Configure Outbound Proxy

Many organizations use outbound proxies to control the flow of traffic to and from their network. Outbound proxies can also be used for performing traffic filtering, inspection, and analysis.

It is not mandatory to use outbound proxies with Omnissa Workspace ONE Tunnel, but your organization may choose to deploy them behind one or more Tunnel servers based on recommendations from your security and network teams.

The following table illustrates outbound proxy support for the Workspace ONE Tunnel Proxy on Linux: 

During installation, the installer prompts you whether to use an outbound proxy. For relay-endpoint configurations, the outbound proxy communication is configured on the endpoint server that resides in your internal network and can communicate with the outbound proxy.

The Tunnel Proxy encrypts traffic to HTTP endpoints using HTTP tunneling with an SSL certificate and sends that traffic over port 2020 as HTTPS. To enable SSL Off loading, enable SSL Offloading in the Workspace ONE Tunnel console configuration and select SSL Offloading during installation on the Relay server. Enabling this setting ensures the relay expects all unencrypted traffic to the port you configured. The original host headers of the request must be forwarded to the tunnel server from wherever traffic is SSL off loaded.

Outbound Proxy with Authentication

If you want to use an outbound proxy, then enter ‘Yes’ when prompted during Tunnel installation, which then prompts you for the following information:

• Proxy Host

• Proxy Port

• Whether the proxy requires any authentication (Basic/NTLM) and appropriate credentials

Entering this information and completing the installer enables outbound proxy support. This sends all traffic from the Workspace ONE Tunnel Proxy server – except requests to the Workspace ONE UEM API/AWCM servers – to the outbound proxy you configure. If you want to send the requests to the API/AWCM (AirWatch Cloud Messaging) servers through your outbound proxy as well, then you must enable the Enable API and AWCM outbound calls via proxy setting on the Tunnel > Advanced settings page. Go to Groups & Settings > All Settings > System > Advanced > API.

PAC Files and Multiple Outbound Proxies

A PAC file is a set of rules that a browser checks against to determine where traffic is routed. If you want to use a proxy auto configuration (PAC) file, then provide the path to the PAC file location when prompted during Tunnel installation. If you want to use a PAC file for an outbound proxy that requires authentication, or if you want to use multiple proxies with different hostnames, or if some proxies require authentication (basic/NTLM) and some do not, then use the Proxy Tool for PAC Files and Multiple Outbound Proxies.

Use the Proxy Tool for PAC Files and Multiple Outbound Proxies for Workspace ONE Tunnel Proxy

You can use the proxy tool if Tunnel routes its outbound requests through an outbound proxy that has rules set in a PAC file that also requires authentication.

Complete the following steps before you use the proxy Tool for PAC Files and Multiple Outbound Proxies for Workspace ONE Tunnel Proxy:

• To use the PAC file, edit the proxy.properties file and change the PROXY_SEARCH_STRATEGY to 2.

• Uncomment the PAC_URL and enter the PAC file URL or the absolute path of the PAC file on the Workspace ONE Tunnel server.

Complete the following steps to use the Proxy Tool for PAC Files and Multiple Outbound Proxies for Workspace ONE Tunnel Proxy:

1. Within Linux CLI mode, go to: /opt/omnissa/tunnel/proxy/tools.

2. Convert the proxy tool to an executable file by using the following command:

   chmod a+x proxytool.sh
   

3. Run proxy-tools by using the following command:

   sudo sh Proxytools.sh
   

4. Select your authentication method, which can be None, Basic, or NTLM for a single service account. Also enter your credentials, if applicable, and the URI of the proxy for testing.

5. Select Save.

6. To restart the Proxy service, run the following command : sudo systemctl restart proxy.service.

   After saving, run the following command to check if the proxy settings are updated correctly:

   cat /opt/omnissa/tunnel/proxy/conf/proxy-credentials.xml
   

Workspace ONE Tunnel Proxy Tools

The Proxy Tool is an application you can run to configure multiple outbound proxies. The following commands can be used in the application:

• Use arrows, tab, shift+tab to navigate.

• Use Enter or spacebar to select/deselect a proxy.

• Use Alt+Enter to see details of the highlighted proxy.

• Use Ctrl+V to paste on text controls.

• Use F1 to invoke context-sensitive help.

• Use Esc to exit a window.