The architectural diagram below shows an example environment which emulates a typical environment, including DMZ and internal networks. Each platform offers slightly different variations of the Per-App Tunnel feature, but all platforms require the presence of the Workspace ONE Tunnel client to use Per-App VPN functionality. Settings for the Per-App Tunnel feature are pushed to the device in a device profile with the VPN payload configured. The VMware Workspace ONE® Tunnel client application installed on the user's device maintains an allowlist of applications that should use VPN, handle certificates for enabled applications, and initiate the VPN connection on behalf of the user. This feature leverages the native Per-App VPN functionality of Android, iOS, and Windows 10 platforms and a device-side VPN client application to initiate a VPN connection when an enabled application is started. The Per-App Tunnel feature enables an SSL VPN connection on a per-application basis for any public or internal application.
Users also can access internal websites using Workspace ONE Web from non-managed devices, using the Workspace ONE application only in Mobile Application Management (MAM) mode. The Tunnel Proxy feature is enabled through settings in an application-specific SDK profile, which is pushed from the Workspace ONE UEM Console with the managed SDK-enabled app. The Tunnel Proxy feature provides internal access to end-users in VMware Workspace ONE® Web (formerly VMware Browser) or other Workspace ONE UEM SDK-enabled applications by securing traffic from the application to a website with SSL encryption and certificate authentication.
These components run independently as two separate services on the Unified Access Gateway appliance to enable internal access for an end-user device. VMware Tunnel consists of two major components: Tunnel Proxy and Per-App Tunnel. Before deploying Unified Access Gateway with VMware Tunnel, it is important to understand the VMware Tunnel components available to provide secure internal access to your device fleet.
0 kommentar(er)
