Deploying Tunnel using the Unified Access Gateway appliance provides a secure and effective method for individual applications to access corporate resources. Unified Access Gateway 3.0 supports deployment on either ESXi or Microsoft Hyper-V environments.
Tunnel is composed of two independent components: Tunnel Proxy and Per-App Tunnel. You deploy Tunnel using either of two network architecture models: single or multi-tier.
Both Tunnel Proxy and Per-App Tunnel deployment models can be used for a multi-tier network on the UAG appliance. The deployment consists of a front-end Unified Access Gateway server deployed in the DMZ and a back-end server deployed in the internal network.
The Tunnel Proxy component secures the network traffic between an end user device and a website through the Omnissa Browser or any AirWatch SDK-enabled application deployed from AirWatch. The mobile application creates a secure HTTPS connection with the Tunnel Proxy server and protects the sensitive data. Devices are authenticated to the Tunnel Proxy with a certificate issued via the SDK as configured in the AirWatch Admin Console. Typically, this component should be used when there are un-managed devices that need secured access to internal resources.
For fully enrolled devices, the Per-App Tunnel component allows devices to connect to internal resources without needing the AirWatch SDK. This component leverages the native Per-App VPN capabilities of the iOS, Android, Windows 10, and macOS operating systems. For more information on these platforms and Tunnel component capabilities, refer to the Omnissa Workspace ONE Tunnel guide at Omnissa Product Documentation.
Deploying the Tunnel for your AirWatch environment involves setting up the initial hardware, configuring the Tunnel hostname and port information in the AirWatch Admin Console, downloading and deploying the Unified Access Gateway OVF template, and manually configuring the Tunnel. See Configure Tunnel Settings for Workspace ONE UEM .
AirWatch v9.1 and above supports Cascade Mode as the Multi-Tier deployment model for Tunnel. Cascade Mode requires a dedicated inbound port for each Tunnel component from the internet to the front-end Tunnel server. Both the front-end and back-end servers must be able to communicate with the AirWatch API and AWCM servers. Tunnel Cascade mode supports the multi-tier architecture for the Per-App Tunnel component.
For more details, including those on Relay Endpoint Deployment for use with the Tunnel Proxy component, see the Omnissa Workspace ONE Tunnel guide at Omnissa Product Documentation.
Was this page helpful?