<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<!-- https://developer.apple.com/library/ios/featuredarticles/iPhoneConfigurationProfileRef/Introduction/Introduction.html#//apple_ref/doc/uid/TP40010206-CH1-SW7 -->
<plist version="1.0">
<dict>
<!-- VPN Payload
The VPN payload is used for traditional systemwide VPNs based on L2TP, PPTP, and IPSec.
This payload should not be confused with the Per-App VPN, described in Per-App VPN Payload.
The VPN payload is designated by specifying com.apple.vpn.managed as the PayloadType value.
In addition to the settings common to all payload types, the VPN payload defines the following keys
-->
<key>PayloadContent</key>
<array>
<dict>
<!-- Determines the settings available in the payload for this type of VPN connection. IPSec (Cisco) -->
<key>IPSec</key>
<dict>
<!-- Either SharedSecret or Certificate. Used for L2TP and Cisco IPSec. -->
<key>AuthenticationMethod</key>
<!-- The shared secret for this VPN account. Only present if AuthenticationMethod is SharedSecret. Used for L2TP and Cisco IPSec. -->
<string>SharedSecret</string>
<!-- 1 if the VPN connection should be brought up on demand, else 0. -->
<key>OnDemandEnabled</key>
<integer>1</integer>
<!-- Determines when and how an on-demand VPN should be used. -->
<key>OnDemandRules</key>
<array>
<dict>
<!-- The action to take if this dictionary matches the current network. -->
<key>Action</key>
<!-- Disconnect—Tear down the VPN connection and do not reconnect on demand as long as this dictionary matches. -->
<string>Disconnect</string>
<!-- An interface type. If specified, this rule matches only if the primary network interface hardware matches the specified type.
Supported values are Ethernet, WiFi, and Cellular.
-->
<key>InterfaceTypeMatch</key>
<string>WiFi</string>
<!-- An array of SSIDs to match against the current network. If the network is not a Wi-Fi network or if the SSID does not appear in this array, the match fails.
Omit this key and the corresponding array to match against any SSID.
-->
<key>SSIDMatch</key>
<array>
<!-- TODO: eine oder mehree Netzwerk SSID einfügen -->
<string>REPLACE_secure_wpa2_network_ssid</string>
<string>REPLACE_my_private_wpa_network_ssid</string>
</array>
</dict>
<dict>
<!-- The action to take if this dictionary matches the current network. -->
<key>Action</key>
<!-- Connect — Unconditionally initiate a VPN connection on the next network attempt. -->
<string>Connect</string>
<!-- An interface type. If specified, this rule matches only if the primary network interface hardware matches the specified type.
Supported values are Ethernet, WiFi, and Cellular.
-->
<key>InterfaceTypeMatch</key>
<string>WiFi</string>
<!-- An array of SSIDs to match against the current network.
If the network is not a Wi-Fi network or if the SSID does not appear in this array, the match fails.
Omit this key and the corresponding array to match against any SSID.
-->
<key>SSIDMatch</key>
<array>
<!-- TODO: evl. SSID für Hotspots oder Firma ergaenzen -->
<string>REPLACE_UNSECURE_PUBLIC_SSID</string>
<string>REPLACE_Public</string>
<string>REPLACE_Telekom</string>
</array>
</dict>
<dict>
<key>Action</key>
<string>Connect</string>
<key>InterfaceTypeMatch</key>
<string>WiFi</string>
</dict>
<dict>
<key>Action</key>
<!-- Ignore — Leave any existing VPN connection up,
but do not reconnect on demand as long as this dictionary matches.
-->
<string>Connect</string>
<key>InterfaceTypeMatch</key>
<string>Cellular</string>
</dict>
<dict>
<key>Action</key>
<string>Ignore</string>
</dict>
</array>
<!-- Present only if AuthenticationMethod is SharedSecret.
The name of the group to use. If Hybrid Authentication is used,
the string must end with [hybrid]. Used for Cisco IPSec.
