Deploy Client on iOS Using Omnissa Workspace ONE

Profiles manage the core configuration for Client installation. The following sections detail how to configure these profiles effectively.

Administrators must choose the VPN profile type that best fits their requirements, either On-Demand VPN or Per-App VPN.

On-Demand VPN

The following steps explain how to configure a Profile for an On‑Demand VPN deployment.

1. Go to Resources > Profiles & Baselines > Profiles.

2. Click Add Profile from the Add dropdown options.

3. Select Apple iOS from the platform list.

4. Select Device Profile in Select Context and click Next.

5. Enter a unique Profile name. For example, Netskope Client Configuration Profile.

6. Start typing VPN in the search text box of the configuration profile.

7. Expand VPN and click Add.

8. Configure the following settings to allow access to a service or an app:

   • Connection Name: Enter a descriptive name for the Connection Name.

   • Connection Type: Select Custom.

   • Identifier: com.netskope.Netskope

   • Server:  Enter your VPN server name from the Netskope UI. For example, gateway-<tenant-URL>.

   • Account: Click the + symbol and select EnrollmentUserID.

   • Custom Data: Add the following Key:value pairs:

     • OrgKey: Use the tenant organizational key

     • AddonHost: Use the addon URL for the tenant: addon-<tenant-URL>.

     • UserEmail: Use the variable that contains the user identity for the enrollment: {EmailAddress}

     • enrollauthtoken: ​​ Enter the Authentication Token.

     • ​​enrollencryptiontoken:​​ Enter the Encryption token(Optional).

     • ForceDisabledSteering: True.

       Use this key-value pair if you want Netskope Client to steer only Private Access traffic.

     

   • User Authentication: Select Certificate.

   • Enable VPN On Demand: Select the checkbox to enable this option.

   • Use new on-demand Keys: Select the checkbox to enable this option.

9. Click Next.

10. Enter these parameters:

    • Smart Groups: Start typing to select a smart group.

    • Exclusions: No

    • Deployment: Managed

    • Assignment Type: Auto

    • Allow Removal: Always( You can select the desired option)

    • Managed By: Netskope Inc.

11. Click Save & Publish.

    Per-App VPN

    The following steps explain how to configure a Profile for a Per-App VPN deployment.

    1. Go to Resources > Profiles & Baselines > Profiles.

    2. Click Add Profile from the Add dropdown options.

    3. Select Apple iOS from the platform list.

    4. Select Device Profile in Select Context and click Next.

    5. Enter a unique Profile name. For example, Netskope Client Configuration Profile.

    6. Start typing VPN in the search text box of the configuration profile.

    7. Expand VPN and click Add.

    8. Configure the following settings to allow access to a service or an app:

       • Connection Name: Enter a descriptive name for the Connection Name.

       • Connection Type: Select Custom.

       • Identifier: com.netskope.Netskope

       • Server:  Enter your VPN server name from the Netskope UI. For example, gateway-<tenant-URL>.

       • Account: Click the + symbol and select EnrollmentUserID.

       • Custom Data: Add the following Key:value pairs:

         • OrgKey: Use the tenant organizational key

         • AddonHost: Use the addon URL for the tenant: addon-<tenant-URL>.

         • UserEmail: Use the variable that contains the user identity for the enrolment: {EmailAddress}

         • enrollauthtoken: ​​ Enter the Authentication Token.

         • ​​enrollencryptiontoken:​​ Enter the Encryption token(Optional).

         • ForceDisabledSteering: True.

           Use this key-value pair if you want Netskope Client to steer only Private Access traffic.

         • OnDemandConnectionsHoldTimeout: 20

           To define timeout to control the iOS On-demand connections hold feature, add the key-value pair: OnDemandConnectionsHoldTimeout: <numeric value in seconds>. This numeric value in the VPN profile can hold the connection for a longer time until it establishes the tunnel successfully and handles traffic. Netskope recommends using values that are large enough to cover normal connection time.

         

       • Per-App VPN Rules: Toggle to enable this option.

       • Connect Automatically: Toggle to enable this option.

       • Provider Type: Select Packet Tunnel from the options in the dropdown menu.

       • User Authentication: Select Certificate.

    9. Click Next.

    10. Enter these parameters:

        • Smart Groups: Start typing to select a smart group.

        • Exclusions: No

        • Deployment: Managed

        • Assignment Type: Auto

        • Allow Removal: Always( You can select the desired option)

        • Managed By: Netskope Inc.

    11. Click Save & Publish.

Associate Per-App VPN Profile With Managed App Configuration

The following section describes the steps to associate managed applications with Per-App VPN profile in Omnissa Workspace ONE.

1. Go to Resources > Apps > Native.

2. Click the Public tab.

3. Select managed application (For example, Box) and click the application.

4. Click Assignment and click on assignment rule.

5. Select Tunnel & Other Attributes, click Edit and select Per-App VPN profile from the dropdown.

6. Click Save and Publish.

Zero-Touch Enrollment

Netskope client is capable of enrolling silently without any user action when enrollment data supplied through a VPN profile. For a limited number of use cases such as testing mapped to single identity, kiosks deployments and alike enrollment data should be populated through VPN profile and email key must use static email address value (which is provisioned in Netskope tenant).

Push Netskope Root and Tenant Certificates

Provide additional trust to end users by pushing certificates during client installation. Before you can push the root and tenant certificates, ensure that you do the following:

Public Apple Store

The following section describes the steps to add the application from the public store in Omnissa Workspace ONE.

Perform the following steps to add Netskope Client:

1. Go to Resources > Apps > Native.

2. Click the Public tab.

3. Click +ADD APPLICATION.

4. Select Apple iOS from the Platform dropdown menu.

5. In Source, click SEARCH APP STORE.

Purchased App via Apple Business / School Manager

Purchase Netskope Client through the respective tools if your organization is leveraging Apple Business Manager or Apple School Manager. The Netskope Client shows up in the list of applications available for deployment after the tokens are synchronized.

1. Go to Resources > Apps > Native.

2. Click Purchased tab.

3. Click +Select for Netskope Client application.

   

To configure the assignment settings:

1. In the Add Application – Netskope Client window, click Save & Assign.

   

2. After you click Save & Assign, it navigates to the assignment configuration for the App.

3. In Netskope Client – Assignment > Distribution, enter the assignment Name and select a target smart group.

4. In Netskope Client – Assignment > Restrictions, configure the app restrictions.

5. Click Create and save the assignments.

6. Click Publish once you review the app setting.