EnglishFrançaisDeutschEspañolItaliano日本語한국어NederlandsPortuguês (Brasil)中文 (简体)中文 (繁體, 台灣)
Skip to main content

UEM Console Configurations

The Omnissa Workspace ONE UEM console is one of three main components in the Workspace ONE Tunnel solution. It holds all the device and server profiles and allows for customized traffic rules to be pushed out to customer devices.

To configure your settings for the Workspace ONE UEM console, review/set the following settings.

From the Console menu, go to: Groups & Settings > All Settings > Configurations > Tunnel. Select a Current Setting or Override to make new settings for the child.

Under Deployment Details, select whether you are deploying Workspace ONE Tunnel in Basic or Cascade mode.

  1. If you are deploying in Basic mode, supply the public-facing Hostname and the Port number that is assigned for communication with the Workspace ONE Tunnel component.
  2. If you are deploying in Cascade mode, enter the Hostname of the back-end server and the Port number.

Under Server Authentication, select the SSL provider of your choice.

By default, AirWatch provides a certificate, however third-party certificates are also supported. When using a third-party certificate, make sure to include both public and private keys in either .PFX or .P12 format. Currently, server authentication does not support SAN certificates. All certificates must be either issued to the Workspace ONE Tunnel hostname or be a valid wildcard certificate for the corresponding domain.

Under Client Authentication, select either AirWatch or a Third-Party CA as the authentication provider for Tunnel users.

To use a third-party certificate authority, select the Certificate Authority and Certificate Template that are used to request a certificate from the CA.

In order for the Workspace ONE Tunnel gateway to trust certificates issued by a third-party CA, Upload the full chain of the public key of your certificate authority to the configuration wizard. The CA template must contain CN={UDID} in the subject name. If the Windows desktop Tunnel client is used with the Per-App Tunnel, then the template must contain CN={UDID}:vpn.air-watch.com. Certificates auto-renew based on your CA template settings.

Under Networking, define how Tunnel communicates with Workspace ONE UEM and how the device traffic flows through your network.

  • Select Manage Server Traffic Rules with Tunnel PAC Reader if you are using the PAC Reader to manage the traffic rules.
  • Select Default AWCM + API traffic via Server Traffic Rules if the communication between the Tunnel and Workspace ONE UEM API or AWCM (AirWatch Cloud Messaging) uses the outbound proxy.

Under Logging, you can configure settings related to the server logs.

  1. Select the level of logging for the Workspace ONE Tunnel from the Service Logs drop-down menu. It is best practice to select the Service Logs as Error or Info unless you are troubleshooting.
  2. Access Logs provide a high-level record of users and devices using Workspace ONE Tunnel. In a cascade deployment, the back-end server performs the syslog transport. Syslog Hostname : If you make this selection, enter the URL of your syslog host and the UDP Port over which you want to communicate. Ensure that the logging level for access logs is set appropriately in rsyslog.conf on the syslog server. File : If you make this selection, the filename is hardcoded to /var/log/omnissa/tunnel/vpnd/access.log. There is no correlation between this syslog integration and the integration accessed on Groups & Settings > All Settings > System > Enterprise Integration > Syslog.

Tunnel Server – UEM Custom Configuration

In addition to the basic Tunnel configuration, you may use additional Tunnel server custom configurations to fine-tune your Tunnel deployment.

