{
    "properties": {
        "AlwaysOn": {
            "default": {
                "AllowedCaptiveNetworkPlugins": [],
                "ServiceExceptions": [],
                "TunnelConfigurations": [
                    {
                        "AuthenticationMethod": "SharedSecret",
                        "ChildSecurityAssociationParameters": {
                            "DiffieHellmanGroup": 14,
                            "EncryptionAlgorithm": "3DES",
                            "IntegrityAlgorithm": "SHA1-96",
                            "LifeTimeInMinutes": 1440
                        },
                        "DeadPeerDetectionRate": "Medium",
                        "DisableMOBIKE": 0,
                        "DisableRedirect": 0,
                        "EnableCertificateRevocationCheck": 0,
                        "EnablePFS": 0,
                        "IKESecurityAssociationParameters": {
                            "DiffieHellmanGroup": 14,
                            "EncryptionAlgorithm": "3DES",
                            "IntegrityAlgorithm": "SHA1-96",
                            "LifeTimeInMinutes": 1440
                        },
                        "Interfaces": [
                            "Cellular"
                        ],
                        "NATKeepAliveInterval": 110,
                        "NATKeepAliveOffloadEnable": 1,
                        "ProtocolType": "IKEv2",
                        "UseConfigurationAttributeInternalIPSubnet": 0
                    },
                    {
                        "AuthenticationMethod": "SharedSecret",
                        "ChildSecurityAssociationParameters": {
                            "DiffieHellmanGroup": 14,
                            "EncryptionAlgorithm": "3DES",
                            "IntegrityAlgorithm": "SHA1-96",
                            "LifeTimeInMinutes": 1440
                        },
                        "DeadPeerDetectionRate": "Medium",
                        "DisableMOBIKE": 0,
                        "DisableRedirect": 0,
                        "EnableCertificateRevocationCheck": 0,
                        "EnablePFS": 0,
                        "IKESecurityAssociationParameters": {
                            "DiffieHellmanGroup": 14,
                            "EncryptionAlgorithm": "3DES",
                            "IntegrityAlgorithm": "SHA1-96",
                            "LifeTimeInMinutes": 1440
                        },
                        "Interfaces": [
                            "WiFi"
                        ],
                        "NATKeepAliveInterval": 20,
                        "NATKeepAliveOffloadEnable": 1,
                        "ProtocolType": "IKEv2",
                        "UseConfigurationAttributeInternalIPSubnet": 0
                    }
                ]
            },
            "description": "Always On settings",
            "properties": {
                "TunnelConfigurations": {
                    "description": "This array contains an arbitrary number of TunnelConfigurations",
                    "items": {
                        "description": "An item in theTunnelConfigurations array describing an individual configuration",
                        "properties": {
                            "AuthName": {
                                "description": "Username used for authentication",
                                "type": "string"
                            },
                            "AuthPassword": {
                                "description": "Password used for authentication",
                                "type": "string"
                            },
                            "AuthenticationMethod": {
                                "description": "AuthenticationMethod of the IKEv2 client",
                                "type": "string"
                            },
                            "ChildSecurityAssociationParameters": {
                                "default": {
                                    "DiffieHellmanGroup": 14,
                                    "EncryptionAlgorithm": "AES-256",
                                    "IntegrityAlgorithm": "SHA2-256",
                                    "LifeTimeInMinutes": 1440
                                },
                                "description": "Applies to child Security Association",
                                "properties": {
                                    "DiffieHellmanGroup": {
                                        "description": "DiffieHellmanGroup",
                                        "type": "number"
                                    },
                                    "EncryptionAlgorithm": {
                                        "description": "EncryptionAlgorithm",
                                        "type": "string"
                                    },
                                    "IntegrityAlgorithm": {
                                        "description": "IntegrityAlgorithm",
                                        "type": "string"
                                    },
                                    "LifeTimeInMinutes": {
                                        "description": "LifeTimeInMinutes",
                                        "type": "number"
                                    }
                                },
                                "type": "object"
                            },
                            "DeadPeerDetectionRate": {
                                "default": "Low",
                                "description": "Dead peer detection rate; defaults to Medium",
                                "type": "string"
                            },
                            "DisableMOBIKE": {
