Workspace ONE Tunnel is a per-app VPN technology, which is pretty easy to deploy and work on all major platforms today (iOS, Android, macOS and Windows 10). In order for this to work you need to deploy a Unified Access Gateway in a DMZ and configure a few things in Workspace ONE UEM console.
Deploying such virtual appliance can be really simple – one machine with one NIC. This is what I typically deploy for testing or PoC. But what if you require something little bit more secure?