Field & SyntaxDescription & Example
log_file_append log_file_append <value>Setting the log_file_append <value> to 0 will truncate the tunnel.log or reporter.log on service restart and delete tunnel.log.1 or reporter.log.1, tunnel.log.2, or reporter.log.2, and so on if the logs are present. Setting this value to 1 will append logs to tunnel.log or reporter.log and the backed up files (tunnel.log.1 or reporter.log.1 etc) will not be deleted.
  • 0 - Do not append logs
  • 1 – Append logs
Example: log_file_append 1
log_file_backup_count log_file_backup_count <value>Specify the maximum number of backup log files to be created once the max file size is reached. Example: log_file_backup_count 4
log_backup_strategy log_backup_strategy <value>Specify a periodic log backup strategy.
  • 0 - No backup
  • 1 - Daily backup. Log files are backed up daily.
  • 2 - Weekly backup. Log files are backed up weekly.
Example: log_backup_strategy 0
log_backup_hour log_backup_hour <value>Specify the time in hour when the log backup is performed. For example, if you enter the value as 4, then log backup is performed at 04:00. This settings applies only when the log_backup_strategy is daily (1) or weekly (2). Enter a value within the range 0 to 23. Example: log_backup_hour 0
log_backup_day log_backup_day <valueSpecify the day when the log backup is performed. For example, if you enter the value as 3 then the log backup is performed on Wednesday at a specified hour. This setting applies only when the log_backup_strategy is 2 (weekly). The value can be 0-6 for Sunday to Saturday. Example: log_backup_day 0
log_archive_count log_archive_count <value>Specify the maximum number of archive files to be created for the backup logs. The archive files can be found at: /var/log/omnissa/tunnel/vpnd/backup.Example: log_archive_count 1
log_file_size log_file_size <file size>Specify the maximum file size (in MB) of the log file. The file size must be an integer within the range 1 to 80. Example: log_file_size 20
use_internal_dns_for_domains *.domain1.com, *.domain2.comAbility to override the device traffic rules for split DNS. Internal DNS resolution can be specified through the use_internal_dns_for_domains key-value pair. The domains specified here are resolved internally and all other domains are resolved externally. Note: You can only enter 800 characters in this field. Use a comma (,) to distinguish between the domains. You can use wildcard characters for your domains/hostnames. Wildcards must follow the format:
  • *.<domain>.*
  • *<domain>.*
Example: *.internaldomain.com, *.acme.com
allowed_compliance_states allowed_compliance_states Compliance states of the devices that are allowed to connect. Note: You can configure the following possible compliance status:
  • 1 - Allowed
  • 2 - Blocked
  • 3 - Compliant
  • 4 - NonCompliant
  • 5 - NotAvailable
  • 6 - NotApplicable
  • 7 - PendingComplianceCheck
  • 8 - PendingComplianceCheckForAPolicy
  • 9 - RegistrationActive
  • 10 - RegistrationExpired
  • 11 - Quarantined
Example: allowed_compliance_states 3,5
keepalive_timeout keepalive_timeout Default Value = 300Time (in seconds) before disconnecting the device's connection without receiving a TCP keepalive. Example: keepalive_timeout 300
client_ip_traffic client_ip_traffic Set client-side IP mode:
  • 0= Dual IPv4/IPv6. Both IPv4 and IPv6 traffic are enabled on the device side.
  • 1 = IPv4 Only. Only IPv4 traffic is enabled on the device side.
  • 2 = IPv6 Only. Only IPv6 traffic is enabled on the device side.
Example: client_ip_traffic 1
dns_ip_mode dns_ip_mode Default Value = 1Set DNS IPv4/IPv6 query mode:
  • 0= Dual IPv4/IPv6. Both IPv4 and IPv6 results are allowed in the DNS query result.
  • 1 = IPv4 Only allows IPv4 addresses in the DNS query result.
  • 2 = IPv6 Only. Only allows IPv6 addresses in the DNS query result.
Example: dns_ip_mode 0
dns_server_address_1, dns_server_address_2 ...dns_server_address_1 Specifies different DNS servers that devices will use for DNS lookup. If not specified, settings from "/etc/resolv.conf" will be used. Up to 4 addresses can be specified using _1, _2, _3 and _4 suffix.

Example:

dns_server_address_1 1.2.3.4, dns_server_address_2 5.6.7.8

Note: This key has to be used in along with the dns_server_port KVP. If IP address is not specified or dns_server_port KVP is not added, settings from the /etc/resolv.conf are used.

dns_server_address_ipv6_1, dns_server_address_ipv6_2...dns_server_address_ipv6_1 Specifies different IPv6 DNS servers that devices will use for DNS lookup. If not specified, settings from "/etc/resolv.conf" will be used. Up to 4 addresses can be specified using _1, _2, _3 and _4 suffix.

