Deploy Content Gateway

You can deploy Content Gateway using either Unified Access Gateway (UAG) (through the Workspace ONE UEM console) or by using the dux CLI to deploy Content Gateway as a Container.

Option 1: Deploy Content Gateway using dux CLI

Omnissa now supports containerized deployment of Content Gateway independently from Unified Access Gateway using Omnissa dux. For detailed deployment instructions, see Introduction to Omnissa dux.

Option 2: Deploy Content Gateway on Omnissa Unified Access Gateway

Content Gateway deployment on Omnissa Unified Access Gateway begins with providing the UAG parameters to a configured node on the Workspace ONE UEM console.

Pre-requisites

You must have an active deployment of the Unified Access Gateway either as an Appliance or using PowerShell to configure Content Gateway. For more information, see Deploying Unified Access Gateway Appliance and Using PowerShell to Deploy Unified Access Gateway at Omnissa Product Documentation.

Configure a Content Gateway Node with Unified Access Gateway Parameters

To establish a Content Gateway node, configure the Content Gateway settings in the Workspace ONE UEM console. Configuration includes selecting the platform, configuration model, associated ports, and if necessary, uploading an SSL certificate.

You can either add a new node and configure the Unified Access Gateway settings or edit an existing configuration and provide the Unified Access Gateway parameters. When you edit an existing configuration, the updated settings are applied on the active repositories and help you to minimize the manual configuration and the accessibility of end users.

After you edit and save the existing configuration of your standalone Content Gateway instance, you cannot revert to the previously configured values. If you revert to the previously configured values on the console, you must reinstall the Content Gateway.

1. Navigate to Groups & Settings > All Settings > System > Enterprise Integration > Content Gateway in the Organization Group of your choice.

2. Set Enable the Content Gateway to Enabled.

   You might need to select Override to unlock Content Gateway settings. If you have an existing active Content Gateway node, the setting is enabled.

3. Select the Configuration Type.

   • If you want to configure a new Content Gateway Node in the Workspace ONE UEM console, select Add.
   • If you want to edit an existing node, select Edit.

4. To configure a Content Gateway node, complete the following fields.

   1. Configure the Installation Type.

      Setting	Description
      Installation Type	Unified Access Gateway appears as the default available platform for Content Gateway.

   2. Configure the Content Configuration settings.

      Setting	Description
      Configuration Type	Basic – Endpoint configuration with no relay component. Relay – Endpoint configuration with a relay component.
      Name	Provide a unique name used to select this Content Gateway instance when attaching it to a Content Repository, Repository Template, or RFS Node.
      Content Gateway Relay Address	If implementing a relay configuration, enter the URL used to access the Content Gateway Relay from the Internet.
      Content Gateway Relay Port	If implementing a relay configuration, enter the relay server port.
      Content Gateway Endpoint Address	Enter the host name of the Content Gateway endpoint. The Public SSL certificate bound on the configured port must be valid for this entry.
      Content Gateway Endpoint Port	Enter the endpoint server port.

   3. Configure the Content SSL Certificate settings.
      
      Note: Ensure that a full chain SSL certificate is uploaded on the Content Gateway configuration. SSL connections might fail if a full chain certificate is not uploaded.

      Setting	Description
      Public SSL Certificate (required for Linux requirements)	If necessary, upload a PKCS12 (.pfx) certificate file with a full chain for the Content Gateway Installer to bind to the port. The full chain includes a password, server certificate, intermediates, root certificate, and a private key. Note: To ensure that your PFX file contains the entire certificate chain, you can run commands such as certutil -dump myCertificate.pfx or openssl pkcs12 -in myCertificate.pfx -nokeys using command-line tools such as Certutil or OpenSSL. These commands display the complete certificate information. Requirements vary by platform and SSL configuration.
      Ignore SSL Errors (not recommended)	If you are using a self-signed certificate, then enable this setting. If enabled, Content Gateway ignores certificate trust errors and certificate name mismatches.

      Public SSL Certificate Upload for Linux

      Console Action	SSL Offloading	Server Action
      Upload	No	Opt out of SSL Offloading when prompted during installation.
      Upload Optional	Yes	Select SSL Offloading when prompted during installation.

   4. Configure the Certificate Authentication settings.

      Setting	Description
      Enable Cross-domain KCD Authentication	Enable this setting to authenticate users with the PIV-D Derived Credentials instead of user names and passwords. PIV-D certificate authentication is for the users who access the on-prem SharePoint and NFS repositories from their devices. Note: In case of a Network Share repository, ensure that the configuration keys jcifs must be set to false and jcifsng must be set to true.
      Client Certificate Chain	The certificate chain used to issue client certificates.
      Target SPN	SPN of the target service.
      Service Account Username	User name of the service account that has delegation rights.
      Service Account Password	Password for the service account.
      Domain	Name of the domain in the Active Directory (AD) containing the users.
      Domain Controller	Hostname or IP address of the domain controller for the domain.

   5. Enter the Content Gateway edge service values under the Custom Gateway Settings.

      This step is optional. You must perform this step only if you want to override the default configuration values for Content Gateway.

      With the edge service values set on the UEM console, the configuration file changes are automated and does not require manual updates to the configuration files each time the UAG is upgraded. ICAP Proxy configurations are not supported from Workspace ONE UEM console version 9.7. However, existing configurations can be edited. For information about configuring ICAP Proxy, see Internet Content Adaptation Protocol (ICAP) Proxy with Workspace ONE (2960835).

