Create a User Level macOS VPN Policy

You can configure a Virtual Private Network (VPN) policy for macOS to give Users secure remote access to your organization’s network.

The policy supports two route types. Full Device VPN routes all traffic on the Mac through the VPN connection. Per-App VPN defines a secure VPN connection and maps specific apps to that connection on a single configuration screen. Apple permits only one active Per-App VPN configuration per profile.

Prerequisites

• Apple Mobile Device Management (MDM) must be configured for your organization and Mac computers must be enrolled in JumpCloud MDM. See Set up Apple MDM. 
• This policy is supported on Mac computers running macOS 10.7 and later.
• Target Mac computers must have an active network connection for this policy to take effect.
• For Per-App VPN, the third-party VPN provider app must be installed on target Mac computers before the mapped apps can connect through the tunnel.
• For Full Device VPN with Certificate authentication, create a user channel Install Certificate or SCEP Profiles policy first, then select that policy in the Identity Certificate UUID field on the VPN policy. See Install Certificate and macOS SCEP Profiles Policy to learn more.

Considerations

• Per-App VPN combines connection settings and app mapping in one view. You do not select an existing VPN connection from a drop-down. JumpCloud generates a hidden VPNUUID on save and applies the same identifier to both the App Layer VPN payload and the App-to-App Layer VPN Mapping payload.
• You cannot route an app through Per-App VPN unless the VPN connection is defined in the same policy configuration.
• On macOS, each mapped app requires an App Bundle ID, a Designated Requirement string, and a Signing Identifier string. 
• Policy configuration settings are applied automatically and do not require a system restart.

Creating the Policy

To create a VPN Policy policy for macOS devices, do the following:

Selecting the Policy Template

1. Log in to the JumpCloud Admin portal.

2. Go to Device Management > Policy Management. The Policy Management page is displayed.
3. On the Policy Management page, click +Add New.
4. Select User Policy to assign the policy to users and users groups. On the New User Policy page:
   • Select the macOS tab.
   • Search and select the required policy and click Configure. The Details tab of the policy is displayed.
   • On the Details tab, configure the required policy configuration settings.
   • (Optional) In the Policy Name field, enter a new name for the policy or keep the default. Policy names must be unique.
   • (Optional) In the Policy Notes field, enter details such as creation date of the policy, and information on testing and deployment of the policy.

Configuring the Policy

To configure the policy, do the following:

Configuring Full Device VPN

On the Details tab, under Settings, use VPN Routing Mode to choose how the Mac connects to your network.

When you select Per-App VPN, the Admin Portal shows connection settings and app selection together. You do not pick a separate VPN from a VPN Routing Mode drop-down list.

Set VPN Routing Mode to Full Device VPN when you want the entire Mac to use the VPN.

Under Settings, configure the connection details. When Connection Type is set to IKEv2, the following fields are displayed:

When you select Certificate as the Authentication Type, the Identity Certificate UUID field appears. Click the field, search for an existing Install Certificate or SCEP Profiles policy, and select it. Username and password fields are not shown for certificate sign-in.

Configuring Per-App VPN

Set VPN Routing Mode to Per-App VPN when only specific apps should use the VPN. Under Settings, the Admin Portal shows connection fields and App Mappings on one screen.

Configuring Per-App VPN

Selecting Apps for the VPN

You can configure the Apps by the following:

• Click + Add Another App to add more apps to the same VPN connection.
• Click the trash icon to remove an app row.

Finding App Bundle ID, Designated Requirement, and Signing Identifier

App Bundle ID uses reverse-DNS format. For example: com.google.Chrome. For third-party apps, Signing Identifier usually follows the {TeamID}.{AppBundleID} format. For example: EQHXZ8M8AV.com.google.Chrome.

To get these values for an app such as Google Chrome, run the following commands in Terminal:

1. Open Terminal on a Mac that already has the app installed.
2. Run the following command to get the Designated Requirement:

3. The following output is displayed:

4. Copy the full value after designated => and paste it in the Designated Requirement field.
5. Run the following command on your Terminal to get the App Bundle ID and Signing Identifier:

5. The following output is displayed:

6. Copy com.google.Chrome into App Bundle ID.

Finding the File Path of an App

To get the file path using Terminal, do the following:

1. Open Terminal on a Mac that already has the app installed.
2. Run the following command, replacing Google Chrome with the app name:

3. The following output is displayed:

4. Use this path in the codesign commands above. If the app is installed in a different location, replace /Applications/Google Chrome.app with the path returned by the command.

Example Values

Applying the Policy

• (Optional) Select the Policy Groups tab. Select one or more policy groups where you want to add this policy. 
• Select the User Groups tab. Select one or more user groups where you want to apply this policy. For user groups with multiple OS member types, the policy only applies when a user logs into a supported Mac computer that is enrolled in Apple MDM.
• Or, select the Users tab. Select one or more users to whom you want to assign this policy to.
• Click Create Policy. A success message is displayed indicating the completion of policy creation.

Viewing Policy Status

1. Select the Status tab.
2. To see the last Result Log for a device where this policy is applied, click view.