Editing manifest for Tunnel container

In addition to the common settings outlined in the Editing the manifest file section, ensure to configure the following settings for Tunnel container deployment.

Custom settings for Tunnel container

uem

Setting	Description
`tunnel_config_id`	Omnissa Tunnel Configuration ID configured on the Workspace ONE UEM Console. This setting is supported only if the UEM console supports multi-tunnel configuration feature. If not configured, default configuration from the specified Organization Group is fetched.
`group_id`	The Organization Group ID (OG) on Workspace ONE UEM Console where Tunnel is configured. Note: If you are using an older UEM console version, use the `group_id` setting.
`oauth`	Starting with Tunnel Container 25.03, OAuth is the recommended authentication method for securely connecting to the Workspace ONE UEM API server. Important: Older versions of Tunnel Container do not support OAuth. To use OAuth, ensure you are running version 25.03 or later. `client_id` - Client ID to download config from the Workspace ONE UEM API server. `client_secret` - Client Secret to download config from the Workspace ONE UEM API server. `token_service_url` - OAuth token service endpoint URL used to obtain a bearer token using Client ID and Client Secret. Can be configured to point to a different OAuth token service endpoint based on your environment.
`outbound_proxy`	Used if Outbound Proxy needs to be configured to reach to Workspace ONE UEM. `proxy_host` - If protocol is not specified, the default value is `http`. `proxy_port` - Proxy port number. If not specified, default value is `80` for `http` and `443` for `https`.
`multi_nic_external_ip`	For dual-NIC deployments: IP address of the external NIC (unauthenticated traffic). Dux communicates through internal IP but uses this value for configuration and performs security checks (example, ensure SSH is not listening on external IP; port scan to ensure SSH port is not open).

perf_tune

Use this setting to improve the network and file system parameters of the Tunnel container deployment host machine. This helps the host machine to support more connections and improve overall performance. The changes made by the script are applied immediately and made persistent across reboots by saving the updated kernel parameters to a configuration file /etc/sysctl.d/tunnel.conf.

perf_tune: 1

1 (default) - run perf_tune.sh in the remote host
0 - do not edit system configuration in remote host

enable_l3_vpn

Sample Tunnel manifest (ts_manifest.yml)

# Version number for the Tunnel container deployment manifest. This is auto generated and should not be altered.
version: "3.1.0.852"
uem:
  url: https://example-uem-api.com
  tunnel_config_id: cafa5265-2e0f-4506-920e-f07f4b9esdsd
  group_id: 

  admin:
    oauth:
      client_id: 41cbcadbe64e48d3b0be792cc2cd23dd
      client_secret: 28C18ACFDAC1D0ED39E497D7C2BDD8AA
      token_service_url: 
    #basic_auth:
      #username:
  outbound_proxy:
    proxy_host: 
    proxy_port: 
    #proxy_user:
tunnel_server:
  image_name: TunnelContainer_25.06.tar.gz
  ssh_login_credentials:
    ssh_user: 
    ssh_key_path: 
    ssh_port: 
  ssh_host_key_check: 1
  enable_l3_vpn: 0
  container_logging:
    max_size: "10M"
    max_num_files: "5"
  hosts:
    - address: 192.14.18.232
      server_role: 0
      host_info:
        ssh_user: user1
        ssh_key_path: /home/user1/.ssh/id_rsa
        ssh_password: 
        ssh_port: 
      #subnet_range:
      #host_base_dir: $HOME
      #multi_nic_external_ip:
  perf_tune: 1
  global_base_dir: $HOME
  host_entries:  
ca_cert_files: 
permissions:
  docker:
    no_sudo: false
  file_operations:
    no_sudo: false
  system:
    no_sudo: false
  network:
    no_sudo: false

¿Le resultó útil esta página?