Android Legacy policies

Allows a device factory reset.

• Disallow — Factory reset using the hardware button is prevented. However, factory reset using the firmware update utility cannot be prevented.

Allows you to shut down and power off the device.

• Disallow — The power off option menu does not appear even with the use of a power button. However, powering off by separating the battery cannot be prevented. Factory reset is prohibited if this policy is disallowed.

Allows backup of the device data.

Allows using the camera.

Allows the clipboard feature throughout the

entire system.

• Allow within the same app — Allows using the clipboard feature only within the same application.

Check the check box to select the storage to be encrypted.

Allows writing to an external SD card.

Select the control function to be triggered if device OS tampering is detected.

• Lock device — Locks the device.

• Factory reset + Initialize SD card — Simultaneously factory resets the user device and the SD card.
• Factory reset (only) — Resets the user device but not the SD card.

Specifies to run or install EMM applications other than the Knox Manage application.

• Allow — Allows installing or enabling EMM applications.
• Disallow installation — Disallows installing EMM applications.
• Disallow activation — Disallows enabling EMM applications.

Allows installing or activating select EMM applications by adding them to the allowlist. This policy is available only when the Device Administrator to Install and Activate apps policy is set to Disallow installation or Disallow activation.

• To add an application, click Add, and then select applications in the Select Application window.
• To delete an application, click next to the added application.
• Disallow installation — Only the allowed applications can be installed.
• Disallow activation — Only the allowed applications can be activated.

Allows setting the default number of background processes.

If this policy is disabled, the number of background processes is set to the maximum number.

Enables closing all running applications when the user signs out of the device.

If this policy is disabled, the activation setting is disabled on the device and the user cannot control the device settings.

Allows using the mock location, which specifies an arbitrary location for development or test purposes.

Use this policy if location information from the Update Device Information of the Send Device Command seems incorrect.

Enter the text for the reboot manager. You can enter up to 1000 bytes.

Enter a domain blocklist that should not be used when registering an Exchange or email account.

• To add a domain, enter the domain name in the field, and click Add.
• To delete a domain, click next to the added domain name.

Set the maximum number of attempts for connecting to the NTP server to retrieve the time information.

The value can be between 1–100 times.

Set the cycle to reconnect to the server using NTP.

The value can be between 1–8760 hours (8760 = 1 year).

Set the cycle to re-connect to the NTP server after experiencing a timeout.

The value can be between 1–1000 seconds.

Set the connection timeout on the NTP server.

The value can be between 1–1000 seconds.

Sets the device to display notifications when a device control event is applied.

User Defined — Users can set event notifications on the device from the Settings menu of Knox Manage agent.

Show notification — Displays the notification when an event for device control is applied.

Hide notifications — Hides the notification when an event for device control is applied.

Sets the device to display the notifications when an event for device control is disengaged.

• User Defined — Users can set event notifications on the device from the Settings menu of Knox Manage agent.
• Show notification — Displays a notification when an event for device control is disengaged.
• Hide notifications — Hides a notification when an event for device control is disengaged.

Set the removal of the notification from the device Quick panel.

• User Defined — Users can remove notification on the device from the settings menu of Knox Manage agent.
• Disallow to Remove Notification — Users cannot remove notifications on the device Quick Panel.
• Allow to Remove Notification — Users can remove notifications on the device Quick Panel.

Allows using the hardware key on the device to update firmware.

• Disallow — Disallows updating firmware with the hardware key and performing a factory reset.

Allows using Wi-Fi. If the Wi-Fi policy is not applied successfully, the device tries to apply it again 30 minutes later after Knox Manage is activated.

• Allow — Allows using Wi-Fi.
• Disable On — Disallows turning on Wi-Fi. It is turned off at all times.
• Disable Off — Disallows turning off Wi-Fi. It is turned on at all times.

Allows use of the Wi-Fi Direct (Wi-Fi P2P) connection.

Allows using the Wi-Fi SSID allowlist. Devices can only connect to the Wi-Fi APs on the allowlist.