                                "default": 0,
                                "description": "Set to 1 to disable MOBIKE negotiation in IKEv2",
                                "type": "number"
                            },
                            "DisableRedirect": {
                                "default": 0,
                                "description": "Set to 1 to disable IKEv2 redirect",
                                "type": "number"
                            },
                            "EnableCertificateRevocationCheck": {
                                "default": 0,
                                "description": "Set to 1 to enable certificate revocation check for IKEv2 connections",
                                "type": "number"
                            },
                            "EnablePFS": {
                                "default": 0,
                                "description": "Set to 1 to enable Perfect Forward Secrecy for IKEv2 connections",
                                "type": "number"
                            },
                            "ExtendedAuthEnabled": {
                                "default": 0,
                                "description": "Set to 1 to enable extended authentication (EAP)",
                                "type": "number"
                            },
                            "IKESecurityAssociationParameters": {
                                "default": {
                                    "DiffieHellmanGroup": 14,
                                    "EncryptionAlgorithm": "AES-256",
                                    "IntegrityAlgorithm": "SHA2-256",
                                    "LifeTimeInMinutes": 1440
                                },
                                "description": "Applies to child Security Association",
                                "properties": {
                                    "DiffieHellmanGroup": {
                                        "description": "DiffieHellmanGroup",
                                        "type": "number"
                                    },
                                    "EncryptionAlgorithm": {
                                        "description": "EncryptionAlgorithm",
                                        "type": "string"
                                    },
                                    "IntegrityAlgorithm": {
                                        "description": "IntegrityAlgorithm",
                                        "type": "string"
                                    },
                                    "LifeTimeInMinutes": {
                                        "description": "LifeTimeInMinutes",
                                        "type": "number"
                                    }
                                },
                                "type": "object"
                            },
                            "LocalIdentifier": {
                                "description": "Identifier of the IKEv2 client",
                                "type": "string"
                            },
                            "NATKeepAliveInterval": {
                                "default": 20,
                                "description": "NAT Keepalive interval for Always-on VPN IKEv2 connections. This value controls the interval over which Keepalive offload packets are sent by the device. The minimum value is 20 seconds. If no key is specified, the default is 20 seconds over Wi-Fi and 110 seconds over Cellular interface.",
                                "type": "number"
                            },
                            "NATKeepAliveOffloadEnable": {
                                "default": 1,
                                "description": "Set to 1 to enable NAT Keepalive offload for Always-on VPN IKEv2 connections",
                                "type": "number"
                            },
                            "PayloadCertificateUUID": {
                                "description": "The UUID of the identity certificate as the account credential",
                                "type": "string"
                            },
                            "RemoteAddress": {
                                "description": " IP address or hostname of the VPN server",
                                "type": "string"
                            },
                            "RemoteIdentifier": {
                                "description": "Remote Identifier of the IKEv2 client",
                                "type": "string"
                            },
                            "ServerCertificateCommonName": {
                                "description": "Common Name of the server certificate",
                                "type": "string"
                            },
                            "ServerCertificateIssuerCommonName": {
                                "description": "Common Name of the server certificate issuer",
                                "type": "string"
                            },
                            "SharedSecret": {
                                "description": "Value for IKE authentication",
                                "type": "string"
                            },
                            "UseConfigurationAttributeInternalIPSubnet": {
                                "default": 0,
                                "description": "Set to 1 to indicate if negotiation should use IKEv2 Configuration Attribute INTERNAL_IP4_SUBNET and INTERNAL_IP6_SUBNET.",
                                "type": "number"
                            }
                        },
                        "type": "object"
                    },
                    "type": "array"
                }
            },
