CONTENTS. What s New In Mobility. Release Overview

Transcription

1 Release Overview CONTENTS What s New In NetMotion Mobility The only per-app VPN for ALL major enterprise and mobile platforms...2 Use multiple authentication types simultaneously...2 Tighter Active Directory integration...3 Assign settings and policies by operating system...3 Seamless hotspot ( captive portal ) authentication...3 Programmatic access to Mobility server information...4 Custom terms-of-use acknowledgement before logon...4 Simplified over-the-air updates...4 Platform requirements and known issues in Mobility Appendix A: What s New in NetMotion Mobility Version and Appendix B: What s New in NetMotion Mobility Version Appendix C: What s New in NetMotion Mobility Version MAINTENANCE RELEASES Mobility Version Mobility Version Issues addressed in for all Mobility Editions New for Windows Clients Platform Requirements and Known Issues with Mobility Mobility Version

2 Release Overview WHAT S NEW IN NETMOTION MOBILITY Intelligent VPN Built for Applications, Containers, and Devices in Mixed Environments Mobile workers across the organization have fundamentally different application, devices, and security needs. IT organizations want to use a single VPN to manage and secure all of them, rather than multiple solutions each in their own silo, each supporting individual workgroups. Mobility 10.7 is breaking down IT silos and enhancing end user experience with intelligent new features that Allow new flexibility in managing per-application VPNs on iphones, ipads, Android, and Windows devices. Automates how per-app and standard VPNs are configured and managed. Streamlines the management of mixed mobile deployments. Mobility The Only Per-App VPN for All Major Enterprise and Mobile Platforms When employees use their personal devices for work, it is essential for both security and performance that only authorized corporate applications not personal apps and games access the corporate network. Mobility is the only VPN that can limit access from Apple iphones and ipads, Windows tablets and laptops, and Android tablets and phones to corporate assets on a per-application basis. Mobility s superior performance, traffic, and mobile network management capabilities make it the premier solution for secure mobile access. Organizations can now standardize their access policies across all of their mobile devices laptops, tablets, and phones. Use Multiple Authentication Types Simultaneously Authentication requirements are evolving due to escalating security threats and different workflows on different device form factors. Administrators can now configure authentication in Mobility for team s, and individual s devices using whatever method is most appropriate for the security need, workflow, or form factor. Users are automatically prompted for the proper authentication without being required to select a realm prior to authenticating. Create groups of devices that require two-factor authentication and others that authenticate with just a username and password. Users with more than one device can use the authentication method most appropriate for each device. Assign different methods for authenticating based on the operating system of a device. Windows laptops can authenticate differently than Apple ipads or Android phones. Support multiple organizations, each with their own authentication servers and technologies. 2

3 Release Overview Tighter Active Directory Integration When Using NTLM For many organizations, Microsoft Active Directory plays a central role in authenticating users and managing their access to networks, servers, file shares, and applications. Configuration settings and policies in Mobility now respond automatically to changes in Active Directory groups and group membership for users who have authenticated with NTLM. Save time and simplify management tasks by assigning an Active Directory group instead of individual users to a Mobility group. Users in that AD group automatically receive the correct settings. Simplify the on-boarding process by assigning Active Directory groups to Mobility policy rule sets. New users are automatically assigned the appropriate Mobility policies. When a user s Active Directory group changes, Mobility automatically applies the correct policy the next time the user connects. Note: This feature is not supported when using RADIUS based authentication protocols with Active Directory back-end. Assign Settings and Policies by Operating System In an active mobile deployment, adding new devices and retiring old ones can be time consuming. Mobility can automate assigning policies and settings to new devices based on operating system. Administrators can pre-configure and automatically assign the following: Default authentication type based on operating system. Windows, Apple, and Android devices can be assigned different defaults. Access policies for networks and applications. Device settings such as encryption, network timeouts, and addressing. Custom logon notices to remind users of corporate security policies and direct them to more resources. Seamless Hotspot ( Captive Portal ) Authentication Mobility brings the same convenience to Mobility users on Windows devices that iphone, ipad, and Android users currently enjoy. Mobility automatically detects when hotspots require logging on to a web portal to gain access to that network, and displays the portal logon page without disabling the VPN. Organizations save on data costs and employees gain access more quickly, without compromising security because Mobility preserves the VPN tunnel throughout the portal login process. VPN security remains in place, even on untrusted public networks. Users are protected from Evil Twin attacks since no unencrypted traffic or credentials are exposed to the untrusted network. Login process fully supports browser extensions that automate entering portal authentication credentials. 3