Add Wi-Fi APs to the allowlist. This policy is irrelevant to adding or deleting the Wi-Fi setting profile.

• To add a Wi-Fi AP, enter a Wi-Fi SSID and click Add.
• To add all Wi-Fi APs, click Add all to access the Wi-Fi list.
• To delete a Wi-Fi AP, select a Wi-Fi SSID and click .

Android 1 (SDK1) and higher

Samsung Knox 1.0 and higher

Allows using the Wi-Fi SSID blocklist. Devices cannot connect to Wi-Fi APs on the blocklist.

Add Wi-Fi APs to the blocklist. This policy is irrelevant to adding or deleting the Wi-Fi setting profile.

• To add a Wi-Fi AP, enter a Wi-Fi SSID and click Add.
• To add all Wi-Fi APs, click Add all to access the Wi-Fi list.
• To delete a Wi-Fi AP, select a Wi-Fi SSID and click .

Set a minimum security level for Wi-Fi.

The security level increases in the following ascending order: OPEN < WEP < WPA < LEAP, PWD < FAST, PEAP < TSL, TTLS, SIM, AKA, AKA'

Block a device's Wi-Fi proxy information from showing on the device. When this policy is set, device users cannot see the proxy menu under device settings > Wi-Fi.

• N/A — No settings
• Allow — Allow users to configure Wi-Fi proxy with the device
• Disallow — Disallow users from configuring Wi-Fi proxy with the device.

Allows using Bluetooth.

• Allow — Allows using Bluetooth.
• Disable On — Disallows turning on Bluetooth. It is turned off at all times.
• Disable Off — Disallows turning off Bluetooth. It is turned on at all times.

Select a method to connect Bluetooth devices based on their Universal Unique Identifier (UUID).

• Blocklist configuration — Set a device to block Bluetooth connections from certain devices.
• Allowlist configuration — Set a device to allow Bluetooth connections to certain devices.

Select devices to block Bluetooth connections with. Click the check boxes for Audio, File transfer, Phonebook, Headsets, or Hands-free.

Select devices to allow Bluetooth connections with. Click the check boxes for Audio, File transfer, Phonebook, Headsets, or Hands-free.

Allows NFC (Near Field Communication) control.

• Samsung Knox 2.4 and higher is supported for Knox Workspace devices.
• Android 10 and higher devices are not supported.

Allows a device connection using OTG (On the Go). OTG controls only the storage items and not the non-storage items, such as a keyboard or mouse.

Allows using GPS.

• Allow — Allows using GPS.
• Disable On — Disallows turning on GPS. It is turned off at all times.
• Disable Off — Disallows turning off GPS. It is turned on at all times.

Set the password for the device screen lock. Use of the camera is prohibited when the device is screen locked.

Allow or disallow users from setting the Secure Startup feature on devices.

When Secure Startup is set and the user enters the wrong password 30 times, the device is factory reset even if you have restricted factory resets through a policy. To avoid this situation, set this policy to Disallow.

Set the minimum password strength on the screen.

The password strength increases in the following ascending order: Pattern < Numeric < Must be alphanumeric < Must include special characters.

• Pattern — Set the password using a pattern or a password with a higher degree of complexity.
• Numeric — Set the password using numbers or a password with a higher degree of complexity.
• Alphanumeric — Set the password using alphanumeric characters or a password with a higher degree of complexity.
• Complex — Set it so that the passwords must include alphanumeric and special characters.

Set the maximum number of incorrect password attempts before access is restricted.

The value can be between 1 - 10 times.

Select the action to be performed when the maximum number of failed attempts is reached.

• Lock device — Locks the device.

• Factory reset + Initialize SD card — Simultaneously resets the user device and the SD card.
• Factory reset — Resets the user device but not the SD card.

Set the minimum length of the password.

The value can be between 4 - 16 characters.

Set the maximum number of days before the password must be reset.

The value can be between 0 - 365 days.

Set the minimum number of new passwords that the user must use before they can reuse the previous password.

