Deploying Tunnel using the Unified Access Gateway appliance provides a secure and effective method for individual applications to access corporate resources. Unified Access Gateway 3.0 supports deployment on either ESXi or Microsoft Hyper-V environments.
Tunnel is composed of two independent components: Tunnel Proxy and Per-App Tunnel. You deploy Tunnel using either of two network architecture models: single or multi-tier.
Both Tunnel Proxy and Per-App Tunnel deployment models can be used for a multi-tier network on the UAG appliance. The deployment consists of a front-end Unified Access Gateway server deployed in the DMZ and a back-end server deployed in the internal network.
The Tunnel Proxy component secures the network traffic between an end user device and a website through the Browser or any AirWatch SDK-enabled application deployed from AirWatch. The mobile application creates a secure HTTPS connection with the Tunnel Proxy server and protects the sensitive data. Devices are authenticated to the Tunnel Proxy with a certificate issued via the SDK as configured in the AirWatch Admin Console. Typically, this component should be used when there are un-managed devices that need secured access to internal resources.
For fully enrolled devices, the Per-App Tunnel component allows devices to connect to internal resources without needing the AirWatch SDK. This component leverages the native Per-App VPN capabilities of the iOS, Android, Windows 10, and macOS operating systems.
Deploying the Tunnel for your Workspace ONE UEM environment involves the following:
- Configure the Tunnel hostname and port information in the Workspace ONE UEM console. See Firewall Rules for DMZ-Based Unified Access Gateway Appliances.
- Download and deploy the Unified Access Gateway OVF template.
- Manually configure the Tunnel.
Deploying the Tunnel for your AirWatch environment involves setting up the initial hardware, configuring the Tunnel hostname and port information in the AirWatch Admin Console, downloading and deploying the Unified Access Gateway OVF template, and manually configuring the Tunnel. See Configure Tunnel Settings for Workspace ONE UEM .
AirWatch v9.1 and above supports Cascade Mode as the Multi-Tier deployment model for Tunnel. Cascade Mode requires a dedicated inbound port for each Tunnel component from the internet to the front-end Tunnel server. Both the front-end and back-end servers must be able to communicate with the AirWatch API and AWCM servers. Tunnel Cascade mode supports the multi-tier architecture for the Per-App Tunnel component.
For load balancing considerations for Content Gateway and Tunnel Proxy, see Load Balancing Topologies.
Was this page helpful?