Hello everyone, I'm Andreano Lanusse from the VMware End-User Computing group and I'm
here today to talk about how VMware Workspace ONE enables external users to access internal
resources. When you see the reality today, the users are no longer sitting behind
the desk with their computers accessing information. They are all over the
place accessing those informations through
mobile devices with iOS, Android, or two laptops which can be Win10, Chrome,
or Macbooks, so the diversity here is quite large because you are no longer
sitting or leveraging one specific type of device, right? And when you look the
information that they need to access even that we are now moving a lot of
things to the cloud there's a lot of important information that remains into
their internal network. And those informations can be hosted in SharePoint
servers, can be a network FileShare where they have like hundreds and
thousands of files, they also has some internal websites that is to host them
internally and some native applications that you host that you're deploying one
of those devices needs to access back-end information through some type
of rest or SOAP API. There are also organizations that want to containerize
information and they provide access through virtual desktops over to apps
and those apps hosted in VMware Horizon. So all of these are completely separate right
so we have the users only connecting to internet everywhere and all of these on
the internal network so the question is how do I enable and provide security to
access all this information first though for those users? I support IT providing
all the security requirements there and now so I don't impact the productivity
of the users blocking them to do the job? So to do that
VMware Workspace ONE provides the VMware Unified Access Gateway. The Unified Access
Gateway it is an appliance that typically sits on the DMZ right behind a
load balancer firewalls right and then Unified Access Gateway provides a number of
different services to access those internal resources and those services we
call EDGE Services. They can support multiple use cases. The first Edge
Services that we call is the VMware Tunnel which provides per up
tunneling for applications that for native applications or web domains that
you have on your mobile devices or your Win10 and or Mac. The second one service
is the Content Gateway. Let's put this as a Content here. The Content Gateway
enables the users to access SharePoint in file share and other internal
repositories through the Workspace ONE Content app on those devices. The third
one is the one that we call Reverse Proxy, where the reverse proxy and
identity bridging which will allow managed and unmanaged devices to access
internal websites directly without authentication, but what we're really
trying to do here is secure right so we in this case we provide different ways
to authenticate the users into those internal websites, which in many
situations are legacy websites, and we are going through that in a couple of
minutes. And the last one is what we call Horizon Service that enables access
to virtual desktops and retro apps in all of this, Unified Access Gateway provides
authentication, what we call DMZ authentication, through different methods you
can perform have a second-factor authentication through SecureID or
RSA, you can leverage your certificates, including smart cards, radios, as another
method, and what we call pass-through as well. So this is really the core of the
Unified Access Gatway when you deploy. So those are the main services and
authentication provided here. Aut also there is an important point on the Unified
Access Gateway which is how you the appliance segment segment to the network
I can deploy that appliance with one, two, or three NICs. I'm gonna consider in
that use case here that I'm deploying, that appliance with 2 NICs, and the first
NIC that you see here on the front is the NIC that will receive all the
traffic coming from the Internet. On that traffic coming from the Internet, UAG
will forward to the respective services, perform all the authentications, and all
the security that we configure in the appliance, and then to the second NIC,
which is the backend NIC, the NIC that communicates with the internal network
so it will forward the traffic to the respective endpoint service. With
that, all the firewall rules can be applied to those specific NICs here on
the internet NIC, and to those to that specific NIC on the back end, so that
you restrict access to the internal network just for that specific NIC here,
as well. There are more regarding network segmentation access to different network
subnets that you can also configure in the Unified
Access Gateway here as well, but let's go now and try to understand
what would it be the use cases some of the use cases that I could be handled
here with the Unified Access Gateway? First one, let's say I have the user that has
some native apps on the mobile devices and that application needs to access a
back-end system to get the data, so workspace ONE UEM can configure here
on that device what we call per-app VPN and that per-app VPN can be assigned to a
specific application or actually specific domain in the case of iOS, and
then when the users launch the app, it opens the per-app VPN, which goes here
into the Unified Access Gateway, and the Unified Access Gateway checks that traffic and
forwards to the specific service, in this case, VMware Tunnel. The VMware Tunnel,
because I'm coming from a managed device, goes into the Workspace ONE UEM, and checks
if that device is in compliance or not. If something is out of compliance,
devices geo brake or hood route in the Android case, it will block the traffic
here, not allowing that device to communicate with the internal network.
