<VPNProfile>
    <DnsSuffix>example.com</DnsSuffix>
    <NativeProfile>
        <Servers>vpn.example.com</Servers>
        <NativeProtocolType>IKEv2</NativeProtocolType>
        <Authentication>
            <UserMethod>Eap</UserMethod>
            <Eap>
                <Configuration>
                <!-- Paste (Get-VpnConnection -Name template).EapConfigXmlStream.InnerXML HERE -->
<EapHostConfig xmlns="http://www.microsoft.com/provisioning/EapHostConfig"><EapMethod><Type xmlns="http://www.microsoft.com/provisioning/EapCommon">13</Type><VendorId xmlns="http://www.microsoft.com/provisioning/EapCommon">0</VendorId><VendorType xmlns="http://www.microsoft.com/provisioning/EapCommon">0</VendorType><AuthorId xmlns="http://www.microsoft.com/provisioning/EapCommon">0</AuthorId></EapMethod><Config xmlns="http://www.microsoft.com/provisioning/EapHostConfig"><Eap xmlns="http://www.microsoft.com/provisioning/BaseEapConnectionPropertiesV1"><Type>13</Type><EapType xmlns="http://www.microsoft.com/provisioning/EapTlsConnectionPropertiesV1"><CredentialsSource><CertificateStore><SimpleCertSelection>true</SimpleCertSelection></CertificateStore></CredentialsSource><ServerValidation><DisableUserPromptForServerValidation>true</DisableUserPromptForServerValidation><ServerNames>vpn.example.com</ServerNames><TrustedRootCA>00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 </TrustedRootCA></ServerValidation><DifferentUsername>false</DifferentUsername><PerformServerValidation xmlns="http://www.microsoft.com/provisioning/EapTlsConnectionPropertiesV2">true</PerformServerValidation><AcceptServerName xmlns="http://www.microsoft.com/provisioning/EapTlsConnectionPropertiesV2">true</AcceptServerName><TLSExtensions xmlns="http://www.microsoft.com/provisioning/EapTlsConnectionPropertiesV2"><FilteringInfo xmlns="http://www.microsoft.com/provisioning/EapTlsConnectionPropertiesV3"><CAHashList Enabled="true"><IssuerHash>00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 </IssuerHash><IssuerHash>00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 </IssuerHash></CAHashList></FilteringInfo></TLSExtensions></EapType></Eap></Config></EapHostConfig>
                <!-- HERE -->
                </Configuration>
            </Eap>
        </Authentication>
        <RoutingPolicyType>SplitTunnel</RoutingPolicyType>
        <DisableClassBasedDefaultRoute>true</DisableClassBasedDefaultRoute>
    </NativeProfile>
    <AlwaysOn>true</AlwaysOn>
    <RememberCredentials>true</RememberCredentials>
    <TrustedNetworkDetection>example.com</TrustedNetworkDetection>
    <Route>
        <Address>10.0.0.0</Address>
        <PrefixSize>8</PrefixSize>
    </Route>
    <Route>
        <Address>172.16.0.0</Address>
        <PrefixSize>12</PrefixSize>
    </Route>
    <Route>
        <Address>192.168.0.0</Address>
        <PrefixSize>16</PrefixSize>
    </Route>
    <DomainNameInformation>
        <DomainName>.example.com</DomainName>
        <DnsServers>192.168.1.254</DnsServers>
    </DomainNameInformation>
</VPNProfile>