4 Release Overview Programmatic Access to Mobility Server Information For administrators who use dashboards or other network management applications, Mobility supports programmatic access to key metrics with an easy-to-use RESTful API. Organizations can develop applications that call the API directly and retrieve real-time data: Connection, device, and user status Application launch count Network roaming and usage Server and pool status The API is useful for feeding key performance metrics and current status into network management suites or custom-built management dashboards. With up-to-date information about the state of the deployment, administrators can make better management decisions, identify and resolve issues while they are small, and ultimately keep users productive. Custom Terms-of-Use Acknowledgement before Logon Many corporate security policies and some government regulations require that users be reminded of and accept terms of use that govern access to the organization s private network. Mobility can now display a customized notice and require that users accept it before connecting. Notice text is customizable, and different notices can be displayed for different users, devices, or groups. Simplified Over-the-Air Updates Mobility provides new tools for installing client updates while keeping users productive. Administrators can choose any of the following options: Give users the option to defer installing an update and to defer rebooting after installation completes. Users can choose when to install previously deferred updates. Administrators can choose which network types (Ethernet, WiFi, and Cellular) are allowed for downloading updates. When configuring a Diagnostics module update, only eligible devices are displayed. Integrate Mobility Servers into Corporate PKI Many organizations have turned to x.509v3 certificates to secure communications and validate the identity of users and devices in their networks. Mobility now allows administrators to import certificates signed by commercial or corporate certificate authorities. Tighter Security During Device Provisioning Mobility adds an additional layer of security to help manage logistical challenges of running a multiplatform mobile deployment. In addition to the quarantine features already used to manage the onboarding of 4

5 Release Overview new devices, administrators can now specify a list of people authorized to add a new devices to the deployment, providing an extra layer of accountability and control. IPv6 Support for the Datacenter IPv6 increasingly becoming a reality in the datacenter. Mobility 10.7 supports IPv6 for server to server communications in addition to IPv6 tunnels from the client to the server. Platform Requirements and Known Issues in Mobility Mobility servers accept connections from all currently supported Mobility 9.x and 10.x clients. The minimum supported system requirements for a Mobility server have not changed from previous versions. They are: a 2 GHz x64 compatible processor, 4 GB of RAM, and 20 GB of hard disk space. For more detail see: Supported Operating Systems and Mobility Versions A list of known and resolved issues can be found here: Known and Resolved Issues for Mobility

6 Release Overview Appendix A: What s New in NetMotion Mobility Version and Mobility enhances secure remote connectivity for the entire enterprise with: Support for ipads, iphones, and the ipod touch Automatic Client Updates for all platforms (version and later) Web-hosted Help system that is always available and up-to-date Mobility for ipads, iphones, and ipod touch NetMotion Mobility 10.5x delivers secure, flexible network access to iphones, ipads, and the ipod touch with the same reliability organizations have come to trust and rely on for their other devices running Android or Windows. More than just a VPN, Mobility dynamically adjusts to changing network conditions, ensuring that mobile workers have the most productive mobile experience possible and administrators maintain the control they need to secure the enterprise. Unlike competing solutions from other vendors, the Mobility client for iphone, ipad and ipod touch is deeply integrated with the operating system and supports native applications, not just a mobile browser. Policy The Mobility client supports over 30 policy conditions and actions, giving administrators fine-grained control over how workers access networks and resources. Make policy changes on-the-fly and enforce them in real-time. Improve security by granting access to specific resources only when using trusted networks or during specific times of day. Reduce data plan usage by blocking traffic at the client and automatically compressing data to get the greatest effective throughput with the least amount of data usage. Keep workers productive by dynamically adjusting QoS parameters according to the network name, type, or interface speed. Security Mobility supports NTLM, RSA, RADIUS, and certificate-based authentication, including industry-standard two-factor solutions. It also uses FIPS validated cryptography, and fully supports NSA Suite B compliant cryptographic algorithms. Performance Mobility maintains the performance advantages Mobility has over the competition, with up to 13 times better performance when downloading images and up to 90% faster when downloading web pages. 6

