KB40328 - How to configure Per-App VPN for Pulse Mobile for iOS with Pulse Workspace and Pulse Connect Secure (PCS) device

This article provides the step-by-step instructions how to configure Per-App VPN Pulse Mobile for iOS with Pulse Workspace (PWS) and Pulse Connect Secure (PCS) device.

Prerequisite(s):

• Pulse Workspace or other third-party MDM solution (MobileIron and AirWatch instructions can be found here)
• Existing Pulse Connect Secure (PCS) device running 7.2 or later
• Recommended:  Vpn On Demand (VOD) configuration with certificate authentication.  If VOD is not configured, Per-App Vpn tunnel must be manually launched using the Pulse mobile app.

Note:  For PCS 8.0R5 to 8.0R11 and 8.1R1 to 8.1R4, PAC license (Pulse AppConnect license) is required for each physical device that does accept AppConnect tunnels from mobile devices. (*Virtual Connect Secure deployments do not currently require the PAC license.)
 

Section 1:  Pulse Workspace Configuration
Section 2:  Pulse Connect Secure Configuration

​​

Pulse WorkSpace Configuration:

1. Login to Pulse Workspace admin console.
2. From the top menu bar, select Policies.
3. From the left pane, select Add.

4. In the Policy Name field, enter a friendly name to help identify the policy.
5. In the Has user tag and LDAP group fields, enter the user tag or LDAP groups to apply the policy to.  These options can be modified in the future.

5. Click Save.
6. From the left pane, click on the friendly name for the policy.

7. From the right pane, click the Properties tab.

8. Under Policy Name, navigate to the VPN section and configure the following options:
   • VPN Host = Sign-in page of the PCS device (fully qualified domain name or IP address)
   • VPN Type = Pulse SSL
   • Optional (VOD): VPN Safari Domains = Domain name(s) to automatically launch the tunnel (also referred to as VPN On Demand) **
   • Optional (VOD): VPN Certificate Auth = Client certificate will be deployed to WorkSpace endpoints to support VOD scenario **
   • Optional: VPN Realm = Realm name configure on the PCS device
   • Optional: VPN Role = Role name configured on the PCS device

 

9. From the right pane, click the iOS App Rules tab.

10. Click Add.

11. Under Add App Rule, enter the app name in the search box and hit the Enter key.
12. From the list, select the app to configure for Per-App VPN.
13. Click Next.

14. For Rule Type, leave as Add.
15. For Network Access, select Per App VPN.
16. Click Save.

Per-App VPN configuration is complete for Pulse Workspace.  The policy will remain in edited state until the policy is published.  The administrator may make additional policies changes prior to pushing the policy.  Once all changes are completed, click Publish button.

For additional Pulse Workspace help documentation, please click here.

Pulse Connect Secure (PCS) Configuration:

1. Login to PCS admin console.
2. Navigate to Users > User Roles > New Role.

3. In the Name field, enter a friendly name for the Per-App VPN role.
4. Under Access features, select the checkbox for Secure Application Manager > Windows Version and VPN Tunneling.

5. Click Save Changes.
6. Navigate to Users > Resource Profiles > WSAM Destinations > New Profile.

7. For the Name field, enter a friendly name for the profile.
8. Under Destination, enter the list of IP addresses to tunnel through the Per-App VPN tunnel.  (Note:  FQDN names are supported starting in 8.2R3 and above for the Per-App tunnel)

9. Click Save and Continue.
10. Under Available Roles list, select the role created for Per-App VPN (above), then click Add.

11. Click Save Changes.

Administrator may create a new sign-in page and user realm or use an existing sign-in page and user realm for Per-App VPN role.  (Note:  Sign-in page and User realm will need to match step 8 in the PWS configuration)
 

Optional configuration for VPN On Demand:

Please refer to KB40360 - VPN On Demand with Pulse WorkSpace and Pulse Connect Secure