Understanding and using Knox VPNs

This article answers some of the basic questions you may have when trying to use VPNs with Knox.

What VPN encryption does Knox use?

Knox provides a comprehensive IPSec-based VPN solution for the most demanding enterprise requirements. Triple DES (56/168-bit), AES (128/256-bit) encryption with MD5 or SHA.

Can I configure VPN without a VPN client?

No. If you have a Knox Workspace license, download the Knox VPN Client before attempting to configure VPN.

Does the Knox VPN Framework call my service on device restart?

1. Does the Knox VPN framework call our VPN service on every device restart?
A: Yes

2. Can we expect a startConnection call from the Knox VPN framework on device restart even though we did not call the activate profile API?
A: Yes

3. When is the stopConnection called from the Knox VPN framework?
A: Few of the scenarios include:
- When admin calls deactivate profile
- When admin removes all the packages from the VPN profile

Should the VPN client be installed inside or outside the Knox container?

The VPN client can be installed inside and/or outside of the Knox container. If you have two containers created on your device, you can install the VPN client outside the Knox container so that it is available to both containers. On the other hand, if the VPN client is installed inside one container, the VPN client is not available to the other container.

How do I enable Dead Peer Detection (DPD) for VPN?

The Dead Peer Detection (DPD) feature is supported by the VPN gateway. The VPN connection is terminated automatically by DPD ACK from the gateway when no data is communicated through the VPN.

If the Mocana KeyVPN Client is being used, then DPD can be set by going to Advanced Settings >Enable > Dead Peer Detection.

How do I troubleshoot VPN configuration issues?

1. After pushing the Knox VPN client via Samsung SDS IAM & EMM, verify that it appears on both the personal space and on the Knox container on users' devices.
2. Verify that your VPN credentials are correct by manually setting up VPN in the personal space.
3. Verify that you can connect to the Knox VPN gateway.
4. If you can't connect to the Knox VPN gateway and:
   • you are connected to a firewall, change your access point and try again.
   • you aren't connected to a firewall, try to connect to any website using the device browser. If you can't access any of the websites, contact Samsung Knox Support.
5. If the issue persists, capture log files and contact Samsung Knox Support.

Is it possible to manually configure any VPN client to chain VPNs without using VPN APIs?

Manually configuring any other 3rd-party VPN client for your Knox VPN chaining is not possible for Samsung devices that support the Knox framework. VPN chaining on these devices requires the Knox VPN framework and the Knox VPN profile configuration APIs. They require both the inner and outer VPN profiles to be set up in specific ways for dual tunneling to work.