            "type": "object"
        },
        "DisconnectOnIdle": {
            "default": 0,
            "description": "DisconnectOnIdle",
            "type": "number"
        },
        "DisconnectOnIdleTimer": {
            "description": "DisconnectOnIdleTimer",
            "type": "number"
        },
        "EAP": {
            "description": "Dictionary containing EAP settings",
            "properties": {},
            "type": "object"
        },
        "IKEv2": {
            "default": {
                "AuthenticationMethod": "SharedSecret",
                "ChildSecurityAssociationParameters": {
                    "DiffieHellmanGroup": 14,
                    "EncryptionAlgorithm": "3DES",
                    "IntegrityAlgorithm": "SHA1-96",
                    "LifeTimeInMinutes": 1440
                },
                "DeadPeerDetectionRate": "Medium",
                "DisableMOBIKE": 0,
                "DisableRedirect": 0,
                "EnableCertificateRevocationCheck": 0,
                "EnablePFS": 0,
                "IKESecurityAssociationParameters": {
                    "DiffieHellmanGroup": 14,
                    "EncryptionAlgorithm": "3DES",
                    "IntegrityAlgorithm": "SHA1-96",
                    "LifeTimeInMinutes": 1440
                },
                "UseConfigurationAttributeInternalIPSubnet": 0
            },
            "description": "IKEv2 settings",
            "properties": {
                "AuthName": {
                    "description": "Username used for authentication",
                    "type": "string"
                },
                "AuthPassword": {
                    "description": "Password used for authentication",
                    "type": "string"
                },
                "AuthenticationMethod": {
                    "description": "AuthenticationMethod of the IKEv2 client",
                    "enum": [
                        "SharedSecret",
                        "Certificate",
                        "None"
                    ],
                    "type": "string"
                },
                "CertificateType": {
                    "description": "Type of the certificate; defaults to RSA",
                    "type": "string"
                },
                "ChildSecurityAssociationParameters": {
                    "default": {
                        "DiffieHellmanGroup": 14,
                        "EncryptionAlgorithm": "3DES",
                        "IntegrityAlgorithm": "SHA-96",
                        "LifeTimeInMinutes": 1440
                    },
                    "description": "Applies to child Security Association",
                    "properties": {
                        "DiffieHellmanGroup": {
                            "description": "DiffieHellmanGroup",
                            "type": "number"
                        },
                        "EncryptionAlgorithm": {
                            "description": "EncryptionAlgorithm",
                            "type": "string"
                        },
                        "IntegrityAlgorithm": {
                            "description": "IntegrityAlgorithm",
                            "type": "string"
                        },
                        "LifeTimeInMinutes": {
                            "description": "LifeTimeInMinutes",
                            "type": "number"
                        }
                    },
                    "type": "object"
                },
                "DeadPeerDetectionRate": {
                    "default": "Medium",
                    "description": "Dead peer detection rate",
                    "enum": [
                        "None",
                        "Low",
                        "Medium",
                        "High"
                    ],
                    "type": "string"
                },
                "DisableMOBIKE": {
                    "default": 0,
                    "description": "Set to 1 to disable MOBIKE negotiation in IKEv2",
                    "type": "number"
                },
                "DisableRedirect": {
                    "default": 0,
                    "description": "Set to 1 to disable IKEv2 redirect",
                    "type": "number"
                },
                "DomainName": {
                    "description": "The primary domain of the tunnel",
                    "type": "string"
                },
                "EnableCertificateRevocationCheck": {
                    "default": 0,
                    "description": "Optional. Set to 1 to enable a certificate revocation check for IKEv2 connections. This is a best-effort revocation check; server response timeouts will not cause it to fail.",
                    "type": "number"
                },
                "EnablePFS": {
                    "default": 0,
                    "description": "Set to 1 to enable Perfect Forward Secrecy for IKEv2 connections",
                    "type": "number"
                },
                "ExtendedAuthEnabled": {
                    "default": 0,
                    "description": "Set to 1 to enable extended authentication (EAP)",
                    "type": "number"
                },
                "IKESecurityAssociationParameters": {
                    "default": {
                        "DiffieHellmanGroup": 14,
                        "EncryptionAlgorithm": "3DES",
                        "IntegrityAlgorithm": "SHA-96",
                        "LifeTimeInMinutes": 1440
                    },
                    "description": "Applies to child Security Association",
                    "properties": {
                        "DiffieHellmanGroup": {
                            "description": "DiffieHellmanGroup",
                            "type": "number"
