Configuring the Content Gateway Edge Service: VMware Workspace ONE Operational Tutorial

Before deploying the Unified Access Gateway with Content Gateway, it is important to understand the Content Gateway architecture and deployment models available to provide secure internal access to file repositories from your device fleet.

The Content Gateway works as a edge service on the Unified Access Gateway appliance, and can be configured automatically during deployment of the appliance using PowerShell or after deployment, using the Unified Access Gateway administration console.

The Unified Access Gateway appliance OVF template product, contains several edge services, beyond  Content Gateway. The template includes VMware Tunnel, Web Reverse Proxy, and Horizon. This appliance runs from a VMware standard hardened image.

The Content Gateway can be deployed in one of two configurations:

• Basic Mode consists of a single Unified Access Gateway appliance, typically situated in the DMZ, where devices can connect to the appropriate port for each feature, authenticate with a certificate issued from the Workspace ONE UEM Console, and connect to internal sites.
• The Cascade Mode option allows devices to authenticate to the front-end Content Gateway on the Unified Access Gateway appliance located in the DMZ, then connect to the back-end Content Gateway enabled on another Unified Access Gateway appliance over a single port and then access internal resources.

The following architectural diagram shows an example of two major networks that you can deploy your servers into. For this set of exercises, you deploy the Unified Access Gateway appliance on a DMZ and assign the respective NICs.

At the top of the diagram is vCenter Networking. At the bottom of the diagram is the vApp network required to support the environment. For these exercises, the focus is on the network hosted on the ESXi, and represented by the following three networks:

• VM Network & Management: Represents the dedicated network to access the Management Console
• Internal Network: Represents the internal network on 172.16.0.x range. The Control Center, ESXI, and vCenter are part of the internal network.
• DMZ Network: Represents the DMZ network on 192.168.110.x which is where the Unified Access Gateway appliance is to be deployed. The Unified Access Gateway Internet-facing NIC is associated to this network.

High-level Overview of Traffic Routing

The architectural diagram is based on two ports and two host names that route through the F5 load balancer. In this example, non-standard ports are used for these services in the 6000 - 6500 port range, due to F5 configuration for an internal network.

The next steps detail how the traffic is routed:

1. The host names ( pool##.airwlab.com) are CNAMEs that point to the external IP of the F5.  When these host names are resolved, they are routed to the F5 to be inspected and forwarded to the internal networks.
2. If the request includes only the host name ( pool##.airwlab.com), the F5 uses the Hostname iRule. This Hostname iRule inspects inbound traffic to the F5 over port 443 (HTTPS). The traffic is decrypted using the *.airwlab.com SSL certificate and chain. The Hostname iRule then inspects the traffic, re-encrypts the traffic using the SSL certificate and chain, and then routes the inbound request to the appropriate destination server based on the host name of the request. This process is known as SSL Bridging, which is not supported by Per-App Tunnel.
3. If the request includes the host name and port ( pool##:airwlab.com:6000), the F5 uses the Port iRule. This Port iRule inspects inbound traffic to the F5 over non-443 ports. Unlike the Hostname iRule, the Port iRule parses the request for the port number and then routes the inbound request to the appropriate destination server based on the port of the request. This process does not involve decrypting or re-encrypting the traffic; it forwards the request to the desired destination. This process uses SSL Passthrough.
4. From the F5 Hostname or Port iRules, the traffic is forwarded to the configured IP address.
5. The vPodRouter is configured to forward Unified Access Gateway traffic to the 192.168.110.20 IP address over the DMZ Network.
6. The Nested DMZ Network (192.168.110.0 on vmnic2) is provided by NIC 2 on the ESXi-01 Host (192.168.110.160).
7. The request reaches the nested Unified Access Gateway appliance deployed on 192.168.110.20.

Avoid SSL Bridging

In this example, non-443 ports are used for VMware Tunnel and Content Gateway to avoid decrypting and re-encrypting the traffic because this is not supported with Per-App Tunnel. In other scenarios, you would use the standard ports where possible. This exercise demonstrates that the ports for both services can be configured to work within the architecture.

