Of course, there are also requirements for the UAG appliance(s) itself and the network connectivity. Windows 10, macOS, Android and iOS devices are supported An endpoint/mobile device for the platform you plan to use.VMware UAG 3.3 and later (latest release is recommended).The UAG will then authorize access to the internal resource.īefore you can think about deploying the VMware Tunnel, you will have to meet these requirements at a minimum: When an end-user is starting one of the configured applications in the Device Traffic Rules, the VMware Tunnel is started and will reach out to the internet to the company’s external firewall to the VMware UAG appliance(s) that are installed in the DMZ network. Within the VMware Tunnel configuration defined in Workspace ONE UEM, administrators can configure Device Traffic Rules to specify which application can use a specific resource within the company’s datacenter. Some installed applications on the device require network connectivity to backend systems of the company to function correctly. The below illustration shows a managed Workspace ONE UEM device on the left.

Whilst traditional VPN solutions enable full access from the endpoint device to the entire datacenter of the company, the VMware Tunnel allows individual applications to authenticate and securely communicate with specific backend servers, IP Subnets and resources. The VMware Tunnel can be configured as an Edge Service on VMware Unified Access Gateway (UAG), which enables Per-App VPN on managed mobile devices to further secure access to internal resources. Using Workspace ONE UEM, you can deploy the Workspace ONE Tunnel software to endpoint devices, configure VPN Profiles and configure the VPN Policy settings.

In this blog post, I will show you why and how to configure the Workspace ONE Tunnel, which you can use for your per- App VPN configuration.

Uag workspace one