VMware Workspace ONE Community
syarbrou
Enthusiast
Enthusiast

How to move from VMware Tunnel/Content Gateway to UAG?

I have frontend and endpoints setup for Tunnel, Proxy, and Content on Linux in my organization.  Lately VMware keeps calling my environment "Legacy".  With the next update we do I am going to have to also replace all my SSL certs and was thinking of switching to UAG.  Some questions immediately pop up:

1. Being a packaged deal not sure how that would work.  Does this still have the frontend and endpoints?

2. If I turn off my current servers and install these, rename them to the same as the old ones, and use the same IP's will they just pick up where the other ones left off?

3. Curious also if there is any conversion guide and way to do this without users being overly impacted.

4. I assume the UAG includes Tunnel, Proxy, and Content?

5. I have never done an OVA install as basically when a new version comes out do you delete the current install and put the other OVA in it's place and redo all the settings again?

Thanks.

Reply
0 Kudos
3 Replies
jonathanjabez
Hot Shot
Hot Shot

Hi,

In place upgrade of UAG appliance is not an option. You would need to delete the old one, deploy the new UAG appliance with the same IP and Hostname details, and reapply the configuration. Before deleting the old one, export the settings to a JSON file as a configuration backup. You can reapply the licenses, SSL certificates, etc. after deploying the new UAG

Reference Blogs:

https://www.carlstalhood.com/vmware-unified-access-gateway/#upgrade

Reply
0 Kudos
werner_mobinerg
Contributor
Contributor

Here are some answers to your questions:

1. Being a packaged deal not sure how that would work.  Does this still have the frontend and endpoints?

YES, you will just deploy 2 UAG's. One in the DMZ to replace your "Relay" server and one in your LAN to replace the "Endpoint" server.

2. If I turn off my current servers and install these, rename them to the same as the old ones, and use the same IP's will they just pick up where the other ones left off?

You will need to create new configurations in Workspace One UEM. You will need to select the Linux UAG'S for each of the edge services. I make sure to use the same ip's so that I don't have to deal with the firewall.

3. Curious also if there is any conversion guide and way to do this without users being overly impacted.

https://www.carlstalhood.com/vmware-unified-access-gateway/  is great guide, but go ahead and google, there are several out there.

For Content there is an official VMware Guide here: https://docs.vmware.com/en/VMware-Workspace-ONE-UEM/9.7/content-gateway-to-unified-access-gateway-mi...

4. I assume the UAG includes Tunnel, Proxy, and Content?

Yes, and the new version now includes the Secure Email Gateway. - depending on how many users will be using these edge services you may want to consider HA.

5. I have never done an OVA install as basically when a new version comes out do you delete the current install and put the other OVA in it's place and redo all the settings again?

You deploy the .OVA in vSphere and follow the install guide. For updates you download the .ini configuration from the UAG, then deploy the new .OVA and insert the configuration. Done.

You can also use the powershell method to deploy or update your UAG's. Should you be using numerous UAG's then it's worth your time to create the powershell script.

Good luck

Reply
0 Kudos
aguedesrocha
VMware Employee
VMware Employee

There are tutorials on Tech Zone explain step by step how to deploy UAG and configure Tunnel, Content Gateway, and all other edge services.

Since you are starting, read the following tutorial first to understand the bases of UAG deployment

Deploying VMware Unified Access Gateway: VMware Workspace ONE Operational Tutorial

The move to the following one related to the configuration of the edge services (Tunnel and Content)

Configuring the VMware Tunnel Edge Service: VMware Workspace ONE Operational Tutorial

Configuring the Content Gateway Edge Service: VMware Workspace ONE Operational Tutorial

Tunnel Proxy is no longer recommended, you should use Per-App Tunnel - read this article on how to migrate from Tunnel Proxy to Per-App Tunnel

Migrating from Tunnel Proxy to Per-App Tunnel

Reply
0 Kudos