                        },
                        "EncryptionAlgorithm": {
                            "description": "EncryptionAlgorithm",
                            "type": "string"
                        },
                        "IntegrityAlgorithm": {
                            "description": "IntegrityAlgorithm",
                            "type": "string"
                        },
                        "LifeTimeInMinutes": {
                            "description": "LifeTimeInMinutes",
                            "type": "number"
                        }
                    },
                    "type": "object"
                },
                "LocalIdentifier": {
                    "description": "Identifier of the IKEv2 client",
                    "type": "string"
                },
                "NATKeepAliveInterval": {
                    "description": "NAT Keepalive interval for Always On VPN IKEv2 connections",
                    "type": "number"
                },
                "NATKeepAliveOffloadEnable": {
                    "default": 1,
                    "description": "Set to 1 to enable or 0 to disable NAT Keepalive offload for Always On VPN IKEv2 connections",
                    "type": "number"
                },
                "PayloadCertificateUUID": {
                    "description": "The UUID of the identity certificate as the account credential",
                    "type": "string"
                },
                "RemoteAddress": {
                    "description": " IP address or hostname of the VPN server",
                    "type": "string"
                },
                "RemoteIdentifier": {
                    "description": "Remote Identifier of the IKEv2 client",
                    "type": "string"
                },
                "SearchDomains": {
                    "description": "A list of domain strings used to fully qualify single-label host names.",
                    "type": "array"
                },
                "ServerAddresses": {
                    "description": "An array of DNS server IP address strings (IPv4 or IPv6)",
                    "type": "array"
                },
                "ServerCertificateCommonName": {
                    "description": "Common name of the server certificate",
                    "type": "string"
                },
                "ServerCertificateIssuerCommonName": {
                    "description": "Common Name of the server certificate issuer",
                    "type": "string"
                },
                "SharedSecret": {
                    "description": "Value for IKE authentication",
                    "type": "string"
                },
                "SupplementalMatchDomains": {
                    "description": "A list of domain strings used to determine which DNS queries will use the DNS resolver settings contained in ServerAddresses.",
                    "type": "array"
                },
                "SupplementalMatchDomainsNoSearch": {
                    "default": 0,
                    "description": "Optional. Whether (0) or not (1) the domains in the SupplementalMatchDomains list should be appended to the resolver\u2019s list of search domains. Default is 0.",
                    "maximum": 1,
                    "minimum": 0,
                    "type": "number"
                },
                "UseConfigurationAttributeInternalIPSubnet": {
                    "default": 0,
                    "description": "Set to 1 to indicate if negotiation should use IKEv2 Configuration Attribute INTERNAL_IP4_SUBNET and INTERNAL_IP6_SUBNET.",
                    "type": "number"
                }
            },
            "type": "object"
        },
        "IPSec": {
            "default": {
                "AuthenticationMethod": "SharedSecret",
                "LocalIdentifierType": "KeyID"
            },
            "description": "Dictionary containing IPSec settings",
            "properties": {
                "AuthenticationMethod": {
                    "description": "Authentication method. Either shared secret or certificate",
                    "enum": [
                        "SharedSecret",
                        "Certificate"
                    ],
                    "type": "string"
                },
                "LocalIdentifier": {
                    "description": "The name of the group to use. If Hybrid Authentication is used, the string must end with \"[hybrid]\"",
                    "type": "string"
                },
                "LocalIdentifierType": {
                    "description": "Present only if AuthenticationMethod = SharedSecret. Must be \"KeyID\"",
                    "enum": [
                        "KeyID"
                    ],
                    "type": "string"
                },
                "OnDemandEnabled": {
                    "description": "Enable VPN On Demand",
                    "enum": [
                        0,
                        1
                    ],
                    "type": "number"
                },
                "OnDemandMatchDomainsAlways": {
                    "description": "",
                    "items": {
                        "description": "Match domain or host",
                        "type": "string"
                    },
                    "type": "array"
                },
                "OnDemandMatchDomainsNever": {
                    "description": "",
                    "items": {
                        "description": "Match domain or host",
                        "type": "string"
                    },
                    "type": "array"
                },
                "OnDemandMatchDomainsOnRetry": {
                    "description": "",
                    "items": {
