What Are the Differences Between Web Resources and Tunnel Resources?
Supported Architecture Differences
Tunnel resources support both B/S (browser/server) and C/S (client/server) architecture applications.
Web resources support only B/S (browser/server) architecture applications.
Different Access Methods
The iOA client must be installed for tunnel resources, and they can be accessed only through the service backend address.
Web resources do not require client installation. You can access services through a browser or other methods, and access is supported through frontend addresses or custom domain names.
Different Access Address Types
Tunnel resources can be accessed only through the backend address.
Web resources support access through frontend addresses or custom domain names. Access through backend addresses is prohibited.
Summary of Key Differences
Architecture compatibility: Tunnel resources can adapt to more complex C/S architecture applications, such as traditional desktop clients, while Web resources are only suitable for web-based applications.
Access threshold: Tunnel resources require a client and are suitable for strict control scenarios, while Web resources have zero client dependency and are suitable for quick access.
Address access rules: Backend addresses are forcibly hidden for tunnel resources, and only standardized entry points are exposed. Web resources provide friendly access entry points through frontend addresses/custom domain names, while backend details are shielded to enhance security.
Does All Traffic Need to Be Routed Through the iOA Gateway?
Only business traffic that accesses iOA and whose logged-in account has the access permission for the corresponding service will be routed to the iOA gateway.
How Does Tunnel Resource Priority Work and What Is Its Purpose?
When multiple tunnel resources conflict, for example, when resources are accessed, wildcard domains and precise domains may be hit simultaneously, or IP address ranges and IP addresses may be hit simultaneously, resource priority is used to determine which resource is hit preferentially. This is the priority for tunnel resource access.
1. Tunnel resources can be configured with wildcard domain names. In this scenario, some domain names may require direct connection. You can separately configure the domain name resources that require direct connection and raise their priority.
2. The same tunnel resource needs to be routed through different gateways.
Why Can't I Access Resources Immediately After Configuration?
After resources are configured on the iOA console, they need to be delivered through the iOA gateway. Generally, you need to wait 1-2 minutes before access is available.
How Many Proxy Modes Does the Client Support, and How Should Conflicts with Existing VPNs Be Handled During Testing/Canary Deployment?
The client has three proxy modes:
Global Proxy: All access requests are intercepted through the virtual NIC. The system queries iOA's own DNS based on the IP address to determine whether to proxy the traffic. Compatibility issues may exist on terminals running multiple VPNs.
PAC mode/browser proxy: The browser intercepts access requests and forwards them to the NGN module, which determines whether to intercept them. The virtual NIC is not started. Only tunnel resources configured on the iOA console are routed through the proxy, while other traffic uses direct connection. This mode is typically used during the coexistence transition phase with other VPNs.
WFP mode: The Microsoft firewall driver intercepts access requests, then forwards the request packets to the NGN module for rule evaluation to determine whether to proxy them. Because it is an official Microsoft driver, it offers better compatibility and serves as an alternative to Global Proxy, but it can only be used on Windows.
As mentioned above, it conflicts with existing VPNs. During the testing/gray release phase, you can use PAC mode/browser proxy or WFP mode.