Before deploying the GlobalProtect app, you can set up VPN configurations for iOS endpoints by using Jamf configuration profiles that specify how traffic is routed in the tunnel. You can specify a VPN configuration to ensure that the secure GlobalProtect connection is always on, user-initiated (on-demand), or specify which managed apps can route traffic through the tunnel.