7 Release Overview Automatic Client Updates for All Platforms (Mobility 10.51) The Mobility client will be the last Mobility client you will ever have to manually install. Mobility adds the ability to: Remotely update the Mobility client for Windows over the network Install or upgrade the Locality agent for Windows Administrators can push an update to individual Windows devices, groups of devices, or an entire deployment in real time, or schedule updates during non-peak periods like evenings or weekends. Administrators can even allow users to interrupt an update, or defer it to a more convenient time in the work day. Clients running on other platforms are available in their respective application stores and can be upgraded manually or automatically, based on the user s preferences. To take advantage of automatic Mobility client updates for Windows, customers must have both a Mobility server and client. Mobility s automatic client update feature can also be used to upgrade Locality v2.10 agents or later. Web-Hosted Help Mobility s context-sensitive help system is easier to use and is hosted in the cloud so it can be accessed from any page of the Mobility console as well as directly from any browser. Customers automatically see the latest help content without having to update server software. The System Administrator Guide is still installed locally for customers who prefer local rather than web access. Start Application Policy Action on Android The start application policy action is now supported on Mobility client for Android. Administrators who need to automatically launch an application when network or device conditions change (for example, to start a file transfer or launch a web browser) can now do so on Android. Windows API Improvements The Mobility API (NMCLAPI) for Windows clients supports two new API calls: Determine the POP interface type (WWAN, WiFi, or Ethernet). This call can be used to set policy parameters (such as QoS or compression) based on the type of interface, as well as other attributes, such as the reported speed. Force a route check to speed up the process of reconnecting to an unreachable Mobility server. This call makes it easy for a third-party application to have Mobility update the routes back to the server when the interface address has changed. 7

8 Release Overview Multicast Support All clients now support standard IP multicast traffic. Applications that rely on multicast to communicate will work correctly on all platforms. In addition, IP multicast can be disabled to reduce the chances of data overage charges. Platform Requirements and Known Issues with Mobility 10.50/10.51 Mobility 10.5x servers will accept connections from all currently supported Mobility clients. The minimum supported system requirements for a Mobility 10.5x server have not changed from previous versions. They are: a 2 GHz x64 compatible processor, 4 GB of RAM, and 20 GB of hard disk space. For more detail, please review: Supported Operating Systems and Mobility Versions A list of known and resolved issues can be found here: Known and Resolved Issues for Mobility Known and Resolved Issues for Mobility

9 Appendix B: What s New in NetMotion Mobility Version Mobility enhances secure remote connectivity for the entire enterprise by Improving worker productivity with greatly increased performance and lower data consumption on real-world wireless networks Improving enterprise security with more authentication options for Android Improving the performance of real-time applications on Android Expanding platform choices for the mobile enterprise with new support for Windows 8.1, Windows Server 2012 R2 and Riverbed Steelhead Mobile clients Increased Performance and Lower Data Consumption on Real-World Networks While the carriers have made great strides in improving the overall performance and reliability of their LTE networks, latency is still a problem according to a recent report by Fierce Wireless. Mobility keeps workers productive on these networks with up to 300% faster performance compared to our competition, and 3.5 times the effective throughput over the same networks without Mobility installed. Organizations using metered data plans need to manage costs by controlling data use and avoiding overage charges, but adding controls often compromises mobile worker productivity and burdens the IT department that enforces the data policies. Mobility s advanced data compression technology shrinks the data sent over the network by up to half, reducing the risk of costly data overruns. Organizations with metered data plans will find Mobility keeps mobile workers, and those who manage them, more productive while reducing the overall costs of their mobile deployment. With Mobility 10.10, mobile workers spend less time waiting on the networks and consume less data to get their work done. The result is a more productive, profitable mobile deployment. Android Client Enhancements More Authentication Options Mobility adds certificate-based authentication for all devices running Android 4.2 or later, extending Android device usage to enterprise applications that require additional or stronger authentication. 9