Unified Access Gateway supports deployments with one, two, or three NICs. This means that the server can be partitioned to receive traffic on a single interface or to route traffic to different interfaces, based on the source of the request. Most often, if you need to implement multiple NICs, you already follow this standard with other web applications in your organization.

You must determine what is appropriate for your environment when selecting the number of NICs during installation. It is important for you to understand the expected behavior when two or three NICs are enabled.

To explore these options, see Deploying VMware Unified Access Gateway: VMware Workspace ONE Operational Tutorial.

In the exercises for deploying the Unified Access Gateway server through vSphere, the vCenter setup is hosted in a nested template. This is not usually the case when working with users in a live environment.

User environments can include multiple networks and can optionally have a Network Protocol Profiles (NPP) that corresponds to the networks to connect to the Unified Access Gateway. Prior to version 3.3, NPP was a requirement. Since version 3.3, NPP is no longer required.

Note: Keep in mind that the Unified Access Gateway requires a netmask, default gateway, and subnet to be defined for each network enabled during deployment.

Double-click the Google Chrome browser icon on the desktop.

1. Launch the Chrome browser from your desktop and click the bookmark for vSphere.
2. Enter the username, such as administrator@vsphere.local.
3. Enter the password, such as VMware1!.
4. Click Login.

After completing the login, you are presented with the vSphere Web Client.

On your desktop, double-click the Google Chrome icon.

For example, navigate to https://<WorkspaceONEUEMHostname> where WorkspaceONEUEMHostname is the host name of the Workspace ONE UEM console.

1. Enter your Username, for example, administrator.
2. Click Next. After you click Next, the Password text box is displayed.

1. Enter your Password, for example, VMware1!
2. Click Login.

Note: If you see a Captcha, be aware that it is case sensitive.

Note: Checked out devices will likely have the Workspace ONE Intelligent Hub already installed. You may skip this step if your device has the Workspace ONE Intelligent Hub installed.

At this point, if you are using your own iOS device or if the device you are using does not have the Workspace ONE Intelligent Hub Application installed, then install the application from the App Store.

To install the Workspace ONE Intelligent Hub application from the App Store, open the App Store application and download the free Workspace ONE Intelligent Hub application.

Launch the Hub app on the device.  

1. Enter the Server URL for your Workspace ONE UEM environment.
2. Click Next.

Click the Server Details button.

Return to the Workspace ONE Intelligent Hub application on your iOS Device,

1. Enter your Group ID for your Organization Group for the Group ID field.
2. Tap the Next button.

Note: On an iPhone, you may have to close the keyboard by clicking Done to click the Next button.

You now provide user credentials to authenticate to Workspace ONE UEM.

1. Enter the Username, for example, testuser.
2. Enter the Password, for exmaple, VMware1!.
3. Tap Next.

The Workspace ONE Intelligent Hub prompts you to enable Workspace Services to enroll your device into Workspace ONE UEM.  

Tap Next to begin.

If you are prompted to allow the website to open Settings, tap Allow.

Note: If you do not see this prompt, ignore this and continue to the next step. This prompt occurs only for iOS devices on iOS 10.3.3 or later.

Tap Install in the upper-right corner of the Install Profile dialog box.

Tap Install when prompted on the Install Profile dialog.

You should now see the iOS Profile Installation warning explaining what this profile installation will allow on the iOS device.

Tap Install in the upper-right corner of the screen.

You should now see the iOS request to trust the source of the MDM profile.

Tap Trust when prompted at the Remote Management dialog.

You should now see that the iOS Profile was successfully installed.

Tap Done in the upper-right corner of the prompt.

Your enrollment is now complete. Tap Open to navigate to the Workspace ONE Intelligent Hub.

Tap Done to confirm the notice and continue.

Tap Allow if you get a prompt to allow notifications for the Hub app.

You may be prompted to install a series of applications. If prompted, tap Install to accept the application installation.

Tap I Understand when shown the Privacy policy.

Tap I Agree for the Data Sharing policy.

Confirm that the Hub app shows the user account that you enrolled with.

You have now successfully enrolled your iOS device with Workspace ONE UEM. Continue to the next step.