Example: dns_server_address_ipv6_1 2001:4860:4860::8888, dns_server_address_ipv6_2 2001:5860:5860::8888

dns_server_portdns_server_port Specifies DNS server port that devices will use for DNS lookup. If port is not specified, settings from "/etc/resolv.conf" will be used. Example: dns_server_port 53
api_configuration_fetch_interval api_configuration_fetch_interval Default Value = 60Specifies if a secondary DTLS channel must be enabled for device UDP traffic, this also requires additional firewall modification to allow the UDP port. Example: api_configuration_fetch_interval 60
dtls_channel dlts_channel Default Value = 1Specifies the cipher suites allowed in TLS handshakes between servers and devices. Supports the format supported by OpenSSL ciphers command. Example: dlts_channel 1
nsx_ethernet_interface 
nsx_ethernet_interface
Specifies the ethernet interface where traffic to NSX will be routed to. Virtual interface is created based on this Ethernet interface. If nsx_host_id is 2 and nsx_ethernet_interface is eth1. If two security groups with two IP sets (192.168.0.0/24 and 192.168.1.0/24) are defined, two virtual interfaces are needed. As a result, eth1:001 will be created with 192.168.0.2 and eth1:002 is created with 192.168.1.2. Example: nsx_ethernet_interface eth1
access_log_events access_log_events Default Value = 1,2,3,4,5...Specifies the events that must be logged in the access log.
  • 1 - Session connect: Logs when a device connects to the tunnel server.
  • 2- Session disconnect : Logs when a device disconnects from the tunnel server.
  • 3 - Stream connect: Logs when a TCP connection is established between an application on the device and a host.
  • 4 - Stream disconnect: Logs when a TCP connection is disconnected.
  • 5 - HTTP request/response: Logs when an HTTP traffic is detected (unencrypted traffic only).
Example:access_log_events 1,2,3,4,5
access_log_format access_log_format Default Value = 
%h %l %u %t "%r" %>s %b 
"%{Referer}i" "%{User-Agent}i" 
"%{Device-UID}e"
Access log format. Supported log variables:
  • %h- Remote host
  • %l
  • %u- remote user
  • %t - time
  • %r - first line of request
  • %s - status
  • %b - size of response
  • %{variable}i - HTTP request header variables
  • %{variable}e - HTTP request response variables
Example:
access_log_format %h %l %u %t "%r" %>s %b 
"%{Referer}i" "%{User-Agent}i" "%{Device-UID}e"
access_log_custom_format_session_connect access_log_custom_format_session_connect Default Value = 
%{Connection}v %{Connection-ID}v 
%{Connection-Type}v 
%{Connection-Status}v %{Connection-Time}v 
%{Device-Uid}v 
%{Device-Name}v 
%{Device-IP}v->%{Cascade-IP}v 
%{Device-Vpn-IP}v 
%{VPN-Server-Connection-Availability}v
This setting defines access log message format when a new session is connected. See access_log_format for a list of supported specifiers. Example:
access_log_custom_format_session_connect 
%{Connection}v 
%{Connection-ID}v
 %{Connection-Type}v
 %{Connection-Status}v 
%{Connection-Time}v 
%{Device-Uid}v 
%{Device-Name}v 
%{Device-IP}v 
%{Device-Vpn-IP}v 
%{VPN-Server-Connection-Availability}v
access_log_custom_format_session_disconnect access_log_custom_format_session_disconnect Default Value = 
%{Connection}v 
%{Connection-ID}v
 %{Connection-Time}v
 %{Device-Uid}v
 %{Device-Name}v 
%{Device-App}v 
%{Remote-Connection-Status}v 
%{Remote-Host-Name}v
 %{Remote-Host-IP}v 
%{Remote-Bytes-Transferred}v
This setting defines access log message format when a session is disconnected. See access_log_format for a list of supported specifiers. Example:
