1. A method, comprising: transmitting, to a mobile device, policy information that describes one or more policies for providing an application of the mobile device with access to at least one resource accessible through an access gateway; receiving, by the access gateway, as part of a process of establishing a per-application policy-controlled virtual private network (VPN) tunnel for enabling the application with access to the at least one resource, a ticket configured to provide authentication in connection with establishing the per-application policy-controlled VPN tunnel, wherein the ticket includes a validity duration; providing access to the at least one resource via the per-application policy-controlled VPN tunnel; receiving, during the validity duration, the ticket at the access gateway to cause the per-application policy-controlled VPN tunnel to be re-established a first time; closing the per-application policy-controlled VPN tunnel after re-establishing the per-application policy-controlled VPN tunnel the first time; and after closing the per-application policy-controlled VPN tunnel, receiving, during the validity duration, the ticket at the access gateway to cause the per-application policy-controlled VPN tunnel to be re-established a second time.