Configure Omnissa Workspace ONE Tunnel for Linux machines to provide secure access to your corporate applications and resources. Tunnel for Linux supports both Per-App and Full Device Tunnel modes in Standalone mode. There is no requirement for device management or Workspace ONE HUB for configuration. Support for Managed enrollment is on our roadmap. Tunnel for Linux is supported on UEM 2302 and later versions. Enable the following feature flag at Global OG (OG ID 7):
TunnelStandaloneProfileSupportForLinuxFeatureFlag
Please work with your Workspace ONE support representative if you require assistance with feature flag enablement. This feature flag will be enabled by default in an upcoming Workspace ONE UEM release.
-
This will enable Linux as an option within the Tunnel Profiles section on the Tunnel configuration page.
-
This is a Global feature flag and needs to be enabled for the entire environment (OG ID 7).
Tunnel Profile for Standalone Enrollment
-
To setup a new Tunnel profile, within the UEM console, please navigate to Groups and Settings --> All Settings --> System --> Enterprise Integration --> Omnissa Tunnel.
-
Here, one can find the section titled “Client Side Configurations” which includes the original Device Traffic Rule Sets and the Tunnel Profiles tiles
-
For first time setup, the setup wizard will walk one through the profile setup.
-
The profile will be associated to all devices at the Organization Group, support for Assignment Groups is planned for a future release.
Device Traffic Rules
- Administrators may create new Device Traffic Rules and or use existing Device Traffic Rules. The Linux client supports both per-app and full device Tunnel mode.
Installation
run sudo ./ws1tunclient_installer.run to install the Linux Tunnel Client. Once installation is complete, ws1tunctl will be available to use.
Steps to Enroll the client
Lists of CLI commands available:
ws1unctl - This is the Tunnel application running on the machine.
-
ws1tunctl enroll- This command is used to enroll the device to UEM. This step should be performed after init.
Syntax:
ws1tunctl enroll -e https://ds101.awmdm.com -t TUN -u Username
where:
https://ds101.awmdm.com --> Enrollment URL
TUN --> GroupID
Username --> Enrollment username
The enrollment process will prompt for user authentication. If basic enrollment is set-up, please enter the password. Optionally, if SAML enrollment is configured, it will open up the system’s default browser. The system must not be headless and a working browser needs to be present (e.g. Firefox/Chromium) if SAML enrollment is set up.
Once enrolled, the Linux client is ready for use.
-
ws1tunctl start -
ws1tunctl stop- The above two are used to start and stop the Tunnel VPN connection respectively.
-
ws1tunctl status- This will show the current status of the client.
-
ws1tunctl unenroll- This will unenroll the Tunnel client.
-
ws1tunctl version- This will show the current version of the Tunnel client. Troubleshooting
-
ws1tunctl log get- This will output a log file to the /tmp folder. Please copy this file to the other location before restarting the system.
-
ws1tunctl log level set debug- Values allowed: info (Default), debug, error
Disabling Linux Tunnel client
sudo systemctl stop ws1tunclient && sudo systemctl disable ws1tunclient
Enabling Linux Tunnel client
sudo systemctl enable ws1tunclient && sudo systemctl start ws1tunclient
Current Limitations:
-
Support for one Tunnel Profile per Organization Group. Tunnel client will only configure if it is enrolled at the Organization Group where the Tunnel Profile is set up.
- The profile is assigned to all devices at that Organization group, support for Assignment Groups is planned for a future release.
-
Device compliance is not supported and will be added in a future release.
Was this page helpful?