The value can be between 0 - 10 times.

Set the duration for locking the device when the user has not set up a password for the screen lock.

The value can be between 0 - 60 minutes.

Set the maximum number of consecutive numeric characters allowed in a password.

The value can be between 1 - 10 words.

Set the number of consecutive letters allowed in a password.

The value can be between 1 - 10 words.

Allows blocking functions on the lock screen.

Select the function to be blocked on the lock screen when a password policy is set on a device.

• All — Blocks all functions on the lock screen.
• Camera — Blocks direct camera control on lock screen.
• Trust Agent — Blocks the Smart Lock function which automatically unlocks the screen in certain conditions, such as during a certain physical activity, at a specific location, or when devices are added.
• Fingerprint — Blocks the fingerprint unlock function.
• Previews in pop-ups — Displays notifications on the lock screen but hides private content set in the application.
• Notifications — All notifications are hidden using the lock screen.

Set a retry count when a device is disconnected from Knox Manage and Knox Manage retries connecting to the device in 1 minute intervals.

If the device is disconnected continuously despite retrying on the specified count, Knox Manage retries connections according to the Communication retry interval (min) below.

The value can be between 1 - 60 times.

Set a retry interval for when a device is disconnected from Knox Manage. If Knox Manage receives the event that the device is available, the server tries to reconnect immediately despite the waiting time.

The value can be between 1 to 60 minutes.

Allows Smartcard Browser Authentication within the internet browser.

When the policy is allowed, the Bluetooth security mode is applied while the device is connected to the smart card reader and the device does not accept other Bluetooth connections.

Set the measure for when forgery of the device firmware is detected. If detected, the creation of a new Knox Workspace and the use of the existing Knox Workspace are prohibited.

• Lock Knox Workspace — Locks the Knox Workspace.
• Delete Knox Workspace — Deletes the Knox Workspace.

• Lock device — Locks the device.

                <p>Android 10 and higher devices are not supported.
                </p>
            </div>
        </div>
            <li><strong>Factory reset + Initialization SD Card</strong> &mdash; Simultaneously factory resets the user's device and the SD card.</li>
            <li><strong>Factory reset</strong> &mdash; Resets the user device but not the SD card.</li>
        </ul>
    </td>
    <td>Samsung Knox 1.0.1 and higher</td>
</tr>
<tr>
    <td id="security-google-android-security-update-policy">Google Android security update Policy</td>
    <td>
        <p>Allows the user to select whether to receive updates on the device.</p>
        <p><strong>Forced use</strong> &mdash; Set to receive security updates by default.</p>
    </td>
    <td>Samsung Knox 2.6 and higher</td>
</tr>

Select a Kiosk feature to use on a device.

Single App Mode — Runs a single application on the device's home screen.

Multi App Mode — Runs multiple applications that are developed using the Kiosk Wizard.

Web Mode — Opens webpages that are specified by the administrator.

Click Select and select a single Kiosk application from the list. Alternatively, click Add and manually add applications. For more information about adding single applications, see Create a kiosk using the Kiosk Wizard.

Click Select and select multiple Kiosk applications from the list. Alternatively, click New and create a MultiApp Kiosk using the Kiosk Wizard. To learn how to use the Kiosk Wizard, see Exploring Kiosk Wizard.

Use the screen saver for the Multi App Kiosk and the Kiosk Browser. When no user activity is sensed for a certain amount of time, as set in the Auto Screen Off or Session Timeout settings on the device, the registered images or video files are shown on the device display.

Select image files for the screen saver. You can add up to 10 image files in PNG, JPG, JPEG, or GIF formats (animated files are not supported). Each image file must be less than 5 MB.

• To upload an image file, click Add and select a file.
• To delete an image file, click next to the name of the uploaded image file.

Select a video file for the screen saver. You can add only one video file in the MP4 or MKV format. The video file must be less than 50 MB.

• To upload a video file, click Add and select a file.
• To delete a video file, click next to the name of the uploaded video file.

