Yes, everything you mentioned is correct. The same config tested with Apple Configurator profile is working fine. But NEVPNManager pushed Personal VPN config is not working. Because all the DNS traffic is going to the default DNS instead of our VPN.

Thanks for details.

We are already using NEVPNManager with NEVPNProtocolIKEv2 to connect VPN. I verified this with VPN configuration profile as well. VPN connectivity is working fine. Now, I am trying to start VPN based on On demand rules using NEOnDemandRuleConnect. let neVpnManager = NEVPNManager.shared() let IKEv2Protocol = NEVPNProtocolIKEv2() neVpnManager.protocolConfiguration = IKEv2Protocol let onDemandRule = NEOnDemandRuleConnect() onDemandRule.interfaceTypeMatch = .wiFi onDemandRule.ssidMatch = ["DNET"] neVpnManager.isOnDemandEnabled = true neVpnManager.onDemandRules = [onDemandRule] With this code, VPN is starting when ssidMatch happens and interfaceTypeMatch is wifi. But, when I try to browse "pa.test2.com" with onDemandRule.dnsSearchDomainMatch = ["pa.test2.com"] added in the VPN configuration, VPN is not starting.