I am seeing similar issues. We are using Airwatch as our MDM solution and have configured a single app as “managed” with Per-App VPN support. When I launch this app (Google Chrome), it does not appear to attempt to launch the VPN connection, but appears to have no connectivity. Any help would be appreciated.
Alex - Can you send me the .mobileconfig file you are using?
Is this thread monitored ? I have the same problem. keep on getting App-Layer VPN required. Any solutions ?
MDM vendors need to specify the proper configuration in their software to enable F5 EDGE client Per-App VPN functionality.
Specifically, to specify that Per-App VPN is going to be used, they should specify the PerAppVpn key PerAppVpntrue in the configuration profile’s VendorConfig section of the Per-app VPN profile.
If you are having difficulties with Per-App VPN functionality, please open a case with your MDM vendor and ask them to verify that they are sending this key as part of the F5 EDGE client per-App VPN configuration.
MDM vendors need to specify the proper configuration in their software to enable F5 EDGE client Per-App VPN functionality.
Specifically, to specify that Per-App VPN is going to be used, they should specify the PerAppVpn key PerAppVpntrue in the configuration profile’s VendorConfig section of the Per-app VPN profile.
If you are having difficulties with Per-App VPN functionality, please open a case with your MDM vendor and ask them to verify that they are sending this key as part of the F5 EDGE client per-App VPN configuration.
Is it means that from APM side, we just need to configure the normal Network Access and let the MDM Vendor configure the Per-app VPN profile only?
You don’t need the Network Access Object on APM in order to use Per-App VPN - you just need to check “VDI & Java Support” on the Virtual server. Per-App VPN and Full Network Tunnel VPN are mutually exclusive - you currently can’t have both on the same virtual server.
You don’t need the Network Access Object on APM in order to use Per-App VPN - you just need to check “VDI & Java Support” on the Virtual server. Per-App VPN and Full Network Tunnel VPN are mutually exclusive - you currently can’t have both on the same virtual server.
Thanks Michael. For Per-App VPN, my understanding is this feature required the mobile app support. Is it a list of supported app? If the app is not supported, is it using Mobile SDK to make it work with APM?
Clive, from what i observed, as long as app uses NextStep classes, it will be fine. If you are using CoreFoundation classes to make connections, you need to make the app proxy aware. Specifically, browser applications (e.g. Chrome) from App Store don’t appear to be working with per-app vpn currently.
Alex, thanks. I want to set Safari for per-App VPN. Is it supported? How to configure it?
Michael, Do you know if there is any documentation that you can point me to that describes what needs to be configured on the Big-IP to support Per-App VPN? Are you saying that Network Access / APM is not required to make this work?
Michael, Do you know if there is any documentation that you can point me to that describes what needs to be configured on the Big-IP to support Per-App VPN? Are you saying that Network Access / APM is not required to make this work?
Unfortunately, there is no public documentation on the topic just yet. In order for the Per-App VPN to work, you don’t assign any resources to the session in the policy - no webtop, no Network Access - just end the branch in Allow state after the authentication - and you must check the 'VDI and Java" checkbox on the Virtual Server properties - that is it.
Unfortunately, there is no public documentation on the topic just yet. In order for the Per-App VPN to work, you don’t assign any resources to the session in the policy - no webtop, no Network Access - just end the branch in Allow state after the authentication - and you must check the 'VDI and Java" checkbox on the Virtual Server properties - that is it.
Michael, What is the syntax for this key in the VendorConfig section. I tried adding: VendorConfig PerAppVpntrue This did not work. Can you provide the correct syntax?
Michael, What is the syntax for this key in the VendorConfig section. I tried adding: VendorConfig PerAppVpntrue This did not work. Can you provide the correct syntax?
Oops, sorry, it should be: PerAppVpntrue
Oops, sorry, it should be: PerAppVpntrue
Clive, Safari is enabled by default for Per-App VPN. In your configuration, you can specify the URLs that are whitelisted for Per-App VPN. There is a “SafariDomains” attribute of the Per-App VPN payload.