Allows the use of the session timeout feature for the Kiosk Browser. If the user does not use the device for a set time, the device deletes user information, such as the cache and cookies, in the device Kiosk Browser and goes to the main page URL.

• Apply — Enable the session timeout feature for the browser.

Set the session timeout in seconds for the Kiosk Browser.

The value must be between 10 - 3600 seconds. The default value is 1800 seconds.

Set the key value to be added to the user agent. Allow the Kiosk Browser to access the Web server and the user agent key values contained in the HTTP header.

User agent key settings can be used to detect access to non-Kiosk Browsers on the web server.

Allows the user to upload files to websites through the Kiosk Browser.

Disallow is the default value.

Allows the use of the Task Manager.

Use the System bar which refers to the Status bar in the Notifications area at the top of the device and the Navigation bar in the Buttons area at the bottom.

For non-Samsung devices, irrespective of whether you select Allow status bar only or Allow navigation bar only, both the status bar and the navigation bar are disabled.

Select hardware keys to disable.

The availability of Hardware keys can vary by device.

If you do not allow the use of the Task Manager, then it does not run, even if the user tries to activate it by tapping the left menu key in the Navigation bar at the bottom of the device.

Allows the installation of applications from untrusted sources instead of just the Google Play Store.

Set to control the app installation policies.

If no apps are added to the Application installation blocklist and the Application installation allowlist, then no other apps except the Knox Manage agent are installed or run.

Add apps to prohibit their installation.

• To add an app, click Add, and then select apps in the Select Application window.
• To add all apps, click Add all.
• To delete an app, click next to the added app.

Add apps to allow their installation.

• To add an app, click Add, and then select apps in the Select Application window.
• To add all apps, click Add all.
• To delete an app, click next to the added app.

Set to control the app execution policies.

If the policy changes or Knox Manage is unenrolled, hidden apps reappear.

Add apps to prevent their execution. Icon of the blocked app disappears and users cannot run the app.

To add an app, click Add, and then select apps in the Select Application window.

To delete an app, click next to the added app.

Add apps to allow their execution. Icons of apps that are not on the allowlist disappear automatically. Knox Manage and the preloaded apps are automatically registered on the allowlist.

• To add an app, click Add, and then select apps in the Select Application window.
• To delete an app, click next to the added app.

Add apps to be displayed but not executable.

Listed apps can be installed and the icons are shown on the screen, but they are not allowed to run.

• To add an app, click Add, and then select apps in the Select Application window.
• To delete an app, click next to the added app.

Add apps to prevent their uninstallation.

• To add an app, click Add, and then select apps in the Select Application window.
• To delete an app, click next to the added app.

Select from one of the following actions to take if an internal or a kiosk application is compromised:

• Disallow running — Prohibits the application's execution.
• Uninstall — Deletes an application.
• Lock device — Locks the user's device.

                <p>Android 10 and higher devices are not supported.</p>
            </div>
        </div>
            <li><strong>Notify Alert</strong> &mdash; The compromised status of the device is reported on the <strong>Dashboard</strong>.</li>
            <li><strong>Factory reset + Initialize SD card</strong> &mdash; Simultaneously resets a user device and the SD card.</li>
            <li><strong>Factory reset</strong> &mdash; Resets the user device but not the SD card.</li>
        </ul>
        <div class="notice-note">
            <p>Actions such as lock device, factory reset, and the notify alert are applied but only for general Android devices and not for Samsung Galaxy and LG Electronic devices.</p>
        </div>
    </td>
    <td>Samsung Knox 1.0 and higher</td>
</tr>
<tr>
    <td id="application-battery-optimization-exceptions">Battery optimization exceptions</td>
    <td>
        <p>Set to exempt applications from the battery optimization function. This policy may cause battery loss.</p>
        <div class="notice-note">
            <p>This policy is for devices running Android (Nougat) or later.</p>
        </div>
    </td>
    <td></td>
</tr>
<tr>
    <td id="application-app-excluded-battery-optimization">&gt; Apps excluded battery optimization</td>
    <td>Add applications to exempt them from the battery optimization function.</td>
    <td>Samsung Knox 2.7 and higher</td>
</tr>

Allows collection of location data.

