PULSE ONE ADMINISTRATION GUIDE

Transcription

1 PULSE ONE ADMINISTRATION GUIDE 2015 by Pulse Secure, LLC. All rights reserved

2 Table of Contents Introduction... 4 Centralized Control and Visibility of Pulse One... 5 Pulse One Administration... 7 Getting Started... 8 User Administration Provisioning Devices Auto-provisioning Auto-provisioning of Workspace (LDAP Group Policy) ios Device Registration Android Device Registration Workspace User and Device Management...38 Add a New User Delete a User Account Add a Policy Tag to a Workspace User Account Workspace Actions Understanding the Workspace Details Window Appliance ActiveSync Configuration Policy Management Creating a New Policy Policy Properties System Management Changing Pulse One Properties Changing Workspace Properties Viewing Licenses Activity Log Viewing, Adding and Removing Apps... 71

3 Changing the Builtin Apps LDAP Configuration Adding an ios MDM Certificate VPN Certificate Changing the Enterprise Usage Agreement Appliance Management Appliance Registration Appliance Configuration CPU, Memory and Disk Utilization Activities Log Configuration Change History Reboot Appliance Remove Appliance Dashboards Overall Dashboard

4 Introduction Page 4

5 Centralized Control and Visibility of Pulse One Pulse One provides unified management of Pulse Connect Secure, Pulse Policy Secure and Pulse Workspace in a single easy-to-use console. Pulse One Unified Management It controls enterprise access to datacenter and cloud from a single console. Role-based access - Grants console access and privileges based on IT role and credentials Group-based management - Publish software updates, policy changes and configuration provisioning by customdefined groups Centralized administration - Collectively administers multiple appliances without logging into them on a box-by-box basis Built-in Mobility Management - Provides basic EMM functionality for ios and Android devices and management of BYOD Workspaces System Dashboard - Assesses the collective health of all appliances and provides security alerts and appliance alarms Appliance Dashboard - Provides appliance status with analytics for connectivity, capacity, utilization, and uptime Administrator Audit Logging - Tracks administrator changes to appliance configuration Monitor and Reporting - Monitors system activity and provides historical reporting SaaS Deployment - Introduces new features and scales without datacenter logistics and planning Back Office Integration - Uses APIs and connectors for easy integration with Microsoft Active Directory and other systems Page 5

6 Page 6

7 Pulse One Administration Page 7

8 Getting Started This article will walk you through the steps to log in to Pulse One administration. Pulse One Login Page Enter the user name and password. Click Sign In to log in to Pulse One product. The End User License Agreement (EULA) page appears. Page 8

9 End User License Agreement Use the scroll bar to read through the terms of the agreement and then click Agree. The Pulse One home page appears. Page 9

10 Pulse One Home Page Select the appropriate menu and get started with the administration. Change Password Click the user icon on the top-right corner of the page. From the menu displayed, click Change Password to change your login password. To log out of the application, click Logout. Page 10

11 User Administration Pulse One offers comprehensive Admin account management. This article will walk you through the steps to create an Admin user. Admin Users Click the Administration tab. A list of existing admin users is displayed. Click Add User to add an admin user. Click Edit icon in the user details pane to modify the user details. Click Delete User to remove an admin user. Page 11

12 Adding Admin User In the Add Admin User window, enter the user details. Select Workspace check box to provide the link to user's workspace. Select Send Workspace welcome check box to send an confirmation to the user about the creation of Workspace. Click Create. The new user will be displayed in the User's list. Modify User Details To modify a user's details, select the user from the list and in the user details pane click the Edit icon. Make the required changes and click Update. Page 12

13 Removing Admin User Select the user from the list, and click Delete User. In the Remove Admin User confirmation message box, click OK to remove the selected user as an administrator. The user is removed as an administrator, but will still be a Pulse Workspace user. In order to remove the user even from Pulse Workspace, select the Remove entire user record check box and click OK. Page 13

14 Provisioning Devices Page 14

15 Auto-provisioning This article will walk you through the steps to auto-provision user and the Pulse Workspace on Android and ios devices. Before proceeding with the below steps, ensure the enterprise domain and domain are created for your enterprise. Note: Obtain Provisioning portal URL from your enterprise administrator. Launch the Provisioning portal Launch the Provisioning portal. Enter your address and click Submit. On successful verification, you will receive an from the Pulse Workspace system containing the instructions for the registration process. Page 15

