VPN

The VPN policy configuration distributes VPN profiles to managed Windows devices centrally. Besides the connection itself, the configuration covers authentication, name resolution, split tunneling and proxy settings. Windows Home, Pro, Enterprise and Education version 1607 or later are supported.

The form is divided into the sections General, Apps, DNS settings, Split tunneling and Proxy configuration.

General #

Authentication #

Depending on the VPN type, the Authentication type field offers the following options. When the VPN type changes, the authentication type is reset.

With the VPN type L2TP, either a pre-shared key or an identity certificate is required (certificate, certificate template or user certificate). If both are missing, the configuration is not saved.

EAP XML #

EAP is not set up through individual fields but as an XML configuration in the EAP XML text field. Above the field, the portal links to the Microsoft documentation on how to build this configuration: EAP configuration →.

The field is available for all combinations except IKEv2 with Machine certificate. The XML is only transferred to the device with the authentication type EAP; with None and Pre Shared Key it is ignored.

As of Relution 26.5.5, the XML must not contain a DOCTYPE declaration (<!DOCTYPE …>). Such a configuration can still be saved, but the VPN profile cannot be transferred to the device. EAP configurations based on the Microsoft template do not contain a DOCTYPE declaration and are not affected. If an existing configuration contains such a declaration, it has to be removed from the XML.

Identity certificate #

Except with the authentication type Pre Shared Key, Identity Certificate defines which certificate is used for the connection:

• Use user certificate: Uses the user certificate. The optional Certificate name field selects a specific certificate by name if the user has several certificates of this type; the name may contain placeholders. If the field is left empty, the certificate with the longest validity is used. This requires a user to be assigned to the device for whom a user certificate exists.
• Select certificate: Selection of a certificate or a certificate template from certificate management.

The certificate is only installed on the device together with the VPN profile with the authentication type EAP.

IKEv2 parameters #

With the VPN type IKEv2, the cryptography parameters can also be defined. The default value of all fields is Not configured.

• IKE SA Params: Encryption Algorithm, Integrity Algorithm and Diffie-Hellman group
• Child SA Params: Encryption Algorithm, Integrity Algorithm and Diffie-Hellman group (PFS group, additionally with the option Use parent Diffie-Hellman group)

Either all six values or none are set; a partial specification is not saved.

Apps #

DNS settings #

The DNS suffix field takes DNS suffixes that are added to the DNS search list so that short names are resolved correctly. The first suffix in the list is also used as the primary connection-specific DNS suffix of the VPN interface.

The Name Resolution Policy table (NRPT) rules define how DNS names are resolved while a VPN connection is established. Each rule specifies a domain and the DNS servers or web proxy server used to resolve that domain. Add creates a rule with the following fields:

Split tunneling #

Split tunneling is enabled with the Split tunneling switch. Only then are the entries under Split tunneling routes for this VPN connection transferred to the device, and only traffic to these destinations is sent through the VPN.

Each route is added with Add as a Destination prefix in CIDR notation, as an IPv4 or IPv6 address with prefix length (e.g. 10.22.0.0/16). The prefix length (subnet mask) must be greater than 0.

Proxy configuration #

The Proxy type field determines which further fields appear:

Related topics #

• Certificates → — provide identity and trust certificates.
• Wi-Fi → — network profiles for Windows devices.