User consent — Allows location data collection only with the user's consent.

Set an interval period to save the location data of the device.

Allows using the Android browser.

Allows cookies in the Android browser.

Set the proxy server address for the Android browser in the general area.

Enter the value in the form of IP:port or domain:port in the fields.

Allows the use of a cellular data connection.

Specifies the types of voice call to block:

• Incoming — Blocks incoming voice calls only.
• Outgoing — Blocks outgoing voice calls only

If both are selected, only emergency calls can be received or made.

Add phone numbers to the blocklist to block incoming voice calls.

• To add a phone number, enter it in the field and click .
• To delete a phone number, click next to it.

Add phone numbers to the blocklist to block outgoing voice calls.

• To add a phone number, enter it in the field and click .
• To delete a phone number, click next to it.

Limits the maximum data usage for user devices. If data usage exceeds the limit set on a device, data use is no longer available.

To get precise information on the amount of usage, changing the date and time must not be allowed.

Set the maximum data amount for user devices for 1 day, 1 week, or 1 month.

Specifies the types of SMS and MMS messages to block.

Add phone numbers to the blocklist to block incoming SMS/MMS messages.

• To add a phone number, enter it in the field and click .
• To delete a phone number, click next to it.

Add phone numbers to the blocklist to block outgoing SMS/MMS messages.

• To add a phone number, enter it in the field and click .
• To delete a phone number, click next to it.

Allows recording phone conversations.

Add applications that are allowed to record phone conversations to the allowlist.

Set to use the firewall to set target IP addresses. The firewall policy is enabled by default.

Input values to permit the target IP and port address. Configure the following:

1. Enter or click Add to search the Package Name of the application.
2. Input the IP Address (range) and Port (range).
3. Select the Network Type:
   • All
   • Data — Only mobile network access is enabled.
   • Wi-Fi — Only Wi-Fi network access is enabled.
4. Select Port Range:
   • All
   • Local — Port access from the device is enabled.
   • Remote — Port access from the target server is enabled.
5. Click to add.

Input values to permit the target IP and port address. Configure the following:

1. Enter or click Add to search the Package Name of the application.
2. Input the IP Address (range) and Port (range).
3. Select the Network Type:
   • All
   • Data — Only mobile network access is enabled.
   • Wi-Fi — Only Wi-Fi network access is enabled.
4. Select Port Range:
   • All
   • Local — Port access from the device is enabled.
   • Remote — Port access from the target server is enabled.
5. Click to add.

Input values to permit the target domain address.

1. Enter or click Add to search the Package Name of the application.
2. Input the IP Address (range) and Port (range).

Input values to disable the target domain address.

1. Enter or click Add to search the Package Name of the application.
2. Input the IP Address (range) and Port (range).

Input values to specify the domain server address of all applications or registered applications.

1. Enter or click Add to search the Package Name of the application.
2. Input DNS values.
   • DNS1 — Primary DNS.
   • DNS2 — Secondary DNS.

Set to enable the save logs feature.

Enable — Set to perform logging. This is the default value.

Disable — Cannot record device logs.

Select a log level.

• DEBUG — Logs detailed device information for the developers.
• INFO — Logs device information for the administrators.
• WARNING — Logs information that are not errors, but the ones that require special attention for the administrators.
• ERROR — Logs error information.
• FATAL — Logs critical error information, such as system interruption.

Enter value for the maximum log size.

The value can be between 1 - 20 MB.

Enter value for the maximum days for log storage.

The value can be between 1–30 MB.

Allows the use of DeX mode.

• Disallow — The DeX station does not function even if a mobile device is mounted on it.

Prohibits launching the specified applications.

• To add an application, click Add, and then select applications in the Select Application window.
• To delete an application, click next to the added application.

Enter an identifier of a wireless router to connect to.

You can also click Lookup to open the reference items list and select an item from it. The reference value is automatically entered.