1. Select Groups & Settings.
2. Select All Settings.

1. Select System.
2. Select Enterprise Integration.
3. Select Content Gateway.
4. Change the setting to Override.
5. Select Enabled for Content Gateway.
6. Click Save.
7. Click Add.

1. Select UAG for Installation Type.
2. Select Basic (Single-Tier) for Choose Configuration Type.
3. Enter a Name, for example, Content Gateway on UAG.
4. Enter the Content Gateway server host name (for example, https://contentgateway.vmware.com) for Content Gateway Endpoint Address.
5. Enter a port number for Content Gateway Endpoint Port.
6. Click Upload and select your certificate.
7. Click Save.

1. Select the Content Gateway configuration that you just added.
2. Select More Actions and select Download Unified Access Gateway, which redirects to the Workspace ONE Resources portal where the Unified Access Gateway virtual appliance OVF package is hosted.
3. Copy the Content Gateway Configuration GUID—this is required to enable the Content Gateway edge service on Unified Acces Gateway.

Extract the ZIP file on the Windows machine where you will install Unified Access Gateway.

The next section helps you to deploy the Unified Access Gateway appliance OVF through PowerShell and configure the Content Gateway edge service based on the settings configured in Workspace ONE UEM.

The INI file contains all the configuration settings required to deploy the Unified Access Gateway appliance.

This exercise uses the uag-CG.ini file and is configured for a Unified Access Gateway appliance called UAG-CG, that has two NICs—NIC one is set to internet facing and NIC two for back end and management.

The INI file is located in the Unified Access Gateway installer ZIP package downloaded in the previous exercise.

Navigate to your Unified Access Gateway INI file. In this example, the INI file is located in UAG Resources.

1. Click the File Explorer icon from the task bar.
2. Select Desktop.
3. Select UAG Resources.
4. Right-click the INI file, for example, uag-CG.ini.
5. Select Edit with Notepad++.

In this example, the settings are already filled out. The General section includes details such as deployment location and network configuration for the Unified Access Gateway appliance.

The SSLCert and SSLCertAdmin sections contain SSL certificate location for the administrator and Internet interfaces.

The AirWatchContentGateway section contains the required parameters to enable Content Gateway edge service on your Unified Access Gateway appliance.

1. Paste the Content Gateway configuration GUID for cgConfigId. You copied this value in the previous exercise.
2. Enter the apiServerUsername, for example, apiuser.
3. Enter the apiServerUrl, for example, https://v9.airwlab.com.
4. Enter the apiServerPassword, for example, VMware1!.
5. Enter the airwatchServerHostname, for example, https://pool###.airwlab.com.

If you do not provide the apiServerPassword as part of the INI settings, the administrator must enter the password in the Unified Access Gateway administration console.

Click the PowerShell icon.

After you run the script, it prompts for input.

1. Navigate to the folder containing your INI file. For example, enter cd '.\Desktop\UAG Resources' then press Enter.
2. Enter .\uagdeploy.ps1 .\<uag-tunnel>.ini <password1> <password2> false false no then press Enter.
   Replace <uag-tunnel> with your INI file name.
   Replace <password1> with the root password for the UAG appliance.
   Replace <password2> with the administrator password for  REST API management access.
   The first false is to not skip the validation of signature and certificate.
   The second false is to not skip SSL verification for the vSphere connection.
   The no is to not join the VMware CEIP program.
3. Enter the password for the certificated that will be used on the following fields SSLcert and SSLcertAdmin.
4. Enter the password for the apiuser previous defined on the INI file, which will allow Unified Access Gateway to obtain the VMware Tunnel settings from Workspace ONE UEM.

To avoid a password request for the certificate, remove the pfxCert values and provide a PEM certificate in the INI file. Set the pemCerts and pemPrivKey for the SSLCert and SSLCertAdmin sections in the INI file.

The deployment starts and you can follow the progress in the same window or on your vSphere Web Client.

1. Confirm the deployment has been completed successfully. The Completed successfully text is shown in the output.
2. Click Close.