access_log_custom_format_session_disconnect 
 %{Connection}v 
%{Connection-ID}v 
%{Connection-Time}v 
%{Device-Uid}v 
%{Device-Name}v 
%{Device-App}v 
%{Remote-Connection-Status}v 
%{Remote-Host-Name}v 
%{Remote-Host-IP}v %{Remote-Bytes-Transferred}v
access_log_custom_format_stream_connect access_log_custom_format_stream_connect Default Value = 
%{Connection}v 
%{Connection-ID}v 
%{Connection-Type}v 
%{Connection-Time}v 
%{Device-Uid}v 
%{Device-Name}v 
%{Device-Username}v 
%{Device-App}v 
%{Remote-Connection-Status}v
 %{Remote-Host-Name}v 
%{Remote-Host-IP}v
This setting defines access log message format when a new stream is connected. See access_log_format for a list of supported specifiers. Example:
access_log_custom_format_stream_connect
 %{Connection}v 
%{Connection-ID}v 
%{Connection-Type}v 
%{Connection-Time}v 
%{Device-Uid}v %{Device-Name}v 
%{Device-Username}v 
%{Device-App}v %{Remote-Connection-Status}v 
%{Remote-Host-Name}v %
access_log_custom_format_stream_disconnect access_log_custom_format_stream_disconnect Default Value = 
%{Connection}v 
%{Connection-ID}v 
%{Connection-Type}v 
%{Connection-Time}v  
%{Device-Uid}v 
%{Device-Name}v 
%{Device-Username}v 
%{Device-App}v  
%{Remote-  Connection-Status}v 
%{Remote-Host-Name}v 
%{Remote-Host-IP}v
This setting defines access log message format when a new stream is disconnected. See access_log_format for a list of supported specifiers. Example:
access_log_custom_format_stream_disconnect 
%{Connection}v  
%{Connection-ID}v  
%{Connection-Type}v 
%{Connection-Time}v 
%{Device-Uid}v  %{Device-Name}v  
%{Device-Username}v 
%{Device-App}v  
%{Remote-Connection-Status}v 
%{Remote- Host-Name}v %
access_log_custom_format_stream_blocked access_log_custom_format_stream_blocked Default Value = 
%{Connection}v  
%{Connection-ID}v 
%{Connection-Type}v 
%{Connection-Time}v  
%{Device-Uid}v  
%{Device-Name}v 
%{Device-Username}v 
%{Device-App}v  
%{Remote-Connection-Status}v 
%{Remote-Host-Name}v 
%{Remote-Host-IP}v
This setting defines access log message format for a stream that is blocked by ZTNA Example:
access_log_custom_format_stream_blocked 
%{Connection}v 
%{Connection-ID}v  
%{Connection-Type}v 
%{Connection-Time}v 
%{Device-Uid}v  
%{Device-Name}v  
%{Device-Username}v 
%{Device-App}v  
%{Remote-Connection-Status}v 
%{Remote-  
Host-Name}v %
vpn_mode 
socks,nat
Supported modes:
  • socks: Per-App Tunnel with SOCKS Proxy for Android, iOS and MacOS devices
  • nat: Per-App Tunnel with NAT Protocol for Windows devices
  • tun (experimental): Per-App Tunnel using Linux TUN driver for Windows devices. Cannot be used together with 'nat' mode. This mode requires more configuration such as iptables NAT setup or corporate routing setup for the return traffic so customers are recommended to use 'nat' mode instead.

Note: The Custom Settings that is used for defining the Configuration Key and the Configuration Value is available only in Workspace ONE UEM console 2003 or later. For older versions of the console, the server.conf file must be manually modified. The service restart removes the configuration from Unified Access Gateway 3.7+.

Click Save.

What to do next:

  • Edit, Disable, or Delete the Workspace ONE Tunnel configuration.
  • Download the Installer and XML to finish the setup.
  • Test Connection to verify the server reachability.

You can now configure your advanced settings for your Workspace ONE Tunnel component.

Was this page helpful?

Provide feedback for this topic

Was this topic helpful?

Please do not include any personal or confidential information.

Generating link…