Service	Ivanti EPMM: Select the TCP or IP service that the Safari browser or managed app will use. Ivanti Neurons for MDM: Select the Ivanti Tunnel for macOS service that the Safari browser or managed app will use. The field is not available if the profile mode is Access Profile Only. Only TCP services are available for selection if the provider type is app-proxy. Only IP services are available for selection for the following: The provider type is packet-tunnel. The VPN is per device.
SCEP Identity (Ivanti Neurons for MDM)	Select the Identity Certificate configuration you created for Ivanti Tunnel. The Identity Certificate is automatically selected if Sentry Profile Only or Sentry + Access Profile is enabled.
Debug Info Recipient (Ivanti Neurons for MDM)	Enter an email address for emailing debug logs.
Identity Certificate (Ivanti EPMM)	Select the certificate setting you created. If you are using user-provided certificates, select the user provided certificate you created for Ivanti Tunnel.
On Demand Rules (iOS 9 and later; macOS 10.13 and later) (Ivanti EPMM) VPN On Demand rules are applied when the device's primary network interface changes, for example when the device switches to a different Wi-Fi network. Devices will drop the Tunnel VPN connection if an enterprise Wi-Fi is detected. If the network is not a Wi-Fi network or if its SSID does not appear in the list, the device will continue to use Tunnel VPN. A matching rule is not required. The Default Rule is applied if a matching rule is not defined. If you select Evaluate Connection, a matching rule is not required. You can create up to 10 On Demand matching rules. For each matching rule you can create up to 50 Type and Value pairs. An Ethernet on-demand rule is only applicable to macOS devices. If the rule is pushed to macOS device, the rule may cause issues with Tunnel behavior and how traffic through Tunnel is handled. Therefore, Ivanti recommends using separate Tunnel VPN configurations for iOS and macOS.
Add +	Click to add a new On Demand matching rule.
On Demand Action	Select one of the following actions to apply to the matching rule: Connect Disconnect
Matching Rules For each On Demand matching rule to which the action is applied enter the type and value pair.
Add +	Click to add a new On Demand matching rule. A dialog box appears.
Type	Select the following key type: SSID
Value	Enter a list of SSIDs to match the enterprise Wi-Fi. If the network is not a Wi-Fi network or if its SSID does not appear in the list, the match will fail. To add multiple SSIDs, create a separate SSID Type-Value pair for each SSID.
Description	Enter additional information about this matching rule.
OK	Click to add the On Demand Action and the associated Matching Rules.
Default Rule The default rule (action) is applied to a connection that does not match any of the matching rules.
On Demand Action	From the drop down list, select Connect.
Safari Domains The device user can access servers ending with these domains in Safari. Ivanti Tunnel configuration is only applied to a managed app. Therefore, a managed app with the Ivanti Tunnel configuration must be installed on the device for the device user to access the domains from Safari. If the device resolves the destination domain, then Tunnel is not launched.
Safari Domain	Enter a domain name. Only alphanumeric characters and periods (.) are supported.
Description	Enter a description for the domain.
Add New	Click to add a domain.
Calendar Domains (iOS 13 and later; macOS 10.15 and later) A Tunnel VPN connection is automatically established for these domains. Only available for per-app VPN.
Calendar Domain	Enter a domain name. Only alphanumeric characters and periods (.) are supported.
Description	Enter a description for the domain.
Add New	Click to add a domain.
Contact Domains (iOS 13 and later; macOS 10.15 and later) A Tunnel VPN connection is automatically established for these domains. Only available for per-app VPN.
Contact Domain	Enter a domain name. Only alphanumeric characters and periods (.) are supported.
Description	Enter a description for the domain.
Add New	Click to add a domain.
Mail Domains (iOS 13 and later; macOS 10.15 and later) A Tunnel VPN connection is automatically established for these domains. Only available for per-app VPN.
Mail Domain	Enter a domain name. Only alphanumeric characters and periods (.) are supported.
Description	Enter a description for the domain.
Add New	Click to add a domain.
Included Routes (Added Routes) Only available for device-level VPN. Configured routes are set to the TUN interface. If routes are not configured, Tunnel uses 0.0.0.0/0. Enter list of IPv4 addresses in CIDR format. For multiple values, enter a semicolon separated list.
DNS Resolver IPs Only for packet-tunnel provider type. Enter a domain name server (DNS) to resolve the IP address. IPv4 only. For multiple values, enter a semicolon separated list. Ensure that the DNS is routable if the default route in not used. If DNS is not configured, the Sentry DNS is used.
DNS Search Domain List Only for packet-tunnel provider type. Enter DNS search domains for resolving the domain names. IPv4 only. For multiple values, enter a semicolon separated list.
Match Domain List Only for packet-tunnel provider type. Enter domains for which a proxy connection is used. IPv4 only. For multiple values, enter a semicolon separated list. Only for the domains configured here, Tunnel checks the DNS configured in DNS Resolver IPs to resolve the domains. DNS look up for all other domains goes directly to the device network's DNS server. If no domains are configured here, Tunnel checks the VPN's DNS to resolve all domains.
Custom Data Enter Key Value pair to configure the Ivanti Tunnel VPN disconnect, debug, and timeout behavior. See Key-value pairs for Ivanti Tunnel for macOS.