10 Organizations can now use industry-standard PKI solutions on their Android devices. Users or devices can authenticate using any industry-standard x.509 v3 certificate to comply with advanced authentication regulations or corporate security policies. An easy-to-use interface lets mobile workers focus on their jobs, not on the technology. Real-Time Traffic Optimization for Android Mobility offers extended quality of service to real-time (UDP) applications, even under adverse network conditions, using advanced, patented packet loss recovery algorithms that recover lost packets without retransmissions. Mobility supports these optimizations on Android. Organizations using voice and video applications on Android devices can now use them to stay productive, even when packet loss exceeds 60 percent. Expanded Platform Support New Windows Platforms Mobility adds support for Microsoft s newest client and server platforms, Windows 8.1 and Windows Server 2012 R2. Enterprises adopting Win8.x-powered tablets and laptops can access all the benefits of the Mobility platform. Riverbed Steelhead Mobile Compatibility Mobility clients for Windows 7 and Windows 8 are compatible with version 4.0 of Riverbed s Steelhead Mobile client. Mobile workers can run both solutions side-by-side to reduce data consumption and improve performance. 10

11 Platform Requirements and Known Issues with Mobility Mobility 10.x servers will accept connections from all currently supported Mobility clients, including all Mobility 9.x clients. Mobility 10.x clients for Windows 8, 8.1, and Android can only connect to Mobility 10.x servers. Mobility clients for Android require Android version x. Android 4.4 is not supported in version In addition, certificate-based authentication is supported only on Android version 4.2 or greater. The minimum supported system requirements for a Mobility 10.5x server have not changed from previous versions. They are:: 2 GHz x64 compatible processor, 4 GB of RAM, and 20 GB of hard disk space. For more detail, please review: Supported Operating Systems and Mobility Versions A list of known and resolved issues can be found here: Known and Resolved Issues for Mobility

12 Appendix C: What s New in NetMotion Mobility Version 10 Mobility 10: Secure Remote Connectivity for the Entire Enterprise Mobility 10 is a major release that does more than just secure your data. With support for the newest mobile devices and platforms and greatly expanded administrative options, it provides a frictionless, productive experience for every mobile worker while maintaining the control and visibility administrators need to manage successful mobile deployments. Overview of New Functionality New Support for New Platforms Consumer devices are inexpensive and built for mobility, but it is difficult to provide mobile workers with secure, policy-based remote access to resources behind corporate firewalls. With Mobility 10, enterprises can support Windows 8, Windows 8 Pro tablets and Android devices, and realize the benefits of BYOD using proven, enterprise-grade tools to securely manage remote access. Along with world-class security and performance management technologies for securing the enterprise mobile network, Mobility 10 keeps workers productive, extending administrative controls to these highly mobile platforms. Role-Based Access Control Mobility 10 leverages the role-based access controls IT organizations already have. IT managers can improve the efficiency and security of their data centers without incurring the increased costs associated with standalone RBAC solutions. For example, using built-in templates, help desk personnel can be restricted to troubleshooting tools, while administrators associated with a particular group of users can exercise full control over their users, but not those associated with another group. Auditable Change Logging Mobility 10 keeps a record of configuration changes, who made them, and when. IT organizations can easily undo configuration errors and demonstrate compliance with security regulations and industry best practices. Major Features Mobility 10 Client for Windows 8 Desktops and Windows 8 Pro Tablets Mobility 10 offers the most complete support for Windows 8 and Windows 8 Pro Tablets of any leading mobile VPN. Organizations looking to improve worker productivity with new, lighter-weight platforms are using Windows 8 Pro tablets to satisfy both the users portability requirements and the enterprise s needs for productivity, security, and control. With Mobility 10, they enjoy the same security, productivity, and management benefits as they do with Windows 7 and Windows XP while leveraging the advanced capabilities of Windows 8. 12

