Omnissa Workspace ONE Tunnel on Unified Access Gateway

Deploying Tunnel using the Unified Access Gateway appliance provides a secure and effective method for individual applications to access corporate resources.

Tunnel provides granular access control to applications and services, both in your network and in the cloud. The Tunnel client provides per-app management, with explicit trust of the individual applications you want to manage. Domain-based filtering is used for easy definition of access control and split-tunneling policies. It is built on native frameworks and is provided across all major platforms. When an application is either launched, or creates a network request, that request is forwarded to the Tunnel client for routing. In this way, local filtering is provided to determine what traffic must be tunneled into your network, sent to the Internet or another proxy, or blocked from leaving the device. Data that is passed to the Tunnel gateway leverages TLS and DTLS algorithms to perform the following checks as part of authentication.

• It uses SSL pinning to ensure that the server identity is correct.
• It performs TLS mutual authentication with a client certificate that uniquely identifies the device.
• The Tunnel gateway validates that the client certificate is on an allowlist of trusted certificates within the Workspace ONE UEM Console and performs a device compliance check to ensure the integrity of the user’s device.

For more information on supported platforms and Tunnel capabilities, see Omnissa Workspace ONE Tunnel guide.

Configure Tunnel

Configure Tunnel in the Workspace ONE UEM Console, and set up a server that meets the hardware, software, and network requirements. For more information, see Software Requirements.

Tunnel Deployment Model

Tunnel supports deploying a single-tier model and a multi-tier model. Both SaaS and on-premises Workspace ONE environments support the single-tier and multi-tier models. For more information, see Omnissa Workspace ONE Tunnel guide.

Deployment of Omnissa Workspace ONE Tunnel with Omnissa Unified Access Gateway

Unified Access Gateway hosts Workspace ONE services like per-app Tunnel, and is the preferred method of deployment. Deploying Tunnel on Unified Access Gateway can be done from either vSphere or Hyper-V and can be automated using PowerShell. The Tunnel service on Unified Access Gateway is the same as what the Linux installer provides. For more information, see Installing Tunnel with Unified Access Gateway.

Deployment of Tunnel with PowerShell

You can use PowerShell to deploy the Tunnel for Workspace ONE UEM. For more information, see Install Tunnel using PowerShell Script.