Content Gateway deployment on Unified Access Gateway begins with providing the Unified Access Gateway (UAG) parameters to a configured node on the Workspace ONE UEM console.
You must have an active deployment of the Unified Access Gateway either as an Appliance or using PowerShell to configure Content Gateway. For more information, see Deploying Unified Access Gateway Appliance and Using PowerShell to Deploy Unified Access Gateway in the Unified Access Gateway documentation.
Configure a Content Gateway Node with Unified Access Gateway Parameters
To establish a Content Gateway node, configure the Content Gateway settings in the Workspace ONE UEM console. Configuration includes selecting the platform, configuration model, associated ports, and if necessary, uploading an SSL certificate.
You can either add a new node and configure the Unified Access Gateway settings or edit an existing configuration and provide the Unified Access Gateway parameters. When you edit an existing configuration, the updated settings are applied on the active repositories and help you to minimize the manual configuration and the accessibility of end users.
After you edit and save the existing configuration of your standalone Content Gateway instance, you cannot revert to the previously configured values. In case you revert to the previously configured values on the console, you must reinstall the Content Gateway.
- Navigate to in the Organization Group of your choice.
- Set Enable the Content Gateway to Enabled.
You might need to select Override to unlock Content Gateway settings. If you have an existing active Content Gateway node, the setting is enabled.
- Select the Configuration Type.
- If you want to configure a new Content Gateway Node in the Workspace ONE UEM console, select Add.
- If you want to edit an existing node, select Edit.
- To configure a Content Gateway node, complete the following fields.
- Configure the Installation Type.
Setting Description Installation Type Unified Access Gateway appears as the default available platform for Content Gateway.
- Configure the Content Configuration settings.
Setting Description Configuration Type
- Basic – Endpoint configuration with no relay component.
- Relay – Endpoint configuration with a relay component.
Name Provide a unique name used to select this Content Gateway instance when attaching it to a Content Repository, Repository Template, or RFS Node. Content Gateway Relay Address If implementing a relay configuration, enter the URL used to access the Content Gateway Relay from the Internet. Content Gateway Relay Port If implementing a relay configuration, enter the relay server port. Content Gateway Endpoint Address Enter the host name of the Content Gateway endpoint. The Public SSL certificate bound on the configured port must be valid for this entry. Content Gateway Endpoint Port Enter the endpoint server port.
- Configure the Content SSL Certificate settings.
Setting Description Public SSL Certificate (required for Linux requirements)
If necessary, upload a PKCS12 (.pfx) certificate file with a full chain for the Content Gateway Installer to bind to the port. The full chain includes a password, server certificate, intermediates, root certificate, and a private key.Note: To ensure that your PFX file contains the entire certificate chain, you can run commands such as
certutil -dump myCertificate.pfxor
openssl pkcs12 -in myCertificate.pfx -nokeysusing command-line tools such as Certutil or OpenSSL. These commands display the complete certificate information.
Requirements vary by platform and SSL configuration.
Ignore SSL Errors (not recommended) If you are using a self-signed certificate, then enable this setting. If enabled, Content Gateway ignores certificate trust errors and certificate name mismatches. Console Action SSL Offloading Server Action Upload No Opt out of SSL Offloading when prompted during installation. Upload Optional Yes Select SSL Offloading when prompted during installation.
- Configure the Certificate Authentication settings.
Setting Description Enable Cross-domain KCD Authentication Enable this setting to authenticate users with the PIV-D Derived Credentials instead of user names and passwords.
PIV-D certificate authentication is for the users who access the on-prem SharePoint repositories from their devices.
Client Certificate Chain The certificate chain used to issue client certificates. Target SPN
SPN of the target service.
Service Account Username User name of the service account that has delegation rights. Service Account Password Password for the service account. Domain Name of the domain in the Active Directory (AD) containing the users. Domain Controller Hostname or IP address of the domain controller for the domain.
- Enter the Content Gateway edge service values under the Custom Gateway Settings.
This step is optional. You must perform this step only if you want to override the default configuration values for Content Gateway.With the edge service values set on the UEM console, the configuration file changes are automated and does not require manual updates to the configuration files each time the UAG is upgraded. ICAP Proxy configurations are not supported from Workspace ONE UEM console version 9.7. However, existing configurations can be edited. For information about configuring ICAP Proxy, see https://kb.vmware.com/s/article/2960835.
- Configure the Installation Type.
- Select Add and then select Save.
Note: HTTP traffic is not allowed for Content Gateway on port 80 on Unified Access Gateway because TCP port 80 is used by the edge Service Manager.
After configuring settings in the UEM Console, download the installer, configure additional nodes, or manage configured nodes.
