The network tunnel service controls access for the Connect Tunnel client, OnDemand Tunnel agent, and Mobile Connect agent. Create IP address pools for clients to use as VPN endpoints. You can enable Web resource filtering for Workplace and single sign-on for web apps. Connect Tunnel can connect to different appliances or realms but defaults to the original one. For more information refer to Configuring the Network Tunnel Service.