Understanding DTR updates for Workspace ONE Tunnel

Overview

Device traffic rules (DTR) govern how Workspace ONE® Tunnel routes, blocks, bypasses, or proxies traffic on managed devices. These rules change often, whether to block a new domain or route traffic for a new application, so updates need to reach enrolled devices quickly and without manual intervention. Manual profile pushes introduce delay and trigger unnecessary client certificate regeneration.

Purpose of this guide

This document covers the methods available for delivering DTR updates, including Rapid DTR, gateway-based delivery, on-demand client sync, and profile push, and explains when to use each one. It also covers platform prerequisites, configuration settings, and example deployment scenarios.

Audience

This operational tutorial is intended for IT professionals and Workspace ONE administrators. Both current and new administrators can benefit from reading this document. 

What are device traffic rules (DTR)?

Device traffic rules define how Workspace ONE Tunnel routes traffic on managed devices. It decides which apps and destinations are tunneled, bypassed, blocked, or proxied. When those rules change, getting the updated DTR to enrolled devices needs to happen quickly and automatically.

What DTR updates don’t change

DTR updates do not modify

• Client authentication certificates
• SSL pinning configuration
• Any other VPN profile settings

For client certificate or profile-level changes, a profile push is still required.

Overview of DTR delivery options

Prerequisites

• Omnissa Unified Access Gateway™ 26.03 or Tunnel Container 26.03
• iOS Tunnel app 25.08 or later
• Android Tunnel app 25.12 or later
• Windows Tunnel 25.08 or later
• macOS Tunnel 25.08 or later

Rapid DTR

Rapid DTR is a feature of Omnissa Workspace ONE Tunnel that delivers Device Traffic Rule (DTR) updates to enrolled devices automatically without pushing a new profile. When an administrator updates a DTR in Workspace ONE® UEM™, the Workspace ONE Tunnel client picks up that change from UEM automatically on the next sync cycle without a profile update or profile publication.

DTR delivery via the Tunnel gateway

An additional delivery option is DTR delivery via the Tunnel gateway. In this scenario, the Tunnel gateway (instead of UEM) delivers the updated DTR to the Tunnel client when it connects to the Tunnel gateway.

On-demand sync via Workspace ONE Tunnel client

In the Tunnel client, there is a sync button that initiates an on-demand sync of the DTR to the client.

Profile Push

Pushing the VPN profile will also update the DTR on client. This is not recommended for updates that only have DTR changes.

How Rapid DTR works

The Workspace ONE Tunnel client periodically contacts a UEM API endpoint to check whether a newer version of its assigned DTR exists. If a newer version is available, the client fetches it and applies it to the client. No profile reinstall, no client certificate reissuance, and no user interaction is required.

The client initiates this sync on a configurable schedule. The default interval is 240 minutes (4 hours). To adjust this, deploy the ClientSyncInterval app configuration key through Workspace ONE UEM. The value is in minutes. The minimum recommended value is 60 minutes; values below that can create excessive API load.

Rapid DTR Platform availability

On Android, Windows, and macOS, Rapid DTR runs in the background with no administrator setup or user interaction required.

Enabling Rapid DTR on iOS

Add the following KVP to the iOS VPN profile via Application Configurations:

enable_rapid_dtr = true

On iOS, there is a one-time requirement for the initial sync; the user must open the Workspace ONE Tunnel app at least once. If the app has not been launched after enrollment, Rapid DTR will not run. Once the first sync completes, subsequent syncs run automatically on the configured interval.

How DTR delivery via the Tunnel gateway works

When a Workspace ONE Tunnel client connects to the gateway, the gateway checks whether the device DTR version matches the current version in UEM. If there is a mismatch, the gateway pushes the updated DTR to the client at that moment.

This is particularly useful for iOS, where it provides an update path that does not depend on the user having launched the Workspace ONE Tunnel app. A device that has not yet completed its initial Rapid DTR sync will still receive the latest DTR when the device connects to the gateway.

Gateway-based DTR delivery is controlled by the dtr_delivery server-side KVP. It is disabled by default. To enable it:

dtr_delivery = 1

Using dtr_delivery = 1 alongside Rapid DTR covers both scenarios: scheduled syncs for devices via Rapid DTR (including iOS devices that have launched the app), as well as updates when connecting to the gateway.

When to still use a profile push

Profile pushes are not necessary and not recommended for DTR-only updates. However, they are appropriate in these situations:

• Re-enrollment: A device is being set up fresh.
• Client certificate renewal: An existing client certificate needs to be replaced.
• Profile-level changes: Connection settings, provider type, or other non-DTR fields are changing.