Configure the following items:

• EAP Method — Select an authentication protocol from among PEAP, TLS, and TTLS.
• 2-step authentication — Select one from PAP, MSCHAP, MSCHAPV2, or GTC as a secondary authentication method. This is available when EAP Method is set to TTLS or TLS.
• User information input method — Select an input method for entering user information.
• Manual Input — Enter the user ID and Password for the Wi-Fi connection. You can also click Lookup to open the reference items list and select an item from it. The reference value is automatically entered.
• Connector interworking — Choose a connector from the User Information Connector.
• User Information — Use the user information registered in Knox Manage to access Wi-Fi.
• User certificate input method — Select a user certificate confirmation method.
• EMM Management Certificate — Register an external certificate on the Knox Manage server for each network setting, and then verify each network setting using that certificate. All users share this one certificate for each network setting.

  Navigate to Advanced > Certificate > External Certificate to register network settings for each purpose.

• Connector interworking — Verifies network settings using the user information obtained by applying the filter set for the connector. To verify the network settings on the device, you should set the Service Type as Profile Configuration(Certification) when you register a connector in Advanced > System Integration > Directory Connector. To learn more about how to add a directory connector, see Connect to AD/LDAP. When you search for a user using the filter set for the connector, the user certificate (.p12 or .pfx) corresponding to the obtained user information is applied along with a profile, allowing you to use this certificate to verify the user.
• Issuing external CA — Register a certificate obtained from an external certificate authority to Advanced > Certificate > Certificate Template. Then, you register a certificate template for each network setting, and verify it as a user certificate. To learn more about how to add an external certificate, see Add external certificates.
• CA certificate — Select a root certificate. Among the certificates registered in Advanced > Certificate > External Certificate, those with the Purpose set as Wi-Fi and the Type set as Root are included on the list.

Configure the proxy server manually.

• Proxy host name — Enter the host name of the IP address of the proxy server
• Proxy port — Enter the port number used by the proxy server
• Proxy exception — Enter the IP address or domain address that cannot be accessed through the proxy server.
• Server authentication — If server authentication is required to use the proxy server, check this box.
• User name — Enter the username for the proxy server.
• Password — Enter the password for the proxy server.

Configure the proxy server automatically.

You should enter a PAC web address in the PAC web address field, the URL of the PAC file that automatically determines which proxy server to use.

Select to manually enter the email address, account ID, and password of a user.

You can also click Lookup to open the reference items list and select an item from it. The reference value is automatically entered.

Select to choose a connector from the User Information Connector list.

Enter a domain address for the exchange server.

You can also click Lookup to open the reference items list and select an item from it. The reference value is automatically entered.

Enter the exchange server information such as IP address, host name or URL.

Register an external certificate on the Knox Manage server for each network setting, and then verify each network setting using that certificate. All users share this one certificate for each network setting.

• User Certificate — Select a certificate to use from the User Certificate list.

Verifies network settings using the user information obtained by applying the filter set for the connector. To verify the network settings on the device, you should set the Service Type as Profile Configuration (Certification) when you register a connector in Advanced > System Integration > Directory Connector. To learn more about how to add a directory connector, see Connect to AD/LDAP.

When you search for a user using the filter set for the connector, the user certificate (.p12 or .pfx) corresponding to the obtained user information is applied along with a profile, allowing you to use this certificate to verify the user.

• User certificate Connector — Select a connector to use from the User certificate Connector list.

Register a certificate obtained from an external certificate authority to Advanced > Certificate > Certificate Template. Then, you register a certificate template for each network setting, and verify it as a user certificate. To learn more about how to add an external certificate, see Add external certificates.

• Issuing external CA — Select an external CA to use from the Issuing external CA list.

Set to use SSL for email encryption.

Mutes email notifications.

Enter the email attachment file size limit in bytes.

The input value ranges from 1 to 52428800 (50MB).

Select to manually enter the email address, server ID and password of a user.

You can also click Lookup to open the reference items list and select an item from it. The reference value is automatically entered.