                        "description": "Match domain or host",
                        "type": "string"
                    },
                    "type": "array"
                },
                "OnDemandRules": {
                    "description": "An array of dictionaries defining On Demand Rules",
                    "items": {
                        "description": "An On Demand rule",
                        "properties": {
                            "Action": {
                                "description": "On Demand Action",
                                "enum": [
                                    "Allow",
                                    "Ignore",
                                    "Connect",
                                    "Disconnect"
                                ],
                                "type": "string"
                            },
                            "DNSDomainMatch": {
                                "description": "An array of DNS addresses",
                                "items": {
                                    "description": "A DNS address. May include wildcards",
                                    "type": "string"
                                },
                                "type": "array"
                            },
                            "DNSServerAddressMatch": {
                                "description": "An array of DNS Server Addresses",
                                "items": {
                                    "description": "A DNS server address. May include wildcards",
                                    "type": "string"
                                },
                                "type": "array"
                            },
                            "URLStringProbe": {
                                "description": "A test URL",
                                "type": "string"
                            }
                        },
                        "type": "object"
                    },
                    "type": "array"
                },
                "PayloadCertificateUUID": {
                    "description": "The UUID of the certificate to use for account credentials",
                    "type": "string"
                },
                "PromptForVPNPIN": {
                    "description": "If set, user will be prompted for a PIN when connecting",
                    "type": "boolean"
                },
                "RemoteAddress": {
                    "description": "IP address or hostname of the VPN server",
                    "type": "string"
                },
                "SharedSecret": {
                    "description": "The shared secret for this VPN account",
                    "type": "string"
                },
                "XAuthEnabled": {
                    "description": "1 if XAUTH is ON, 0 if XAUTH is OFF",
                    "enum": [
                        0,
                        1
                    ],
                    "type": "number"
                },
                "XAuthName": {
                    "description": "Username for VPN account",
                    "type": "string"
                },
                "XAuthPassword": {
                    "description": "Password for VPN account",
                    "type": "string"
                },
                "XAuthPasswordEncryption": {
                    "description": "String value is either \"Prompt\" or not present",
                    "enum": [
                        "Prompt"
                    ],
                    "type": "string"
                }
            },
            "type": "object"
        },
        "IPv4": {
            "default": {
                "OverridePrimary": 0
            },
            "description": "Dictionary containing IPv4 settings",
            "properties": {
                "OverridePrimary": {
                    "default": 0,
                    "description": "If set, all network traffic is sent over the VPN interface",
                    "enum": [
                        0,
                        1
                    ],
                    "type": "number"
                }
            },
            "type": "object"
        },
        "PPP": {
            "default": {},
            "description": "PPP Settings",
            "properties": {
                "AuthEAPPlugins": {
                    "description": "Only present if RSA SecurID is being used, in which case it has one string entry: EAP-RSA",
                    "items": {
                        "description": "String inside EAP Plugins array. If present, must be \"EAP-RSA\"",
                        "enum": [
                            "EAP-RSA",
                            "EAP-TLS",
                            "EAP-KRB"
                        ],
                        "type": "string"
                    },
                    "type": "array"
                },
                "AuthName": {
                    "description": "The VPN account username",
                    "type": "string"
                },
                "AuthPassword": {
                    "description": "The VPN user password",
                    "type": "string"
                },
                "AuthProtocol": {
                    "description": "Only present if RSA SecurID is being used, in which case it has one string entry: EAP",
                    "items": {
                        "description": "String inside Auth Protocol array. If present, must be \"EAP\"",
                        "enum": [
                            "EAP"
                        ],
                        "type": "string"
                    },
                    "type": "array"
                },
                "CCPEnabled": {