After a successful deployment, the script automatically powers on the VM UAG-2NIC-CG.

The Received IP address presented by the script log is a temporary IP; the final IPs for NIC one and NIC two are assigned to the Unified Access Gateway appliance during the first start. Return to the vSphere Web Client and validate the IP address in the next step.

1. Click the New Tab button to open a new tab.
2. Navigate to the Unified Access Gateway administration console URL, for example,  https://uagmgt-int.airwlab.com:9443/admin.
3. Enter the username, for example, admin .
4. Enter the password, for example, VMware1!.
5. Click Login.

A successful login redirects you to the following screen. Keep this window open as you will return to the administration console later.

Click Select to configure settings manually.

1. Click SHOW, after you click SHOW, it changes to HIDE.
2. Click the gear icon next to Content Gateway Settings. The circle should be green, which means the Unified Access Gateway appliance and Workspace ONE UEM Console can communicate.

The Content Gateway edge service is enabled based on the configuration defined in the INI file.

You can change the configuration any time, or choose not to configure settings in the INI file and later enable the settings through the Unified Access Gateway administration console.

Each time you change the configuration and Save, the changes are applied to the configuration files and the Content Gateway edge service restarts automatically. Devices cannot communicate with the service during the restart.

Click Cancel.

1. Select Content.
2. Select Repositories.
3. Select Admin Repositories.
4. Click Add.

1. Enter a Name, for example, Corp Files.
2. Select Network Share for Type.
3. Enter the Link, for example, \\intranet.corp.local\Corp Files.
4. Enter the Organization Group, for example, Exercise 02.
5. Select USER for Authentication Type.
6. Enter the User name, for example, corp\administrator.
7. Enter the Password, for example, VMware1!.
8. Select your Content Gateway, for example, Content Gateway on UAG. Access to this internal repository goes through the Content Gateway that you set up in the previous exercise.
9. Click Continue.

Click Save.

1. Select Content.
2. Select Content Locker.
3. Select List View.
4. Select Corporate File Servers.
5. Select Corp Files.
6. Select the IT folder.

You can see the files available in this folder and in sync with Content Management.

The Installed/Assigned column lists the number of devices where the files are available. Click the quantity to see a list of each device that can access the file.

Although you configured the security configurations on the network file share, Workspace ONE UEM allows you to set up a new layer of security for the content on mobile devices.

1. Navigate back to the Corp Files folder.
2. Click Edit for one of your folders.

There are a number of configurations that you can apply to increase security of the asset on the mobile devices. In this example, you edit security for the IT folder, however, you can override the security properties on multiple levels, such as navigating to a specific file.

In this example, you allow the end-user to print any content under the IT Folder from a managed mobile device using Workspace ONE Content.

1. Select Override.
2. Select the Allow Printing check box.
3. Click Save.

1. Select Apps & Books.
2. Select Applications.
3. Select Native.
4. Select Public.
5. Click Add Application.

1. Select Apple iOS for Platform.
2. Enter Content Locker for Name.
3. Click Next.

Click Select.

Click Save & Assign.

Click Add Assignment.

1. Enter your assignment group, for example, Exercise 02.
2. Select AUTO for App Delivery Method.
3. Select Enabled for Managed Access.
4. Click Add.

Click Save & Publish and then click Publish.

After you click Publish, you should receive a prompt on your device requesting confirmation to install the Workspace ONE Content application. Confirm and launch the application after the installation completes.

Tap Content to open Workspace ONE Content.

1. Tap the Repositories icon.
2. Tap Corp Files.

1. Enter a User ID, for example, CORP\jdoe.
2. Enter the Password, for example, VMware1!.

Repeat the following steps for each folder you see under Corp Files. You can see the available files in each folder.

Tap the IT folder.

Tap a file to open it.

1. Tap the Share icon. The Print option is available based on the security properties previously defined for the IT folder.
2. Tap < to return to Corp Files.

1. Tap another folder in Corp Files, for example, Finance.
2. Tap a file to open it.

The file is downloaded to your device and opened.

1. Tap the Share icon. The Print option is not available for this file.
2. Tap < to return to Corp Files.