Mobile Encryption for iOS does not support on-demand VPN

Products

• Mobile Encryption for iOS
• Encryption Management Server
• Encryption Management Server Powered by PGP Technology

Issue/Introduction

If your iOS device requires an on-demand VPN to connect to your internal network, Symantec Mobile Encryption for iOS will not cause the VPN to start when it tries to connect to your Encryption Management Server.

Please note that Mobile Encryption for iOS reaches EOS (End of Service) on 31 December 2020 and EOL (End of Life) on 31 March 2021.

Environment

• Symantec Mobile Encryption for iOS 2.0 and above.
• Symantec Encryption Management Server 3.4.2 and above.

Cause

Mobile Encryption for iOS is designed to communicate with Encryption Management Server using a fully qualified domain name (FQDN) using standard DNS functionality. Mobile Encryption for iOS was not designed to use on-demand VPN connections.

Symantec Mobile Encryption for iOS resolves DNS names by doing a DNS lookup using cross-platform POSIX calls. This method does not trigger the on-demand VPN.

Resolution

Allow inbound https connections from Mobile Encryption for iOS to Encryption Management Server over the Internet.

Also note that in order to enrol iOS devices, the Encryption Management Server that the iOS devices connect to needs to contain the private keys of the iOS users. iOS users will therefore not be able to enrol against an Encryption Management Server that is a DMZ cluster member.