By Tyler Castaldo | Intune PM
As you may have noticed through your own testing, a change has been made in VPN functionality in iOS 12, the next iOS release that is still in beta. As such, several companies including Cisco, F5, and Palo Alto have announced either through their own release notes or through documentation that these older VPN client(s) for iOS will not be supported in iOS 12 and beyond:
- Cisco Legacy AnyConnect
- F5 Access Legacy/F5 Access 2.1 and earlier
- Palo Alto Networks GlobalProtect 4.1 and earlier
If you are using Cisco Legacy AnyConnect, you should move to Cisco AnyConnect, which is supported today. See this blog post for details. We are working to support two new VPN clients for the impacted vendors in Intune as soon as we can to allow you time to migrate before iOS 12 is released to the public. These VPN’s include:
- F5 Access 2018/F5 Access 3.0 and later
- Palo Alto Networks GlobalProtect 5.0 and later
If you would like to switch to the new F5 and Palo Alto VPN clients now, you can do this by using the Custom VPN connection type for iOS VPN profiles; however there’s a few gotcha’s we thought you should know:
- Per-app VPN will not work. Even though the per-app VPN option is available in the UI, there are framework changes that will prevent this from working with the new clients.
- Network access control (NAC) will not work, even if your environment is configured for it.
Custom VPN profiles are created using the Custom VPN connection type, as documented here: https://docs.microsoft.com/intune/vpn-settings-ios#custom-vpn-settings
Support for per-app VPN will be included when we add support for the new F5 and Palo Alto clients. NAC support will be dependent on our NAC partners' timelines to make the necessary updates for integration with Intune.
Intune will continue to support the existing VPN options and functionality for devices on older supported versions of iOS. As a reminder, we announced deprecation of iOS 9 a few months back and will move to support iOS 10+ when iOS 12 is released. Please keep this in mind in your own testing.