                    "description": "Enables encryption on the connection. If this key and CCPMPPE40Enabled are true, represents automatic encryption level; if this key and CCPMPPE128Enabled are true, represents maximum encryption level. If no encryption is used, then none of the CCP keys are true.\n",
                    "enum": [
                        0,
                        1
                    ],
                    "type": "number"
                },
                "CCPMPPE128Enabled": {
                    "description": "Enables encryption on the connection. If this key and CCPEnabled are true, represents automatic encryption level\n",
                    "enum": [
                        0,
                        1
                    ],
                    "type": "number"
                },
                "CCPMPPE40Enabled": {
                    "description": "Enables encryption on the connection. If this key and CCPEnabled are true, represents maximum encryption level\n",
                    "enum": [
                        0,
                        1
                    ],
                    "type": "number"
                },
                "CommRemoteAddress": {
                    "description": "IP address or hostname of VPN server",
                    "type": "string"
                },
                "TokenCard": {
                    "description": "Use a token card such as an RSA SecurID card for connecting",
                    "type": "boolean"
                }
            },
            "type": "object"
        },
        "PayloadDescription": {
            "default": "Configures VPN settings",
            "description": "Description of the payload",
            "type": "string"
        },
        "PayloadDisplayName": {
            "default": "VPN",
            "description": "Name of the payload",
            "type": "string"
        },
        "PayloadIdentifier": {
            "default": "com.apple.vpn.managed",
            "description": "A unique identifier for the payload, dot-delimited.  Usually root PayloadIdentifier+subidentifier",
            "type": "string"
        },
        "PayloadOrganization": {
            "description": "This value describes the issuing organization of the profile, as displayed to the user",
            "type": "string"
        },
        "PayloadType": {
            "default": "com.apple.vpn.managed",
            "description": "The type of the payload, a reverse dns string",
            "type": "string"
        },
        "PayloadUUID": {
            "default": "",
            "description": "Unique identifier for the payload (format 01234567-89AB-CDEF-0123-456789ABCDEF)",
            "pattern": "^[0-9A-Za-z]{8}-[0-9A-Za-z]{4}-[0-9A-Za-z]{4}-[0-9A-Za-z]{4}-[0-9A-Za-z]{12}$",
            "type": "string"
        },
        "PayloadVersion": {
            "default": 1,
            "description": "The version of the whole configuration profile.",
            "type": "number"
        },
        "Proxies": {
            "default": {
                "HTTPEnable": 0,
                "HTTPSEnable": 0
            },
            "description": "Proxies",
            "properties": {
                "HTTPEnable": {
                    "description": "",
                    "enum": [
                        0,
                        1
                    ],
                    "type": "number"
                },
                "HTTPPort": {
                    "description": "",
                    "maximum": 65535,
                    "minimum": 0,
                    "type": "number"
                },
                "HTTPProxy": {
                    "description": "Proxy URL",
                    "type": "string"
                },
                "HTTPProxyPassword": {
                    "description": "",
                    "type": "string"
                },
                "HTTPProxyUsername": {
                    "description": "",
                    "type": "string"
                },
                "HTTPSEnable": {
                    "description": "",
                    "enum": [
                        0,
                        1
                    ],
                    "type": "number"
                },
                "HTTPSPort": {
                    "description": "",
                    "maximum": 65535,
                    "minimum": 0,
                    "type": "number"
                },
                "HTTPSProxy": {
                    "description": "",
                    "type": "string"
                },
                "ProxyAutoConfigEnable": {
                    "description": "",
                    "enum": [
                        0,
                        1
                    ],
                    "type": "number"
                },
                "ProxyAutoConfigURLString": {
                    "description": "",
                    "type": "string"
                },
                "ProxyAutoDiscoveryEnable": {
                    "default": 1,
                    "description": "",
                    "enum": [
                        0,
                        1
                    ],
                    "type": "number"
                }
            },
            "type": "object"
        },
        "UserDefinedName": {
            "description": "Description of the VPN connection displayed on the device",
            "type": "string"
        },
        "VPN": {
            "default": {
                "AuthenticationMethod": "Password"
            },
            "description": "VPN Settings",
            "properties": {
                "AuthName": {
                    "description": "The VPN account username",
                    "type": "string"
                },
                "AuthPassword": {
                    "description": "The VPN user password",
                    "type": "string"
