Skip to main content

Skyhigh Security is launching standalone documentation portals to support Japanese, German, and French languages. We are not supporting auto-translation. Stay tuned for further updates. Thanks for your support.

Skyhigh Security

Configure Microsoft InTune for iOS

This document provides the configuration flow of pushing VPN profile to mobile device from Intune MDM (Mobile Device Management).
Assumption: Device already managed with Intune.

Creation of custom VPN Profile

  1. Login to the Intune MDM account using the URL: https://devicemanagement.microsoft.com/
    clipboard_ec8a40e4ed391064d567c32ab909fa07d.png
  2. Once logged into the account, click Device Configuration.

    21.png
     
  3. In the Device Configuration, click Profiles to create the new VPN profile. 

    llc.png
  4. Click Create Profile in the Profiles section. Refer how to create the apple configurator VPN profile.
    Create the profile by completing the required information in the fields.

    23.png
  5. Once Profile Type is selected as Custom, a window will be opened to upload the Apple Configurator profile file.

    Provide the Custom configuration profile name and upload the apple configurator (.mobileconfig) file.
    [Refer Step#4 to how to create the apple configurator VPN profile]

 

When you use apple configurator to create mobileconfig file, it adds the following key value pair which causes certificate installation failure. Delete this key pair to make the certificate work.

<key>DNS</key>
<dict>
<key>SupplementalMatchDomainsNoSearch</key>
<integer>0</integer>
</dict>


1.png

  1. File content looks like in below image. click OK.
    2.png
  2. Click Create.
    An example of a saved profile is shown below:
    3.png

Assign the Profile to a Managed Device

  1. In the Saved profile page, click Assignments.

    4.png
  2. From the Assign to drop down list, select the specific groups to distribute the profile. 
    6.png

3. Click Save. In the profile, click Device status in the Monitor section. Click the device in which profile got pushed.
     8.png

  1. Once the device page is opened, click Sync to activate the profile distribution action immediately.
    9.png
  2. In the profile, now device’s deployment status is Succeeded.
    10.png

Inside the Device after Publishing the Profile

  1. In the device, in Settings > General > Profiles & Device Management > <MDM Profile> >More DetailsVPN SETTINGS, our distributed profile will be visible.
    clipboard_ee06e1272f648357b0d154581cf604072.png
     
  2. Go to Settings > VPN, tick mark the profile which got pushed from Intunes. Now, click status to enable VPN connection.
    clipboard_e469ea2f8a40e3e3707250a7123906429.png

Create a VPN Profile using Apple Configurator

  1. Install Apple Configurator 2 application in MAC machine. and click New Profile.
    mc1.png
  2. Give specific name in the General > Name field.
    clipboard_ef4ea46aa755a8aea90889ad3e32f5802.png
     
  3. Click Certificates and upload the device certificate.
    clipboard_e2216533846f0ef78868ef2b58b5216aa.png
  4. Click on VPN and configure it with the required fields. Please refer the table at the end of the page to configure VPN profile fields.
    Save the file. It will be saved with .mobileconfig extension.
    clipboard_e833bb9db697412e8dcfb3f416ecf12ac.png

VPN Profile Info

Fields Values
Connection Name IOSTestProfile
Connection Type IKEv2
Server

c<customer ID>.smcs.skyhigh.cloud
You can get this information from the certificate page.

The following information is required to configure an SMCS app in the MDM of your choice.

VPN gateway address: c<customer ID>.smcs.skyhigh.cloud

Remote Identifier vpn.skyhigh.cloud
(This string is SAN (Subject Alternate Name) of server certificate)
Connection Name IOSTestProfile
Connection Type IKEv2
Local Identifier XXXXX
(This string is SAN-(Subject Alternate Name) of client certificate)
Machine Authentication Certificate
Certificate Type RSA
Server Certificate Issuer Common Name XXXX [OPTIONAL]
(This string is CN-Common Name of server root certificate)
Server Certificate Common Name vpn.skyhigh.cloud
(This string is CN-Common Name of server certificate)
Enable EAP True
Disconnect on Idle Never
EAP Authentication Certificate
Identity Certificate  Select the identity certificate
Dead Peer Detection Rate Medium
Enable Perfect Forward Secrecy (PFS) True
IKE SA Params
&
Child SA Params
Encryption Algorithm: AES-256
Encryption Algorithm: SHA2-256
Diffi e Hellman Group: 14 or, 15
Lifetime In Minutes: 1440
Connection Name IOSTestProfile
Connection Type IKEv2
Proxy Setup None

 

  • Was this article helpful?