> Source: [sk170298](https://support.checkpoint.com/results/sk/sk170298) # sk170298 - Capsule Connect - MDM configuration, including Per-App VPN and Zero-touch configuration | Property | Value | |----------|-------| | Solution ID | sk170298 | | Date Created | 2020-11-01 | | Last Modified | 2021-05-05 | | Technical Level | General | | Products | Endpoint Security | | Versions | Cloud, E89.X, E88.X | | OS | iOS | | Platform | Mobile Devices | ## Solution The most convenient way to deploy VPN configurations for Capsule Connect (iOS) is via an Mobile Device Management (MDM). It also allows for Per-App VPN configurations and zero-touch deployments without requiring any user interaction. This is basically done by configuring a VPN profile on the MDM and pushing it to the managed devices. This VPN profile is based on Apple's API, and so it is common across all MDMs with each maybe having slight variations in naming and UI. We will go over the configuration of Microsoft Intune, but it will be almost identical in every other MDM. First, you need to have an operational MDM with enrolled iOS devices that you can deploy policy and configurations to. **Configuring the MDM for managing iOS devices is outside of this article's scope. Refer to the MDM vendor documentation.** For Intune start here: Once you have that, you need to add the Capsule Connect application (as a managed application) that will be deployed to devices, and the VPN profile to go alongside the application. To add an app just go to **Apps** -\> click **+Add** button -\> select '**iOS store app** ' in 'Select app type' -\> click '**Search the App Store** ' and find the "Check Point Capsule Connect" app -\> assign the user/device groups this app should be deployed on and finish. Now you can add the VPN profile. You should look for an iOS profile of type VPN. Here in Intune it is under **Devices** -\> **Configuration profiles** -\> click **+Create** profile -\> select Platform = **iOS/iPadOS** and Profile = **VPN** . Give it a name to represent this configuration object in Intune. The second page - "Configuration settings" is the common section that is very similar on all MDMs, and holds all the VPN settings. You need to first select the VPN application that will handle this VPN configuration. You should be able to find the Check Point application in the list, but then the UI options are limited. It is preferable to select the Custom VPN (or a similar name in other MDM vendors such as Custom SSL). That way you will need to enter the application identifier yourselves, but you will have more options to customize the profile with custom Key-Value pairs. The VPN identifier (or bundle id or application id) for the Capsule Connect application is: **com.checkpoint.CheckPoint-VPN.app** You need to enter a name for the connection (displayed to the user) and the address (IP or FQDN) of the VPN server. The authentication method here is not the actual authentication used by the Security Gateway, but just a very simple representation (You will configure the exact authentication method later in a custom key). If a certificate is used in the authentication scheme (either simple cert, or part of a multi factor authentication) then Certificate should be selected, otherwise just select 'Username and Password'. Certificate authentication is required for zero-touch experience, On-Demand VPN, or Per-App VPN features. In order to select the certificate used, you need to first configure a Certificate Profile. This will usually be a SCEP (Simple Certificate Enrollment Protocol), or PKCS (Public Key Cryptography Standards) configuration that will be used to enroll and deploy to the device a user certificate. This certificate will in turn be linked to your VPN profile, and be used for authentication against the Security Gateway. **Again, setting up this environment and MDM configuration is outside of the scope of this article.** For Intune, see here for more details: Let us return to the VPN profile, we have just covered the basic required fields for a minimal setup. This is enough for having a working VPN connection on the client, but will require interaction from the user, just for the first connection, to approve the Security Gateway certificate. The next step is optional, but highly recommended. It is adding a few key-value pairs that will enable the Capsule Connect application to connect to the Security Gateway without any user interaction, allowing for a zero-touch configuration and enabling advanced features like On-Demand VPN and Per-App VPN, establishing the VPN connection automatically, when needed. The first two keys are used to verify the Security Gateway certificate: * **cn** = common name of the Security Gateway certificate used for Remote Access. This is the portal certificate, not the Security Gateway certificate. You can find the certificate under "Mobile Access -\> Portal Settings" in the dashboard (gw properties). * **fingerprint** = fingerprint of the CA signing this Remote Access certificate in human readable format. The need for 'cn' and 'fingerprint' is for the app to verify the authenticity of the site without user intervention (no trust screen