Apple Configurator for VPN configs

Options
kelmi
kelmi image  Ally Member
First Comment Friend Collector Eighth Anniversary
in USG FLEX H Series

Hello,

Is there any instructions anywhere, how to use Apple Configurator- app to modify the IPSec VPN profile in iPhone? I would like to modify parameters what iOS by default only accepts, like DH14 to DH19. And the initial proposal to be based on AES-GCM. I assume, there is no other way with iPhones to improve the default parameters?

Thank's

K

«1

All Replies

  • Maverick87
    Maverick87 image  Master Member
    Zyxel Certified Network Administrator - WLAN Zyxel Certified Network Administrator - Nebula Zyxel Certified Network Administrator - Security Zyxel Certified Sales Associate
    edited August 22
    Options

    Hello @kelmi,

    why you need to modify the profile directly in iPhone? Is the profile that you load, that "impose" the configuration for the Phase 1 and 2.

    If you would like to use only the DH19, you need to configure the profile for accept only the DH19, then you need to load the profile (.mobileconfig file)

    Otherwise, if you would like to create a profile, directly from iPhone, you can do this:

    • Open Apple Configurator on your iPhone.
    • Select File > New Profile from the top menu bar.
    • Click on the VPN payload category in the left sidebar and click Configure.
    • Set the Connection Type dropdown menu to IKEv2.
    • Scroll down to the crypto parameters sections:
      • IKE SA Params (Phase 1): Locate the Diffie-Hellman Group dropdown and select your required group (e.g., 14, 19, 20, 21).
      • Child SA Params (Phase 2): Check Enable Perfect Forward Secrecy (PFS) to unlock the Phase 2 parameters, then change the Diffie-Hellman Group dropdown to match your server configuration.
    • Save and export your .mobileconfig file.
  • kelmi
    kelmi image  Ally Member
    First Comment Friend Collector Eighth Anniversary
    Options

    iPhone does not seem to approve by default anything else except DH14. That it what it proposes and when 50H replies and proposes DH19, iPhone stops trying.

    K

  • Maverick87
    Maverick87 image  Master Member
    Zyxel Certified Network Administrator - WLAN Zyxel Certified Network Administrator - Nebula Zyxel Certified Network Administrator - Security Zyxel Certified Sales Associate
    Options

    What version of iPhone? What version of iOS?

    I think the important point here is that iOS does support DH19 for IKEv2, so it should not be limited to DH14 by design.

    If the iPhone is only proposing DH14 and then stops when the Zyxel replies with DH19, I would first check the actual IKE_SA_INIT exchange and the configuration profile being used on the iPhone.

    The .mobileconfig should explicitly define the IKEv2 parameters, for example:

    • Phase 1 / IKE SA: AES-GCM + DH19
    • Phase 2 / Child SA: AES-GCM + PFS/DH19 (if PFS is required)

    The important part is that DH19 must be configured in the IKEv2 payload of the profile; changing the Zyxel side alone will not make the iPhone propose DH19.

    So I would suggest creating a new .mobileconfig with the desired IKEv2 crypto parameters using Apple Configurator, installing that profile on the iPhone, and then checking the IKE_SA_INIT packet/logs on the Zyxel.

    If the iPhone still proposes only DH14 after installing a profile explicitly configured for DH19, then we need to look at the exact iOS version and the contents of the .mobileconfig file. If you can share the relevant VPN payload (with the server address/credentials removed), I can take a look at it.

    Thank you

  • kelmi
    kelmi image  Ally Member
    First Comment Friend Collector Eighth Anniversary
    Options

    iPhone 17 Pro. Latest iOS 26.6.1

    K

  • Maverick87
    Maverick87 image  Master Member
    Zyxel Certified Network Administrator - WLAN Zyxel Certified Network Administrator - Nebula Zyxel Certified Network Administrator - Security Zyxel Certified Sales Associate
    Options

    Can you provide the .mobileconfig used? Hide your secret/sensitivity data and if you can, share the .mobileconfig file.

    Thank you

  • kelmi
    kelmi image  Ally Member
    First Comment Friend Collector Eighth Anniversary
    Options

    Well,


    that is my original quesrion up there. How to make the .mobileconfig using Apple configurator as what you can do through iOS GUI always defaults to DH14.


    k

  • Maverick87
    Maverick87 image  Master Member
    Zyxel Certified Network Administrator - WLAN Zyxel Certified Network Administrator - Nebula Zyxel Certified Network Administrator - Security Zyxel Certified Sales Associate
    edited August 24
    Options

    Oh sorry, you're right.

    Can you share your VPN configuration screenshot inside the firewall?

  • Zyxel_Melen
    Zyxel_Melen image  Zyxel Employee
    Zyxel Certified Network Engineer Level 1 - Switch Zyxel Certified Network Administrator - Switch Zyxel Certified Network Administrator - Nebula Zyxel Certified Sales Associate
    Options

    The USG FLEX H series support to modify the parameters and apply to mobileconfig. I think there's no need to use Apple configuration app since delete old profile and import the new file should be easier.

    Zyxel Melen


  • Maverick87
    Maverick87 image  Master Member
    Zyxel Certified Network Administrator - WLAN Zyxel Certified Network Administrator - Nebula Zyxel Certified Network Administrator - Security Zyxel Certified Sales Associate
    Options

    Hi Melen,
    Yes, sure, but first I ask the screenshot to know how kelmi set the phase1 DH

  • kelmi
    kelmi image  Ally Member
    First Comment Friend Collector Eighth Anniversary
    edited August 27
    Options

    Back to this topic, after a business trip.

    • VPN Config1 picture shows the VPN config
    • Log file1 shows the log file

    I deleted the VPN profile from iPhone and pushed the Download- button to have the config script. And installed that to my iPhone

    It looks like iPhone is not getting the right script or is overriding that with default AES256 settings.

    K

    VPN Config1.png
    Log file 1.png

Categories

Security Help Center

EnglishTiếng ViệtРусскийไทย中文（台灣）