-->
<key>LocalIdentifier</key>
<!-- TODO: VPN Login eingeben -->
<string>REPLACE_VPN_LOGIN</string>
<!-- Present only if AuthenticationMethod is SharedSecret. The value is KeyID. Used for L2TP and Cisco IPSec. -->
<key>LocalIdentifierType</key>
<string>KeyID</string>
<!-- IP address or host name of the VPN server. Used for Cisco IPSec. -->
<key>RemoteAddress</key>
<!-- TODO: VPN Server eintragen z.B. xxxxxxxxxxxxxxxxx.myfritz.net oder DynDNS der Fritzbox -->
<string>REPLACE_VPN_SERVER</string>
<!-- The shared secret for this VPN account. Only present if AuthenticationMethod is SharedSecret. Used for L2TP and Cisco IPSec. -->
<key>SharedSecret</key>
<!-- TODO: shared secret für den VPN Account eingeben. z.B. Shared-Secret-Fritzbox-VPN-User-Config -->
<string>REPLACE_SHARED_SECRET</string>
<!-- 1 if Xauth is on, 0 if it is off. Used for Cisco IPSec. -->
<key>XAuthEnabled</key>
<integer>1</integer>
<!-- User name for VPN account. Used for Cisco IPSec. -->
<key>XAuthName</key>
<!-- TODO VPN Login Name (Gruppenname) eingeben -->
<string>REPLACE_VPN_LOGIN</string>
<!-- Keine Doku zu den Parameter, evl. Xauth auf 0 setzen -->
<key>XAuthPassword</key>
<!-- TODO: VPN Passwort eingeben -->
<string>REPLACE_VPN_PASSWORD</string>
</dict>
<key>IPv4</key>
<dict>
<!-- Specifies whether to send all traffic through the VPN interface. If true, all network traffic is sent over VPN. -->
<key>OverridePrimary</key>
<integer>1</integer>
</dict>
<!-- Optional. A description of the profile, shown on the Detail screen for the profile.
This should be descriptive enough to help the user decide whether to install the profile.
-->
<key>PayloadDescription</key>
<!-- TODO: Beschreibung eingeben -->
<string>Configures VPN settings</string>
<!-- Optional. A human-readable name for the profile. This value is displayed on the Detail screen. It does not have to be unique. -->
<key>PayloadDisplayName</key>
<!-- TODO: Beschreibung eingeben -->
<string>VPN</string>
<!-- A reverse-DNS style identifier (com.example.myprofile, for example) that identifies the profile.
This string is used to determine whether a new profile should replace an existing one or should be added.
-->
<key>PayloadIdentifier</key>
<!-- TODO: Eingeben -->
<string>REPLACE_UUID1.com.apple.vpn.managed.REPLACE_UUID2</string>
<!-- The VPN payload is designated by specifying com.apple.vpn.managed as the PayloadType value. -->
<key>PayloadType</key>
<string>com.apple.vpn.managed</string>
<!-- A globally unique identifier for the payload.
The actual content is unimportant, but it must be globally unique.
In OS X, you can use uuidgen to generate reasonable UUIDs.
-->
<key>PayloadUUID</key>
<!-- TODO: UUID eingeben -->
<string>REPLACE_UUID2</string>
<!-- The version number of the individual payload. A profile can consist of payloads with different version numbers.
For example, changes to the VPN software in iOS might introduce a new payload version to support additional features,
but Mail payload versions would not necessarily change in the same release.
-->
<key>PayloadVersion</key>
<real>1</real>
<key>Proxies</key>
<dict />
<!-- Description of the VPN connection displayed on the device. -->
<key>UserDefinedName</key>
<!-- TODO: Anpassen -->
<string>VPN OnDemand</string>
<!-- Determines the settings available in the payload for this type of VPN connection. IPSec (Cisco)... -->
<key>VPNType</key>
<string>IPSec</string>
</dict>
</array>
<!-- Payload Dictionary Keys Common to All Payloads
If a PayloadContent value is provided in a payload, each entry in the array is a dictionary representing a configuration payload.
The following keys are common to all payloads:
-->
<!-- Optional. A human-readable name for the profile payload. This name is displayed on the Detail screen. It does not have to be unique. -->
<key>PayloadDisplayName</key>
<!-- TODO: Anpassen -->
<string>VPN OnDemand</string>
<!-- A reverse-DNS-style identifier for the specific payload.
It is usually the same identifier as the root-level PayloadIdentifier value with an additional component appended.
-->
<key>PayloadIdentifier</key>
<!-- TODO: UUID eingeben -->
<string>REPLACE_UUID1</string>
<!-- Optional. If present and set to true, the user cannot delete the profile (unless the profile has a removal password and the user provides it). -->
<key>PayloadRemovalDisallowed</key>
<false />
<!-- The only supported value is Configuration. -->
<key>PayloadType</key>
<string>Configuration</string>
<!-- A globally unique identifier for the payload.
The actual content is unimportant, but it must be globally unique.
In OS X, you can use uuidgen to generate reasonable UUIDs.
-->
<key>PayloadUUID</key>
<!-- TODO: UUID einfügen -->
<string>REPLACE_UUID3</string>
<!-- The version number of the individual payload.
A profile can consist of payloads with different version numbers.
For example, changes to the VPN software in iOS might introduce a new payload version to support additional features,
but Mail payload versions would not necessarily change in the same release.
-->
<key>PayloadVersion</key>
<integer>1</integer>
</dict>
</plist>
