Preparing for Workspace ONE Tunnel client to replace AirWatch Tunnel client on iOS

Workspace ONE Tunnel client application for iOS is the replacement of the existing AirWatch Tunnel 1.3.3 for iOS app. This Tunnel client adopts an updated iOS 9 Per-App VPN framework (Network Extensions) to provide enhanced user experience and additional features for a broader use of this product.

 

What does this mean for existing customers using AirWatch Tunnel on iOS?

Despite Workspace ONE Tunnel being a replacement for AirWatch Tunnel, both the AirWatch Tunnel and Workspace ONE Tunnel are currently present in the App Store. If you are currently leveraging Legacy AirWatch Tunnel, this will continue to function without any change. Workspace ONE Tunnel is a completely separate application.

The Workspace ONE Team strongly recommends that customers work to migrate any existing AirWatch Tunnel deployments to instead leverage Workspace ONE Tunnel. AirWatch Tunnel leverages a Per-App VPN framework that was introduced in iOS 7, and it is possible that these frameworks may be deprecated in future versions of iOS. Migrating to Workspace ONE Tunnel will ensure compatibility with future releases of iOS. Additionally, all new features related to tunnel functionality will be introduced only to the Workspace ONE Tunnel client.

Note: Workspace ONE Tunnel 2.0+ requires iOS 9.0 and above. Additionally, Workspace ONE Tunnel requires Workspace ONE UEM (AirWatch) Console (along with Tunnel server version) to be on 9.0 and above. Future major releases and feature packs may have enhanced functionality to ease some aspects of the migration.

               VMware_Tunnel.png

 

New Customers

How to use Workspace ONE Tunnel

When deploying Workspace ONE Tunnel, you must ensure that the Workspace ONE Tunnel app is installed on a device before the Tunnel profile is pushed to the device. If the profile is pushed before the app is installed, it will not configured correctly and the profile must be re-deployed.

  1. Deploy Workspace ONE Tunnel as a managed app in the Workspace ONE UEM (AirWatch) Console. Note: This is the primary requirement for using Workspace ONE Tunnel seamlessly.
  2. Publish this application to all your devices and confirm its installation from the console.
  3. Navigate to Device Profiles in the Workspace ONE UEM (AirWatch) Console and create a new Workspace ONE Tunnel VPN profile for iOS and deploy it to all devices.
  4. This profile should configure and enable Workspace ONE Tunnel on each assigned device.

 

Existing Customers

Migration steps from AirWatch Tunnel to Workspace ONE Tunnel

We strongly recommend all customers to test this migration in a UAT environment or in a test group before making the change in production. When deploying Workspace ONE Tunnel, you must ensure that the Workspace ONE Tunnel app is installed on a device before the Tunnel profile is pushed to the device. If the profile is pushed before the app is installed, it will not configure correctly and the profile must be re-deployed.

  1. Deploy Workspace ONE Tunnel as a managed app in the Workspace ONE UEM (AirWatch) Console. This is the primary requirement for using Workspace ONE Tunnel seamlessly.
  2. Publish this application to all your devices and confirm its installation from the console.
  3. Once this is complete, re-publish the existing Tunnel profile to all devices. This profile will activate Workspace ONE Tunnel and disable AirWatch Tunnel on the device.
  4. Now you can have your end users remove the AirWatch Tunnel app from their devices OR if it is pushed through AirWatch as a managed app, simply delete it from the Workspace ONE UEM (AirWatch) Console.

Note: The AirWatch Tunnel VPN profile can be deployed to both AirWatch Tunnel and Workspace ONE Tunnel with the same configuration. The profile will deploy to the Workspace ONE Tunnel app if it is available on the device, but if not it will instead deploy to the AirWatch Tunnel app.

Note: As of Workspace ONE UEM (AirWatch) Console 9.1+, there is a check box for the iOS Tunnel profile which if checked will always enable Workspace ONE Tunnel. Once this box is checked and profile is published, even if the profile lands on the device before the Workspace ONE Tunnel client, it will still be able to configure Workspace ONE Tunnel. We recommend customers to use this feature for a better migration/deployment experience.

How much time do I have to migrate?

It is possible that the next major iOS release will no longer support the Per-App VPN framework used in the AirWatch Tunnel client. In order to ensure support on devices as well as support for any new tunnel features introduced, AirWatch recommends planning to migrate your deployment to the Workspace ONE Tunnel client as soon as possible. 

Other Languages: 日本語

Have more questions? Submit a request

1 Comments

  • 0
    Avatar
    The Workspace ONE Team

    Reminder: Legacy AirWatch Tunnel for iOS is approaching the End of General Support

    Overview

    Last summer we announced that legacy AirWatch Tunnel for iOS will reach End of General Support (EOGS) on July 5th, 2019 and be removed from the App Store. Customers still using Legacy AirWatch Tunnel must migrate to Workspace ONE Tunnel for iOS in order to maintain functionality. More information on Workspace ONE Tunnel can be found through the Workspace ONE Tunnel product pagePlease reference the migration resources here for more information.

     

    Support Contact Information

    To receive support, either submit a ticket via the My Workspace ONE portal or call your local support line.

     

    Best Regards,

    The VMware Workspace ONE Team

     

Article is closed for comments.