13 Mobility 10 Client for Android Mobility 10 brings the world s most advanced mobile VPN to Android. The Android client boasts the same reliability, application session persistence, data compression, and web acceleration features thousands of organizations have come to rely on to keep applications connected and workers productive, even across coverage gaps or on slow and congested networks. Enterprises can confidently secure and manage network access, boosting mobile worker productivity with phones and tablets running the world s most popular mobile operating system. The client supports Mobility Policy Management conditions and actions, FIPS validated encryption, NTLM, RADIUS and RSA authentication technologies, and it is NSA Suite B-compliant. Users can see basic connection status information on the main screen and quickly gather and share diagnostic information. The Mobility 10 client for Android runs on all devices with Android 4.0 (Ice Cream Sandwich) or greater and is available on the Google Play store or by download from the NetMotion Wireless customer portal. It is not necessary to root a device to install and run the Android client. Platform-Specific Policies With broader platform support, Mobility 10 also provides the ability to create policies that are tailored to the needs of each user and that take advantage of the unique capabilities of each platform. Organizations can set policy on Windows 8 based on whether an interface has a monetary cost limiting roaming charges or they can limit access to corporate resources when a user is using a smartphone. Role-Based Access Control The administrative console in Mobility 10 has been significantly improved. Administrators can now delegate specific management tasks to the people best-suited to doing them without giving anyone more access than needed. You can set up console roles that define access to client and server configuration settings, analytics reports, Policy Management and NAC rules, and specify the people or groups who can assume those roles. Organizations can leverage Active Directory to implement role-based access controls or assign roles to individual users. Mobility 10 includes templates for the most common scenarios such as client administration for help desk personnel making it easy to get started. The Mobility console provides the flexibility to fine-tune access rights to match organizational needs and compliance requirements. 13

14 Auditable Logging of Console Changes Mobility 10 automatically logs changes made by all Mobility console users to server and client settings, Policy Management and NAC rule sets, user and device group membership, and console actions (such as user quarantine, reconnect and database maintenance). Robust log filtering makes it easy to determine who logged on when, what access role was used, and what was changed. Administrators can easily demonstrate compliance with corporate security policies and industry best practices, or roll back changes that may have degraded the performance of the pool or caused a service disruption. Mobility 10 Server for Windows Server 2012 Mobility 10 servers now fully support Windows Server Organizations can confidently deploy the latest Microsoft Windows Server platform to improve the capabilities and efficiency of their data centers. 14

15 Console Changes The Mobility console has been updated to make it easier to manage server pools and to support role-based access controls. New Mobility Status Page You can quickly check the health of your deployment on the Mobility status page. The status of all components including the server pool, clients, warehouse, and analytics can be determined at a glance. Server uptime, address, load balancing zone, and Mobility version information are all available with a single click. Graphs showing server health and memory usage automatically update. From here, administrators can quickly drill down to review server, client, and connection information. Interaction with the status page is managed using role-based access controls. 15

16 Consolidated Logging for All Servers in a Pool Log analysis for server pools has been simplified in Mobility 10. Administrators can choose to see event logs from all servers in the pool in a single log view, or view the log for an individual server. Since all event logs are viewable from any server in a pool, it s no longer necessary to determine which server a client is using before troubleshooting client connections. Easy Group Configuration and Management User and device group membership can now be configured and managed from a dedicated page as well as from the client settings page. With role-based access controls, access can be limited to specific people or teams, providing fine-grained control and streamlined management. Client Failover with a Single Click Managing connected clients during server maintenance periods is much simpler. When administrators need to take a server off line for maintenance, all clients can be failed over to another server in the pool with a single click, eliminating the need to select individual users for failover and reducing the length of planned server outages. New Setting: Pre-populate User Credentials During Mobility Client Logon A simplified user logon process reduces errors and support calls. When a user authenticates, the logon dialog box can be pre-populated with a user name and domain, or simply left blank. New in the Policy Management Module The Policy Management module has been updated to streamline the creation of policies and manage the differences between Windows and Android. Conditions and actions are clearly marked to show which platforms they support, and application names are easier to find and include in policy rules. Administrators can also filter their view to settings or applications that apply to a specific platform, which makes it easier than 16

17 ever to create platform-specific policies. With conditions, actions, and priorities placed on separate tabs, it is easier and faster to create rules and rule sets. Specify the applications for a policy rule Apply a rule only when there is a monetary cost Mobility 10 adds support for the metered connection setting in Windows 8, providing the ability to detect when a network interface has a monetary cost. Administrators can use this condition to more precisely manage VPN and connection use. 17

18 New in the Analytics Module Mobility 10 adds two new reports showing device and user group membership counts and details over time. Organizations that allocate costs per user license can use these reports to track license usage and aid in billing and license reconciliation. 18

