If you decide to configure the list of allowed applications on the headend, you must determine the application IDs for each application on each type of endpoint.

Note	We recommend that you configure the Per App policy in the MDM server. This configuration simplifies the headend configuration.

The application ID, or the bundle ID in iOS, is a reverse DNS name. You can use an asterisk as a wildcard. For example, *.* indicates all applications, com.cisco.* indicates all Cisco applications.

To determine the application IDs:

• Android

  1. In a web browser, go to Google Play (https://play.google.com/store/).

  2. Click the Apps tab.

  3. Click an application that you want to allow in the VPN tunnel.

     The application ID is part of the URL.

  4. Copy the string after the ‘id=’ parameter.

     For Microsoft Remote Desktop, the URL is:

     https://play.google.com/store/apps/details?id=com.microsoft.rdc.androidx, and the app id is com.microsoft.rdc.androidx.

  For applications that are not available on Google Play, download a package name viewer application to extract the app ID.

• iOS

  1. In a web browser, go to Apple App Store (https://www.apple.com/in/app-store/).

  2. In the search results, search for an application.

     The application ID is part of the URL.

  3. Copy the number after the ‘id’ string.

     For Facebook, the URL is:

     https://apps.apple.com/in/app/facebook/id284882215 and the application ID is 284882215.

  4. Open a new browser window, and add the number to the end of the following URL: https://itunes.apple.com/lookup?id=

     For Facebook the URL is https://itunes.apple.com/lookup?id=284882215.

  5. Download the text file, usually named 1.txt.

  6. Open the file in a text editor, and search for ‘bundleId’. For Facebook, the ‘bundleId’ is " com.facebook.Facebook". Use this bundle ID as the app ID.

     

Once you have your list of application IDs, you can define the policy for the mobile device as explained in the procedure below.

Use the Cisco AnyConnect Enterprise Application Selector to define the Per App VPN policy.

We recommend that you create a simple ‘Allow All’ policy, and define the allowed applications in the MDM. However, you can specify a list of applications to allow and control the list from the headend. If you want to include specific applications, create a separate rule for each application, using a unique name and the application’s app ID.

To create an Allow All policy (wildcard policy) that supports both Android and iOS platforms using the AnyConnect Enterprise Application Selector:

1. Choose Android or iOS from the drop-down list as the platform type.

2. Configure the following options:

   • Friendly Name—Enter a name for the policy. For example, Allow_All.

   • App ID—Enter *.* to match all possible applications.

   • Leave the other options.

     

3. Choose Policy > View Policy to get the base64 encoded string for the policy. This string contains an encrypted XML file that allows the threat defense to see the policies. Copy this value. You need this string when you configure Per App VPN on the threat defense in the next step.

   

To create a policy for the Microsoft Remote Desktop application using the AnyConnect Enterprise Application Selector:

1. Choose Android from the drop-down list as the platform type.

2. Configure the following options:

   • Friendly Name—Enter the policy name.

   • App ID—For Android, enter com.microsoft.rdc.androidx.

   • Leave the other options.

     

3. Choose Policy > View Policy to get the base64 encoded string for the policy.