                },
                "AuthenticationMethod": {
                    "description": "Authentication method. Either shared secret or certificate",
                    "enum": [
                        "Password",
                        "Certificate",
                        "Password+Certificate"
                    ],
                    "type": "string"
                },
                "DisconnectOnIdle": {
                    "description": "Disconnect after an on demand connection idles",
                    "enum": [
                        0,
                        1
                    ],
                    "type": "number"
                },
                "DisconnectOnIdleTimer": {
                    "description": "Length of time to wait before disconnecting an on demand connection",
                    "type": "number"
                },
                "OnDemandEnabled": {
                    "description": "Enable VPN On Demand",
                    "enum": [
                        0,
                        1
                    ],
                    "type": "number"
                },
                "OnDemandMatchDomainsAlways": {
                    "description": "",
                    "items": {
                        "description": "Match domain or host",
                        "type": "string"
                    },
                    "type": "array"
                },
                "OnDemandMatchDomainsNever": {
                    "description": "",
                    "items": {
                        "description": "Match domain or host",
                        "type": "string"
                    },
                    "type": "array"
                },
                "OnDemandMatchDomainsOnRetry": {
                    "description": "",
                    "items": {
                        "description": "Match domain or host",
                        "type": "string"
                    },
                    "type": "array"
                },
                "OnDemandRules": {
                    "description": "An array of dictionaries defining On Demand Rules",
                    "items": {
                        "description": "An On Demand rule",
                        "properties": {
                            "Action": {
                                "description": "On Demand Action",
                                "enum": [
                                    "Allow",
                                    "Ignore",
                                    "Connect",
                                    "Disconnect"
                                ],
                                "type": "string"
                            },
                            "DNSDomainMatch": {
                                "description": "An array of DNS addresses",
                                "items": {
                                    "description": "A DNS address. May include wildcards",
                                    "type": "string"
                                },
                                "type": "array"
                            },
                            "DNSServerAddressMatch": {
                                "description": "An array of DNS Server Addresses",
                                "items": {
                                    "description": "A DNS server address. May include wildcards",
                                    "type": "string"
                                },
                                "type": "array"
                            },
                            "URLStringProbe": {
                                "description": "A test URL",
                                "type": "string"
                            }
                        },
                        "type": "object"
                    },
                    "type": "array"
                },
                "PayloadCertificateUUID": {
                    "description": "The UUID of the certificate to use for account credentials",
                    "type": "string"
                },
                "RemoteAddress": {
                    "description": "Hostname or IP address for server",
                    "type": "string"
                }
            },
            "type": "object"
        },
        "VPNSubType": {
            "description": "If VPNType is \"VPN\" this field will be an identifier for a vendor specified configuration dictionary",
            "type": "string"
        },
        "VPNType": {
            "default": "L2TP",
            "description": "Determines the settings available for this VPN payload",
            "enum": [
                "L2TP",
                "PPTP",
                "IPSec",
                "VPN",
                "IKEv2",
                "AlwaysOn"
            ],
            "type": "string"
        },
        "VendorConfig": {
            "default": {},
            "description": "A vendor specific configuration dictionary",
            "properties": {
                "Group": {
                    "description": "Group to connect to on the head end. Valid only for Cisco AnyConnect",
                    "type": "string"
                },
                "LoginGroupOrDomain": {
                    "description": "Login Group or Domain",
                    "type": "string"
                },
                "Realm": {
                    "description": "Realm to connect to on the server",
                    "type": "string"
                },
                "Role": {
                    "description": "Role to select when connecting to the server. Valid only for Juniper SSL",
                    "type": "string"
                }
            },
            "type": "object"
        }
    },
    "title": "com.apple.vpn.managed",
    "type": "object"
}