For DTR-only changes, avoid profile pushes. Every profile push triggers client certificate regeneration, which reissues the client certificate with a new thumbprint. Depending on the number of devices, this may create an overwhelming number of requests for your certificate servers.

Frequently asked questions

Q: I updated the DTR and clicked Save. Why didn't my devices get the update?

Clicking Save stores the updated DTR in UEM but does not deliver it to existing enrolled devices. With Rapid DTR, devices pick up the change on their next sync cycle (default: 4 hours).

Q: Do I still need to repush the VPN profile to update DTR on iOS?

No. After the first app launch, iOS devices sync DTR changes automatically. Profile pushes for DTR-only changes are not required.

Q: Will Rapid DTR affect my devices' client certificates or cause re-authentication?

No. Rapid DTR updates Device Traffic Rules only. Client authentication certificates, SSL pinning, and all other profile settings are not affected.

Q: Can I reduce the sync interval below 4 hours?

Yes. Deploy the ClientSyncInterval app configuration key with a value in minutes. The minimum recommended value is 60 minutes. Lower values are not recommended because of UEM API load.

Q: What is the difference between Rapid DTR and dtr_delivery?

Rapid DTR is the periodic client-initiated sync with UEM. It runs on a schedule and does not require connecting to the Tunnel gateway. dtr_delivery = 1 enables gateway-based delivery, which is triggered when the client connects to the Tunnel gateway. Both should be enabled for full coverage across all device states.

Configuration reference

Customer use cases

Updating split-tunnel rules across a large iOS fleet

A retailer manages several thousand iOS devices used by store staff. When the networking team adds a new internal application domain, the security policy requires that traffic for that domain routes through Workspace ONE Tunnel rather than going directly to the internet. With Rapid DTR and DTR Delivery enabled on the gateway, the updated routing rule reaches devices on their next sync or their next gateway connection. The change causes no downtime for staff, which means no tickets for the helpdesk.

Blocking a newly identified domain on Windows endpoints

A security team identifies a domain that needs to be blocked across all managed Windows laptops. With Rapid DTR always on for Windows, the administrator updates the block rule in UEM and clicks Save. Within four hours, every enrolled Windows device running Workspace ONE Tunnel has the updated rule applied, with no profile push required. For teams that need faster propagation, lowering the sync internal to 60 minutes reduces the window further.

Onboarding a new internal SaaS application on Android

An organization deploys a new internal web application and needs to add its domain to the tunnel rule for all Android devices. The administrator adds the domain to the existing DTR in UEM. Because Rapid DTR is always on for Android, enrolled devices pick up the change automatically on the next sync cycle. The application is accessible to users within hours of the rule being saved, without any device interaction or MDM commands.

Mixed-platform fleet with a rolling policy change

An enterprise runs a mixed fleet of Android, iOS, Windows, and macOS devices. The security team updates traffic rules monthly as part of a recurring review. With Rapid DTR always on for Android, Windows, and macOS, those platforms self-update without any administrator action. For iOS, turning on DTR delivery via the gateway covers iOS devices that have not yet launched the app. One DTR update in UEM propagates to the entire fleet across all platforms, with no profile push required on any of them.

Summary and additional resources

Device traffic rules (DTR) determine how Workspace ONE Tunnel routes, blocks, bypasses, or proxies traffic on managed devices, and because those rules change frequently, administrators need a fast, automatic way to get updates to enrolled devices. Rapid DTR handles this by having the Tunnel client periodically check UEM for a newer DTR version and apply it without a profile push. DTR delivery via the Tunnel gateway complements this by pushing the update the moment a device connects, closing the gap for devices that have not yet completed a Rapid DTR sync. On-demand client sync and profile push remain available for manual refreshes or for changes outside DTR, such as client certificate renewal or connection settings, but neither is required for routine DTR updates. Used together, Rapid DTR and gateway-based delivery give administrators full coverage across device states while avoiding the client certificate regeneration and operational overhead that comes with unnecessary profile pushes.

Additional resources

• Configuring the Tunnel Edge Service: Workspace ONE Operational Tutorial
• Configure Tunnel Settings for Workspace ONE UEM
• Workspace ONE Tunnel: Per-App VPN Connection with Basic Configuration
• Workspace ONE UEM Architecture
• Understand and Troubleshoot Tunnel Connections for Load Balancing

Changelog

The following updates were made to this guide:

About the author and contributors

This document was written by: 

• Lewis Riley, Product Specialist, Omnissa.

Considerable contributions were made by the following subject matter experts:

• Amogh Joshi, Product Manager, Tunnel

Feedback

Your feedback is valuable.

To comment on this paper, contact tech_content_feedback@omnissa.com.