profileXML_device.xml

<VPNProfile>
<NativeProfile>
  <Servers>vpn.domain.tld</Servers>
  <NativeProtocolType>IKEv2</NativeProtocolType>
  <Authentication>
    <MachineMethod>Certificate</MachineMethod>
  </Authentication>
  <RoutingPolicyType>SplitTunnel</RoutingPolicyType>
  <DisableClassBasedDefaultRoute>true</DisableClassBasedDefaultRoute>
</NativeProfile>
<Route>
  <Address>192.5.10.5</Address>
  <PrefixSize>32</PrefixSize>
</Route>
<Route>
  <Address>192.5.10.3</Address>
  <PrefixSize>32</PrefixSize>
</Route>
<AlwaysOn>true</AlwaysOn>
<DeviceTunnel>true</DeviceTunnel>
<RegisterDNS>true</RegisterDNS>
</VPNProfile>