5. Select Add and then select Save.

   Note: HTTP traffic is not allowed for Content Gateway on port 80 on Unified Access Gateway because TCP port 80 is used by the edge Service Manager.

   After configuring settings in the UEM Console, download the installer, configure additional nodes, or manage configured nodes.

Custom Values for Content Gateway

The custom configuration values for the Content Gateway on Unified Access Gateway (UAG) can be set on the Workspace ONE UEM console. These custom values when fetched by the UAG server are automatically updated into the Content Gateway configuration files. The automatic updates eliminate the manual effort of updating the configuration files every time the UAG server undergoes an upgrade.

The tabulated list contains the keys that are available on the UEM console.

Keys	Type	Value	Description	Supported UAG and CG version
aw.server.security-headers.hsts.enabled	Boolean	true	Allows HSTS support in CG.	UAG 3.9 (CG 2.11.0) and later
aw.fileshare.client.domain	String		Default domain with which the users are associated while accessing fileshare repositories.	UAG 3.9 (CG 2.11.0) and later
aw.http.cipher-suites	String	TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA, TLS_DHE_RSA_WITH_AES_256_CBC_SHA, TLS_RSA_WITH_AES_256_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA, TLS_DHE_RSA_WITH_AES_128_CBC_SHA, TLS_RSA_WITH_AES_128_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384, TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384, TLS_DHE_RSA_WITH_AES_256_GCM_SHA384, TLS_DHE_RSA_WITH_AES_256_CBC_SHA256, TLS_RSA_WITH_AES_256_GCM_SHA384, TLS_RSA_WITH_AES_256_CBC_SHA256, TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256, TLS_DHE_RSA_WITH_AES_128_GCM_SHA256, TLS_DHE_RSA_WITH_AES_128_CBC_SHA256, TLS_RSA_WITH_AES_128_GCM_SHA256, TLS_RSA_WITH_AES_128_CBC_SHA256	Comma separates list of allowed ciphers.	UAG 3.9 (CG 2.11.0) and later
aw.http.protocols	String	TLSv1, TLSv1.1, TLSv1.2	Values can be separated by comma.	UAG 3.10 (CG 2.11.0) and later
aw.server.fixed-headers	String	X-Frame-Options: DENY## X-XSS-Protection: 1; mode=block##Expect-CT: max-age=86400, enforce##X-Content-Type-Options: nosniff	Double hash (#) separated headers. Header name and value separated by a colon ( : ). Caution: Use this KVP only when you want to mitigate any threat detection for the missing headers from Content Gateway requests.	UAG 3.10 (CG 2.11.0) and later

Note: The changes made after starting the Content Gateway service requires resaving of the service configuration on UAG.

Modifying the SMB Configurations

The SMB configurations are stored in smb.conf and smb-connector.conf files under the smb-connector directory at the Content Gateway installation path. To define precisely the custom values for these configuration files, you must obtain the current files from the UAG's log export functionality. A definite sequence is not followed when adding a new custom value to these configuration files. The new value when added appears at the end following all the existing values in the file.

Custom values can be provided in the UEM console using the following syntax:

extconf##FILE_NAME##CHANGE_TYPE[##EXISTING_LINE]=LINE_VALUE

• FILE_NAME = Name of the file; smb or smb-connector

• CHANGE_TYPE = ADD, REMOVE, or UPDATE

• EXISTING_LINE = The current content of the line that needs the required change. If the line is not found in the file, this entry in the Key Value Pair (KVP) is ignored and does not have any impact on the file. It is applicable if there is UPDATE or REMOVE.

• LINE_VALUE = Value of the line to be inserted or updated. It is ignored if there is REMOVE.

Listed are few examples of modifying the custom values in the SMB configuration files.

Example 1: An environment requires updating minimum smb protocol version from SMB2_02 to SMB3.

Key	Type	Value	Description
extconf##smb##UPDATE##client min protocol = SMB2_02	String	client min protocol = SMB3	Update the line in the smb.conf file that equals that client min protocol = SMB2_02 with client min protocol = SMB3

Example 2: Updating the smb-connector logs to debug mode. Default is 1 (error) and allowed values are: 0: Off, 1: Error, 2: Warning, 3: Info, 4: Debug

Key	Type	Value	Description
extconf##smb-connector##UPDATE##log_level 1	String	log_level 4	Update the line in the smb-connector.conf file that equals that “log_level 1” with “log_level 4”

Note: All custom values must be provided as a String when inserting or updating the configuration and as Null when removing the configuration.

Modifying Application Log Levels

To update the application logging level to debug, the below KVP entry can be used. Info is the default level and the permitted values include Error, Warn, Info, Debug, and Trace.

Key	Type	Value	Description
extconf##logback##level##com.company_name	String	debug	Update the application logging level to debug.

Configure Content Gateway on Unified Access Gateway

Enable the Content Gateway settings and provide the configuration details required for configuring Content Gateway on Unified Access Gateway. For more information, see Configure Content Gateway on Unified Access Gateway in the Deploying and Configuring Unified Access Gateway Guide at Omnissa Product Documentation.

Verify Content Gateway Connectivity

Post-installation, test the Content Gateway's connection in the UEM console to verify if the installation is completed successfully.

1. Navigate to Groups & Settings > All Settings > System > Enterprise Integration > Content Gateway in the UEM console.
2. Select Test Connection to verify connectivity.