Select a connector from the user information connector list.

Select to access the relevant mail server using the registered Knox Manage email, ID, and password.

Enter an incoming server ID to sign in to the incoming mail server manually.

You can also click Lookup to open the reference items list and select an item from it. The reference value is automatically entered.

Enter an outgoing server ID to manually sign in to the outgoing mail server.

You can also click Lookup to open the reference items list and select an item from it. The reference value is automatically entered.

Enter an incoming server password to manually sign in to the incoming mail server.

You can also click Lookup to open the reference items list and select an item from it. The reference value is automatically entered.

Enter an outgoing server password to manually sign in to the outgoing mail server

You can also click Lookup to open the reference items list and select an item from it. The reference value is automatically entered.

Select an email notification method.

• Enable Notification — Activates email notification.
• Enable 'Always notify by vibrate mode' — Notifies the user of new emails with a vibration.
• Disable Notification — Deactivates email notification.

Specifies a location to install the bookmark.

• BookMark — Saves a bookmark in the S browser.
• Shortcut — Creates a shortcut for the bookmarked address on the home screen of the device. Shortcut icons are created based on the Samsung Launcher.

If a Shortcut was selected, auto installation is not supported.

Shortcut icons may not be able to be created depending on the type of launcher set by the user. An administrator cannot delete the shortcut icon, but the user can delete it manually.

Select the type of the access point.

• Default — default type.
• MMS — Multimedia Messaging Service.
• Supl — IP-based protocol to receive GPS satellite signals.

Enter the server information for sending multimedia messages.

• MMS Proxy Server — Enter the information of the proxy server for sending multimedia messages.
• MMS Proxy Server Port — Enter the port number of the proxy server for sending multimedia messages.

Enter the user name of the access point.

You can also click Lookup to open the reference items list and select an item from it. The reference value is automatically entered.

Enter the password of the access point.

You can also click Lookup to open the reference items list and select an item from it. The reference value is automatically entered.

Select an authentication method.

• None — Disables authentication.
• PAP — Requires a user name and password for authentication.
• CHAP — Uses encryption with a Challenge string for authentication.
• PAP or CHAP — Uses the PAP or CHAP authentication method.

Select a VPN vendor from between Cisco and User defined. Input fields vary depending on the selected VPN vendor name.

Select an entering method for Knox VPN information.

• Manual Input — Only allowed for Cisco. For more information, see Configuring a Knox VPN profile manually.
• Upload profile — Allowed for all VPN vendors.

Allows uploading a Knox VPN profile when you set Entering methods for Knox VPN to Upload profile.

You can upload a text file in the JSON format. JSON varies depending on the VPN vendor and VPN type.

For more information about sample files, see the sample file of a Sectra Mobile VPN configuration in Entering a VPN vendor manually and see the sample file of Cisco VPN configuration in Sample file for uploading a Knox VPN profile.

Select an input method for entering certificate information.

• EMM Management Certificate — Register an external certificate on the Knox Manage server for each network setting, and then verify each network setting using that certificate. All users share this one certificate for each network setting.

  Navigate to Advanced > Certificate > External Certificate to register network settings for each purpose.

• Connector interworking — Verifies network settings using the user information obtained by applying the filter set for the connector. To verify the network settings on the device, you should set the Service Type as Profile Configuration(Certification) when you register a connector in Advanced > System Integration > Directory Connector. To learn more about how to add a directory connector, see Connect to AD/LDAP.
• When you search for a user using the filter set for the connector, the user certificate (.p12 or .pfx) corresponding to the obtained user information is applied along with a profile, allowing you to use this certificate to verify the user.
• Issuing external CA — Register a certificate obtained from an external certificate authority to Advanced > Certificate > Certificate Template. Then, you register a certificate template for each network setting, and verify it as a user certificate. To learn more about how to add an external certificate, see Add external certificates.

Allows the use of FIPS mode.

FIPS (US Federal Information Processing Standards) encrypts all data with FIPS-140-2 authentication modules between the server and client.