19 New in the NAC Module The Mobility 10 NAC module supports new antivirus, firewall and anti-spyware products by AVG, Avast, Avira and ESET. Mobility 10 also expands NAC coverage for Windows 8 security products from those vendors, plus McAfee, Microsoft, Norton, Symantec, and Trend Micro. Platform Requirements and Known Issues with Mobility 10 Mobility 10 servers will accept connections from all currently supported Mobility clients, including all Mobility 9.x clients. In contrast, Mobility 10 clients for Windows 8 and Android can connect only to Mobility 10 servers. The minimum supported system requirements for Mobility 10 have not changed: 2 GHz x64 compatible processor, 4 GB of RAM, and 20 GB of hard disk space. For more detail, please review: Supported Operating Systems and Mobility Versions A list of known and resolved issues can be found here: Known and Resolved Issues for Mobility For More Information To learn more about Mobility, visit 19

20 MAINTENANCE RELEASES Mobility Version Server and Client Maintenance Release This release addresses an important connectivity issue with the server and adds a new client for Windows Clients Mobility supports Windows 10 (Professional, Enterprise). There is a single executable for both Windows 8 and Windows 10. Windows 10 clients should connect to a Mobility Server running or later Server In addition to the connectivity issue, we ve taken steps to strengthen TLS encryption with the Mobility console and improve the management of Windows CE devices and previously quarantined users. All Mobility 10.7x servers accept connections from all currently supported Mobility clients. We recommend that administrators running v10.70 servers upgrade to as soon as is practical in order to prevent the connectivity issue from occurring. Issues Addressed fixes a case where a connection between any client and a server stops passing data. Users could work around this by disconnecting and reconnecting the client. This release provides a permanent fix to the server. The TLS cipher suites used by the Mobility console have been updated to mitigate recently disclosed vulnerabilities in TLS. Users that were quarantined can now be moved to a different user group after the quarantine status is removed. Windows CE devices can now be automatically added to a Windows CE-specific device group. Previously, they were left in the Windows group. Known and Resolved Issues Known and resolved issues in

21 Mobility Version Mobility Client and Server Maintenance Release Issues addressed in for all Mobility Editions Mobility includes Improved user experience for certificate-based authentication Stability enhancements for older clients using QOS policies for UDP traffic A fix for local networking policies on the iphone, ipad, and Android platforms Improved error handling when attempting to connect to unreachable networks New for Windows Clients Mobility Windows Clients Platform Requirements and Known Issues with Mobility Mobility Commercial Edition servers must be managed in a separate pool from existing Mobility deployments. All Mobility 10.5x servers will accept connections from all currently supported Mobility clients. The minimum supported system requirements for a Mobility 10.5x server have not changed from previous versions. They are: a 2 GHz x64 compatible processor, 4 GB of RAM, and 20 GB of hard disk space. For more detail, please review: Supported Operating Systems and Mobility Versions A list of known and resolved issues can be found here: Known and Resolved Issues for Mobility

22 Mobility Version Mobility Server Maintenance Release Mobility version is a maintenance release that addresses important server stability issues and issues found in uncommon upgrade scenarios. NetMotion Wireless recommends that customers upgrade their servers to v10.01 as soon as is practical. For details, refer to Known and Resolved Issues. Significant Issues Addressed in v10.01 Fixed an issue related to the stability of the Mobility server Reduced the number of circumstances under which packet fragmentation would occur Improved the upgrade process to v10.01 from older versions of Mobility Added support for a new version of Microsoft s CNG.sys encryption library Version Information and Operating System Support Version replaces previous version 10 releases. Note the following: Clients Version is the most current version of Mobility for Windows 7 and Windows XP. Version 10.0 is the most current version of Mobility for Android and Windows 8 clients. Version 9.23 is the most current version of Mobility XE for Windows Vista. Version 9.21 is the most current version of Mobility XE for Windows CE and Windows Mobile. Server Window 8.1 and Windows Server 2012 R2 are not currently supported in v10 and v A later version of Mobility will support these platforms. Common Criteria Version 9.50 is the only version of Mobility XE to be Common Criteria-certified. For more information see For a current list of supported operating systems see: 22