But if it's okay VMware Tunnel for the traffic to the backend
NIC then goes into the service that that device is trying to access, which
could be the backend system to ressource of API or it can even be intranet
website to the proper browser here. This is the first use case that we are going through
here. The second one, let's say from that same mobile device, users want to access
files that are stored on the internal network stores like SharePoint or FileShare.
The user goes here on the device launching the Workspace ONE Content app that
will go into the Content Service and will perform the same device compliance
check as part of the authentication method here on the Unified Access
Gateway and that content will be read directly
that communication will be forward to the specific asset that the user is
trying to access. That could be the SharePoint and it could be the FileShare.
So this is a very secured way to provide access to those internal
resources and associated with the profiles that we restrict access and
separation of the corporate data in the personal data we secure end-to-end the
communication of internal resources and also secure the device with other
policies that we are pushing through Workspace ONE UEM. The second case, let's
say you have your laptop your Windows 10 and you need to access some internal
websites but may or may not your device is managed by Workspace ONE UEM or may
not, so you have some internal websites and those websites perform authentication
through Kerberos right, so let's say you don't want to allow access directly to
those internal websites without any type authentication so you want to leverage one
or more authentication to make sure that user that's coming to access that
is really the user that has the permissions to access those websites, so
we can do that leveraging web reverse proxy and identity bridging, so the
Web reverse proxy will enable access to that internal website right and the idea of
the bridging will be the part of the services and will be responsible to take
the identity of the user and transform that identity to perform the
authentication against the website using Kerberos. The user here can provide their
identity through SAML or through certificate. I'm going to consider in
that use case the users provide the identity to SAML, and when the users
log in to the Workspace ONE catalog that is provided by the identity manager,
the user performs the authentication and the Identity Manager provide the SAML
assertion for that specific user. When the user
requests access to that web browser in Windows 10 to access their internal
website, the user sends their assertion to the UAG, which will check against the IDP,
in this case, the Identity Manager, if that assertion is valid or not. If the
assertion is valid, Unified Access Gateway will go into the domain controller to
request a Kerberos ticket and with that ticket that Kerberos ticket, Unified
Access Gateway will use that ticket to authenticate the user against the
website. When the authentication is performed, the user in the user is valid
so the user has access and it is authenticated to access that website in
a secured way. Remember that Unified Access Gateway goes here on the web prefers
proximity bridging and then goes here, and the last use case is that the one
that let's say some organizations has the requirement to provide access to all
of these resources through some type of containerization method which can be
virtual desktops or which we call VDI or publish apps through RDSH, one way to
do that is leveraging VMware Horizon and enable the access to those internal desktops
and published apps to the Horizon Services Unified Access Gateway. For that, the
user can launch can authenticate first from their device using the Horizon
Client or the Workspace ONE app, when the user performs that first request,
UAG will send the request to the Horizon servers, which will go on the
Connection Server to perform the authentication to the XML API protocol.
That first step is really authenticating the user, and with the user authenticated,
the user will perform a second step here on their client which is launch an app a
virtual app or launch their virtual desktop and to that same channel they will
launch for example the desktop using the Blast protocol, UAG will validate that
desktop protocol, and to that validation, it will direct the connection to direct
into the desktop, so you no longer need to authenticate again because you are
already pre authenticated in the first step, so users now when they launch their
desktop in the VDI goes reacting to the desktop and the publish apps. With that,
so you are providing through their appliance access to all of those all of
the services. An important consideration here is, this is a general overview, and
when you are trying to scale, and you have thousands of mobile users, thousands
of users trying to access their VDI, there are some best practices and some
architecture and design that we need to consider here, as for example, we are
going to be separating some of those services, because you probably don't have like
50,000 users accessing all those services, right? We are going to be
scaling and deploying appliances based on their needs and the requirements for
the organization. But the important point here is, if you need to scale, that you
can deploy additional appliances behind your load balancer, that will be here, and
that traffic will be distributed across all the appliances. With that,
the organizations integrated Workspace ONE UEM to push policies and
secure the devices when they are managed, and we've had any manager provide a
unified catalog and also provide main access for those users that you maybe
don't want to manage the device but just want to provide access to apps, you can
secure the access to the internal resources with Workspace ONE. If you want
to know more about the best practices and how we scale and how to deploy and
design the Unified Access Gateway, you can go into TechZone.vmware.com where
you're going to be finding videos, tutorials, reference architecture, how-
to design and leverage Unified Access Gateway to your Workspace ONE and Horizon
deployments today. That's it for today. I want to thank everyone, and see you next
time!
[Music]