Application-triggered VPN for Windows devices
Administrators can choose to specify what applications trigger a VPN connection and what applications do not. Ivanti EPMM exposes all key-value pairs for app triggers and app filters rules to provide administrators with the ability to manually add AppTrigger rules separately from rather than TrafficFilter rules, rather than automatically being added whenever a TrafficFilter rule was applied to an application.
Previous to the Ivanti EPMM 9.2.0.0 release, Ivanti EPMM automatically added an AppTrigger rule whenever adding the TrafficFilter rule, without also including the AppTrigger in the Admin Portal. As of 9.2.0.0, if you set up VPN profiles in previous releases these profiles will not change, but Ivanti EPMM automatically adds the AppTrigger rule that it added in the background with the TrafficFilter rule. Both are included in the Policies & Configs > Configurations > Add New > VPN > Custom Data table.
With this separation between AppTrigger and TrafficFilter rules, you can remove a rule if you do not want to trigger the VPN on an application. While existing profiles will not change, you can modify existing rules or configure them to separate between trigger and filter.
Configuring VPNs triggers
Use these steps to set up VPN triggers by connecting AppTrigger with TrafficFilter rules.
Procedure
- Log in to the Admin Portal.
- Go to Policies and Configs > Configurations.
- Click Add New > VPN.
- Scroll to the Custom Data section.
- Enter a TrafficFilter rule in the KEY column.
- Enter the application to trigger the VPN in the VALUE column.
- Enter an AppTrigger to pair with the TrafficFilter.
- Enter the same application in the VALUE column.
- Click Save.
How to set up exclusions for VPN traffic
If the VPN configuration is set up to send all traffic through VPN, you can configure exclusions. You can exclude traffic from using VPN.
Procedure
- In the Admin Portal, go to Policies and Configs > Configurations.
- Click Add New > VPN, or select an existing VPN setting to Edit.
- Ensure that Send All Traffic is checked.
- In the Excluded Secured Resources (Windows Phone only) section, click Add +.
Create a separate entry for each domain name, IP range, or app.
- Enter the following information:
Item | Description |
|---|---|
Secured Resources | Enter one of the following:
Example: *.corp.example.com We also strongly suggest to add *.yourepmmdomain.com to the exclusion list. This excludes the use of VPN when the device connects to Ivanti EPMM. If your Ivanti EPMM domain is not in the exclusion list, and the device fails to establish a VPN connection, the device will not be able to connect to Ivanti EPMM.
Example: 192.0.2.0/24
|
Description | Enter a description for the secure resource. |
- Click Save.
How to get the app GUID for a Windows Phone 8.1 device app
You can get the app GUID for a 8.1 app.
Procedure
- Go to the Windows Phone 8.1 app store.
- Search and click on the app for which you want the app GUID. The app GUID is the numbers and letters in the tail end of the URL, in the address bar of the app details page.
