Per-App Tunnel can be configured using either of the following two configuration models:
- Basic Endpoint (single-tier) using a Per-App Tunnel Basic Endpoint
- Cascade (multi-tier) using a Per-App Tunnel Front-End and Per-App Tunnel Back-End
Port Requirements for Per-App Tunnel Basic Endpoint Configuration
| Source | Destination | Protocol | Port | Verification | Notes |
|---|---|---|---|---|---|
| Devices (from Internet and Wi-Fi) | Per-App Tunnel Basic Endpoint | TCP, UDP | 8443* | Run the following command after installation:netstat -tlpn | grep [Port] | Devices connect to the public DNS configured for Tunnel over the specified port. If 443 is used, Per-App Tunnel component listens on port 8443. |
| Per-App Tunnel Basic Endpoint | Workspace ONE UEM Cloud Messaging Server | HTTPS | SaaS:443 On-Premises:2001* | Verify by using wget to https://<AWCM URL>:<port>/awcm/status and ensuring you receive an HTTP 200 response. | For the Per-App Tunnel to query the Workspace ONE UEM console for compliance and tracking purposes. This needs to support a minimum of TLS 1.2. |
| Per-App Tunnel Basic Endpoint | Internal websites/web apps/resources | HTTP, HTTPS, or TCP | 80, 443, any required TCP | For applications using Per-App Tunnel to access internal resources. Exact endpoints or ports are determined by where these resources are located. | |
| Per-App Tunnel Basic Endpoint | UEM REST API
| HTTP or HTTPS | 80 or 443 | curl -Ivv https://<API URL>/api/mdm/ping The expected response is HTTP 401 unauthorized | The Per-App Tunnel must communicate with the UEM REST API for initialization. In the Workspace ONE UEM console, go to Groups & Settings > All Settings > System > Advanced > Site URLs to set the REST API URL. This page is not available to Workspace ONE UEM SaaS customers. For Workspace ONE UEM SaaS customers, the REST API URL is most commonly the Console URLor Devices Services URL. |
Port Requirements for Per-App Tunnel Cascade Configuration
| Source | Destination | Protocol | Port | Verification | Notes |
|---|---|---|---|---|---|
| Devices (from Internet and Wi-Fi) | Per-App Tunnel Front-End | TCP, UDP | 8443* | Run the following command after installation:netstat -tlpn | grep [Port] | Devices connect to the public DNS configured for Tunnel over the specified port. If 443 is used, Per-App Tunnel component listens on port 8443. |
| Per-App Tunnel Front-End | Workspace ONE UEM Cloud Messaging Server | HTTPS | SaaS:443 On-Premises:2001* |
Verify by using wget to https://<AWCM URL>:<port>/awcm/status and ensuring you receive an HTTP 200 response. | For the Per-App Tunnel to query the Workspace ONE UEM console for compliance and tracking purposes. This needs to support a minimum of TLS 1.2. |
| Per-App Tunnel Front-End | Per-App Tunnel Back-End | TCP | 8443 | Telnet from Per-App Tunnel Front-End to the Per-App Tunnel Back-End on port 8443. | To forward device requests from the Front-End to the Back-End server. This needs to support a minimum of TLS 1.2. |
| Per-App Tunnel Back-End | Workspace ONE UEM Cloud Messaging Server | HTTPS | SaaS:443 On-Premises:2001* | Verify by using wget to https://<AWCM URL>:<port>/awcm/status and ensuring you receive an HTTP 200 response. | For Per-App Tunnel to query the Workspace ONE UEM console for compliance and tracking purposes. This needs to support a minimum of TLS 1.2. |
| Tunnel Back-End | Internal websites/web apps/resources | HTTP, HTTPS, or TCP | 80, 443, any required TCP | For applications using Per-App Tunnel to access internal resources. Exact endpoints or ports are determined by where these resources are located. | |
| Per-App Tunnel Front-End | UEM REST API
| HTTP or HTTPS | 80 or 443 | curl -Ivv https://<API URL>/api/mdm/ping The expected response is HTTP 401 unauthorized | The Per-App Tunnel must communicate with the UEM REST API for initialization. In the Workspace ONE UEM console, go to Groups & Settings > All Settings > System > Advanced > Site URLs to set the REST API URL. This page is not available to Workspace ONE UEM SaaS customers. For Workspace ONE UEM SaaS customers, the REST API URL is most commonly the Console URLor Devices Services URL. |
| Per-App Tunnel Back-End | UEM REST API
| HTTP or HTTPS | 80 or 443 | curl -Ivv https://<API URL>/api/mdm/ping The expected response is HTTP 401 unauthorized | The Per-App Tunnel must communicate with the UEM REST API for initialization. In the Workspace ONE UEM console, go to Groups & Settings > All Settings > System > Advanced > Site URLs to set the REST API URL. This page is not available to Workspace ONE UEM SaaS customers. Workspace ONE UEM SaaS customers, the REST API URL is most commonly the Console URLor Devices Services URL. |
NOTES
- * This port can be changed based on your environment's restrictions.
- † On-Premises means the location of the Workspace ONE UEM console.
- ‡ For SaaS customers who need to allow outbound communication, refer to the Knowledge Base article that lists up-to-date IP ranges: Workspace ONE IP ranges for SaaS data centers.
Was this page helpful?