that the user needs to approve before connecting). In order to avoid the trust screen shown in Capsule Connect on first use of this profile, in addition to setting the right fingerprint and cn, you need to have the root CA trusted on the device (you can push it with the MDM if it is not already a trusted one). The trust screen is shown when you do not have enough information in order to trust the Security Gateway certificate. When something is missing, or does not match, the 'details' on the trust screen should describe the issue more specifically. **Key names are case sensitive** (no need for quotes in string values). Another important key is the auth key to notify the client the authentication method that should be used. There are two auth keys that serve different purposes on the client, but usually configuring only one of them should suffice. * **auth** = **t** (for certificate) **r** (for challenge-response) **p** (for user/pass and everything else) * **authMethod** = **Certificate** or **Username and Password** or **Challenge Response** or **PinPad** or **KeyFob** (both for RSA SecurID) For MFA configurations, these keys are replaced by the **realm** key. * **realm**= realm_id (Login Option "Name" on the dashboard, not the "Display Name") For a truly automatic connection (zero-touch, on-demand), the authentication method must be a certificate. Any other method will require the user to input credentials in the Capsule Connect application, forcing a manual connection to the Security Gateway. Other optional custom keys: * **tuntype** = **kmp** (IPSec tunnel, default) / **snx** (SSL tunnel) * **port** = port number to connect to on the Security Gateway (default 443) * **url** = a URL that will be opened after each connection to this VPN site * **remoteActions** = **yes** / **no** (enables using the VPN site API for connecting to/disconnecting from the site. See [Capsule Connect and Capsule VPN Clients Administration Guide for iOS, Android, Windows 10, and Windows 8.1](http://downloads.checkpoint.com/dc/download.htm?ID=20361)for more information) * **connectWifiOnly** = **yes** / **no** (allow the VPN site to connect only while the device is on Wi-Fi networks) * **tcpTimeout** = number of seconds to set timeout on connection attempts (default is 20 seconds). Sometimes authentication through external servers and user challenges requires a longer timeout in order to complete. More parameters in the VPN profile: **Split tunneling** / **Route-All-Traffic** -- the default VPN configuration in Capsule Connect uses the Security Gateway's topology (Encryption domains) to tunnel only organizational traffic, while all other network traffic from the device is handled by the device's physical network interface. It is possible to mark the configuration as Route-All-Traffic and tunnel all the traffic from the device to the VPN gateway. **Important note about DNS resolving** : In order to resolve internal resources, a DNS server should be configured on the VPN tunnel, as well as a list of domain suffixes. By default, this DNS server is used only for the configured domain suffixes, while everything else goes through the external DNS server (configured on the primary physical interface, Wi-Fi or Cellular) unless the VPN is configured as Route-All-Traffic. It is possible to make the VPN's DNS server the default resolver even if you are in split tunneling (by adding a special DNS suffix - **CPiOSDefaultDNS** ). **Per-App VPN** -- allows for a more focused VPN instead of the default device-wide VPN. After setting the VPN profile as a Per-App VPN, you need to attach this profile to each of the managed applications that should go through this VPN. All the traffic from these applications (and only traffic from these applications) will go through the VPN tunnel (no split-tunneling for these applications). There are two types of providers, packet-tunnel and app-proxy. **Capsule Connect is a packet-tunnel provider.** Make sure to select the right provider type in the VPN profile. **On-demand VPN** allows for an automatic VPN, establishing the VPN automatically when it is needed based on various on-demand rules you configure in the VPN profile. **Reminder: automatic VPN can only work with certificate authentication.** General page on iOS VPN profile settings for Intune: Complete guide on how to configure Per-App VPN in Intune (including CA cert, SCEP etc.) **MDM keys** : We have some app-specific keys (vs the profile-specific keys we described earlier) that can control the EULA dismissal, and whether the user can edit/delete the site configurations pushed from the MDM. See [sk164159](https://supportcenter.checkpoint.com/supportcenter/portal?action=portlets.SearchResultMainAction&eventSubmit_doGoviewsolutiondetails=&solutionid=sk164159) for more details.
--- # Agent Instructions This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products. ## Navigating This Knowledge Base - **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt) - **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml) - **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}` - **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content