iOS and Android

• No CLI, and nothing to manage. The sxaccess commands do not exist on a phone; everything is in the app. A phone enrols by signing in; there is no enrollment-key option.
• The tunnel runs outside the app. iOS runs it in the SXAccess Packet Tunnel extension and Android in a VPN service, so it keeps running when you leave the app or the system closes it. VPN On Demand (iOS) or Always-on VPN (Android) brings it back after a restart or a network change without opening the app. If that needs a new sign-in, Android shows a notification asking you to open SXAccess.
• One account per phone. A phone stays with the account it was enrolled with, and signing in with another account fails. On an iPhone, reinstalling SXAccess clears the setup so that another account can sign in.

If your organization sends internet traffic through an Internet gateway, the gateway appears as its own row on Resources, marked as an Internet gateway and switched on from the start. While it is on, the phone's IPv4 internet traffic leaves through a device of your organization, from that device's public address. IPv6 internet traffic does not work while a gateway is on, and networks published to you keep their own routes.

Switching the gateway off needs no confirmation: your internet traffic goes back to the phone's own connection. To use it again, connect first, then tap its switch and confirm. Select all never switches a gateway on.

• iPhone: the app asks Route all traffic through …?, naming the gateway; choose Route all traffic or Cancel. Several gateways can be on at once. The confirmation also says that IPv6 internet is not supported while the gateway is in use. It warns that the VPN may stop when the phone moves between Wi-Fi and cellular; with VPN On Demand on, iOS brings it back by itself.
• Android: the app asks Use … for Internet traffic?, naming the gateway; choose Enable Internet Gateway or Cancel. Only one gateway is on at a time: switching one on turns the others off. IPv6 internet traffic is blocked while it is on. A gateway also needs Android's Private DNS turned off (Settings → Network & internet → Private DNS); until then the app says so, and the gateway cannot start.

To check, open any website that shows your public address: it should show the gateway's address, not your own. Administrators set gateways up as described in Sending internet traffic through your own gateway.

The organization pill at the top of Shield appears when your account belongs to more than one organization, and it opens while the phone is connected. Tap it to see your organizations. One marked Enrolled here · no sign-in needed is a switch: the phone keeps its device identity there, and no browser opens. One marked Not enrolled here · joining is a new enrolment is a join: the phone gets a new device identity in that organization, and the browser opens if your sign-in has expired. Either way, the app asks you to confirm first. See Create and switch organizations.

If an organization requires two-factor authentication and your sign-in did not include a second factor, the app asks for one in place, under Confirm it is you. That can be a code from your authenticator app, an emailed code, or a security key. On an iPhone the security-key step can also use a passkey; on Android it takes an NFC or USB key or the phone's screen lock. If you have not set one up yet, you can do it on the same screen. Back to where I was (on an iPhone, Cancel) returns to the organization you were in. See Two-factor and passkeys.

On an iPhone:

• VPN On Demand: Connect automatically, with rules for Wi-Fi (Always, Only on selected networks, Except on selected networks or Never) and for Cellular (Always or Never). It is off until you turn it on.
• Advanced: Pre-shared key, where you set or remove one; Enable Lazy Connect on this device, which otherwise follows your organization's Connect on demand setting; Log level, View logs and Share logs.
• Appearance: System, Light or Dark.

On Android:

• Automatic connection: Android connects SXAccess automatically through its own Always-on VPN setting. Choose Open system VPN settings, tap the gear next to SXAccess and turn on Always-on VPN. Block connections without VPN adds protection, but if your session expires you may have to turn it off briefly to sign in again.
• Advanced: Pre-shared key, where you set or remove one, and Enable on this device for Connect on demand. It also holds Disable client routes, Disable server routes and Disable DNS, and Block inbound connections and Disable firewall. For the logs there are Capture logs (off until you turn it on), Verbose logging, View logs, Share logs and Clear logs. Host names, network addresses, keys and tokens are removed before a log line is written.

A device with a pre-shared key connects only to devices that use the same key, so set one only when your administrator asks you to. Most Advanced changes apply on the next connection, and the app offers to reconnect.