Select to use a VPN for selected applications or for all applications in the General area.

• By Application — Click Add next to The VPN applied package name per app and select applications, and then click Save.
• All packages of general area — All applications in the General area are subject to a VPN.

[
    {"address":"1.1.1.1","port":443},
    {"address":"2.2.2.2", "port":444},
    {"address":"3.3.3.3", "port":445}
]

The MTU (Magnetic Tape Unit) is a size used on Knox Manage's virtual network interface. It is the maximum size for the outgoing UDP (User Datagram Protocol) tunnel packets before being fragmented

The value must be between 576–1500 bytes.

Determines whether a DTLS tunnel is used. A DTLS tunnel should be used if sensitive data is being transmitted in real-time.

For example, when streaming video and/or using VoIP calls.

The value must be either True or False. If unsure, set to True.

Tunnel packets' Quality of Service (QoS) tag sent from a client. Differentiated service is part of an IP header.

The value must be between 0–63. 0 means disabled.

Timer value for the interval of a KeepAlive packet sent from a TCP tunnel.

The value must be between 1–18000.

• Sectra recommends to set this value as 1200 seconds since is compatible with most mobile networks.

The timer value for the standby period of a DTLS tunnel that determines how long it idles without receiving any data before it goes inactive.

The value must be between 1–300 seconds.

[
    {"profileName":"BadNetworkProfile","mtuSize":800, "tcpKeepAlive":600},
    {"profileName":"RealTimeProfile","mtuSize":1500, "useDtls":"true", "diffServ":63}
]

Select a connection type and enter the parameters. Required parameters vary depending on the selected connection type.

• PPTP — Set if PPP should be encrypted (MPPE).
• L2TP/IPSec PSK — Enter parameters in the L2TP Secret Key, IPSec Identifier, and IPSec Pre-shared Key fields.
• L2TP/IPSec RSA, IPSec Xauth RSA, IPSec Hybrid RSA — Select a root certificate from IPSec CA Certificates. Among the certificates registered in Advanced > Certificate > External Certificate, those with the Purpose set as VPN and the Type set as Root are included on the list.
• IPSec Xauth PSK — Enter parameters in the IPSec Identifier and IPSec Pre-shared Key fields.

Select an input method for entering user information.

• Manual Input — Enter the user ID and Password for the VPN connection. You can also click Lookup to open the reference items list and select an item from it. The reference value is automatically entered.
• Connector interworking — Choose a connector from the User information Connector. All the connectors are listed in Advanced > System Integration > Directory Connector.
• User Information — Use the user information registered in Knox Manage to access the VPN.

Select an input method for entering certificate information.

• EMM Management Certificate — Register an external certificate on the Knox Manage server for each network setting, and then verify each network setting using that certificate. All users share this one certificate for each network setting.

  Navigate to Advanced > Certificate > External Certificate to register network settings for each purpose.

• Connector interworking — Verifies network settings using the user information obtained by applying the filter set for the connector. To verify the network settings on the device, you should set the Service Type as Profile Configuration(Certification) when you register a connector in Advanced > System Integration > Directory Connector. To learn more about how to add a directory connector, see Add external certificates.

  When you search for a user using the filter set for the connector, the user certificate (.p12 or .pfx) corresponding to the obtained user information is applied along with a profile, allowing you to use this certificate to verify the user.

• Issuing external CA — Register a certificate obtained from an external certificate authority to Advanced > Certificate > Certificate Template. Then, you register a certificate template for each network setting, and verify it as a user certificate. To learn more about how to add an external certificate, see Add external certificates.

Select a certification category when EMM Management Certificate is selected in User certificate input method,

• CA certificate — Select a certificate to use from the CA certificate list. Among the certificates registered in Advanced > Certificate > External Certificate, those with the Purpose set as CA Cert and the Type set as Root are included on the list.
• User certificate — Select a certificate to use from the User Certificate list. Among the certificates registered in Advanced > Certificate > External Certificate, those with the Purpose has been set as CA Cert and the Type set as User are included on the list.