Custom Values for Content Gateway
The custom configuration values for the Content Gateway on Unified Access Gateway (UAG) can be set on the Workspace ONE UEM console. These custom values when fetched by the UAG server are automatically updated into the Content Gateway configuration files. The automatic updates eliminate the manual effort of updating the configuration files every time the UAG server undergoes an upgrade.
|Keys||Type||Value||Description||Supported UAG and CG version|
|aw.server.security-headers.hsts.enabled||Boolean||true||Allows HSTS support in CG.||UAG 3.9 (CG 2.11.0) and later|
|aw.fileshare.client.domain||String||Default domain with which the users are associated while accessing fileshare repositories.||UAG 3.9 (CG 2.11.0) and later|
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA, TLS_DHE_RSA_WITH_AES_256_CBC_SHA, TLS_RSA_WITH_AES_256_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA, TLS_DHE_RSA_WITH_AES_128_CBC_SHA, TLS_RSA_WITH_AES_128_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384, TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384, TLS_DHE_RSA_WITH_AES_256_GCM_SHA384, TLS_DHE_RSA_WITH_AES_256_CBC_SHA256, TLS_RSA_WITH_AES_256_GCM_SHA384, TLS_RSA_WITH_AES_256_CBC_SHA256, TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256, TLS_DHE_RSA_WITH_AES_128_GCM_SHA256, TLS_DHE_RSA_WITH_AES_128_CBC_SHA256, TLS_RSA_WITH_AES_128_GCM_SHA256, TLS_RSA_WITH_AES_128_CBC_SHA256
Comma separates list of allowed ciphers.
|UAG 3.9 (CG 2.11.0) and later|
|aw.http.protocols||String||SSLv2Hello, SSLv2, SSLv3, TLSv1, TLSv1.1, TLSv1.2||Values can be separated by comma.||UAG 3.10 (CG 2.12.0) and later|
Modifying the SMB Configurations
The SMB configurations are stored in
smb-connector.conf files under the smb-connector directory at the Content Gateway installation path. To define precisely the custom values for these configuration files, you must obtain the current files from the UAG's log export functionality. A definite sequence is not followed when adding a new custom value to these configuration files. The new value when added appears at the end following all the existing values in the file.
Custom values can be provided in the UEM console using the following syntax:
- FILE_NAME = Name of the file; smb or smb-connector
CHANGE_TYPE = ADD, REMOVE, or UPDATE
- EXISTING_LINE = The current content of the line that needs the required change. If the line is not found in the file, this entry in the Key Value Pair (KVP) is ignored and does not have any impact on the file. It is applicable if there is UPDATE or REMOVE.
- LINE_VALUE = Value of the line to be inserted or updated. It is ignored if there is REMOVE.
Listed are few examples of modifying the custom values in the SMB configuration files.
|extconf##smb##UPDATE##client min protocol = SMB2_02||String||client min protocol = SMB3||Update the line in the smb.conf file that equals that client min protocol = SMB2_02 with client min protocol = SMB3|
Example 2: Updating the smb-connector logs to debug mode. Default is 1 (error) and allowed values are: 0: Off, 1: Error, 2: Warning, 3: Info, 4: Debug
|extconf##smb-connector##UPDATE##log_level 1||String||log_level 4||Update the line in the smb-connector.conf file that equals that “log_level 1” with “log_level 4”|
Modifying Application Log Levels
|extconf##logback##level##com.vmware||String||debug||Update the application logging level to debug.|
Configure Content Gateway on Unified Access Gateway
- Open the Unified Access Gateway Admin UI and navigate to and click the gearbox icon.
- Select YES to enable Content Gateway settings.
- Configure the following settings and click Save.
Option Description Identifier Indicates that this service is enabled. API Server URL
The AirWatch API Server URL
The destination URL must contain the protocol, host name or IP address, and port number. For example: https://load-balancer.example.com:8443.
Unified Access Gateway pulls Content Gateway configuration from the API server.
API Server Username
User name to log into the API server.
You must assign the Content Gateway role to the admin account.
API Server Password Password to log into the API server. Content Gateway Hostname Host name used to configure edge settings. Content Gateway Configuration GUID VMware Content Gateway configuration ID. This ID is automatically generated when the Content Gateway is configured on the Workspace ONE UEM console. The Configuration GUID is displayed on the Content Gateway page on the Workspace ONE UEM console under . Outbound Proxy Host The host where the outbound proxy is installed. If configured, the Unified Access Gateway makes a connection to API Server through an outbound proxy. Outbound Proxy Port Port of the outbound proxy. Outbound Proxy Username User name to log into the outbound proxy. Outbound Proxy Password Password to log into the outbound proxy. NTLM Authentication Specify whether the outbound proxy requires NTLM authentication. Trusted Certificates Add a trusted certificate to this edge service. Select '+' to select a certificate in the PEM format and add to the trust store. Select '-' to remove a certificate from the trust store. By default, the alias name is the filename of the PEM certificate. To give a different name, edit the alias text box. Host Entries
Enter the details to be added in the /etc/hosts file. Each entry includes an IP, a hostname, and an optional hostname alias in that order, separated by a space.
For example, 10.192.168.1 example1.com, 10.192.168.2 example2.com example-alias. Select '+' to add multiple host entries.Important: The host entries are saved only after you select Save.
Verify Content Gateway Connectivity
- Navigate to in the UEM console.
- Select Test Connection to verify the connectivity.