16 Registration link and PIN code For Android phone, enable Settings -> Security -> Unknown Sources. Enter the URL mentioned in the mail in a web browser on your mobile device. Page 16

17 Register to Pulse Workspace In the Pulse Workspace registration screen, enter your address and registration key, and then press Register. This will install Pulse Workspace on your device. By default, your Workspace is provisioned with default policy. Page 17

18 Auto-provisioning of Workspace (LDAP Group Policy) This article describes the auto-provisioning of Workspace using LDAP Group Policy. Before proceeding with the below steps, ensure the enterprise domain and domain are created for your enterprise. Enterprise administrator must create Workspace policies, add group names and then assign group names to polices. The VPN appliance validates these group names to make sure that they are real groups. Note: Obtain Provisioning portal URL from your enterprise administrator. Launch the Provisioning portal Launch the Provisioning portal. Enter your address and click Submit. Pulse One validates the group for the user by querying Pulse Connect Secure VPN gateway and assigns appropriate policy to user workspace. On successful verification, you will receive an from the Pulse Workspace system containing the instructions for the registration process. Page 18

19 Registration link and PIN code For Android phone, enable Settings -> Security -> Unknown Sources. Enter the URL mentioned in the mail in a web browser on your mobile device. Page 19

20 Register to Pulse Workspace In the Pulse Workspace registration screen, enter your address and registration key, and then press Register. This will install Pulse Workspace on your device. By default, your Workspace is provisioned with default policy. Page 20

21 ios Device Registration This article will walk you through the steps to provision an ios Workspace. Welcome When the Workspace administrator invites you to provision your mobile device, you will receive a welcome which contains instructions for provisioning your device, a link to the provisioning portal, your provisioning address and a one time registration key. Page 21

22 Provisioning portal Start the provisioning process by opening the browser on your mobile device and entering the URL for the provisioning portal. Then click the START button to start the provisioning process. Page 22

23 Workspace certificate You will be prompted to install the Workspace Server certificate. Click Install, then Install, and then Done. Register device Enter your address and registration key from the Welcome and then click the ENTER button. Click the AGREE button to accept the Enterprise usage agreement. Click the INSTALL button to begin Workspace installation. Page 23

24 Install Workspace You will be prompted to install the Workspace Configuration Profile. Click Install, then Install, and then Install. Page 24

25 Finish provisioning Once the Workspace configuration profile is installed, you may be prompted to perform a variety of actions including installing applications, setting a device passcode or entering your password. These actions will depend on your enterprise security policy. Page 25

26 Android Device Registration This article will walk you through the steps to provision an Android Workspace. Welcome When the Workspace administrator invites you to provision your mobile device, you will receive a Welcome which contains instructions for provisioning your device, a link to the provisioning portal, your provisioning address and a one time registration key. Page 26

27 Install Pulse Workspace App Start the provisioning process by opening the browser on your mobile device and entering the URL for the provisioning portal. This will bring you to the Workspace app on the Google Play Store. Click INSTALL and then ACCEPT the App permissions. Once the app is installed, click OPEN. Page 27

28 Register device Enter your address and registration key received in the Welcome , and then click Register. Page 28

29 Accept Enterprise Usage Agreement Select the I accept this agreement check box and click Accept to agree the Enterprise usage agreement. Page 29

30 Set Workspace Passcode Enter your Workspace passcode and click Set Passcode. Click Passcode Rules if you would like to know the minimum passcode complexity requirements. Page 30

31 Review Provisioning steps Review the steps needed to provision the Workspace and click Continue when you are ready to proceed. Page 31

32 Install Apps from Google Play If apps from Google Play are part of your policy, you will be prompted to install the apps. Click Start installation. This will bring you to the app on Google Play. Click INSTALL and when the apps permissions page is displayed, click ACCEPT. Once the app is installed, you will be returned to the App installation screen to proceed. Page 32

33 Install Workspace Apps Install the Pulse Workspace VM and Secure Shortcuts by clicking Install, then Next, and then Install on the App installation page. After each app is installed, the Workspace will bring you to the next app. Page 33

34 Workspace provisioning is complete Click Continue to start using the Workspace. Page 34

35 Log in to Workspace To log in to the Workspace, enter the password you created during the provisioning process. Page 35

36 Optional: Configure Workspace Apps If your administrator has configured Workspace apps, you can complete the configuration by clicking the Green arrow to the right of the app name. Page 36

37 Optional: Create shortcuts You can add shortcuts to the applications in the Workspace on your Devices home screen. This allows you to access the application in a single click without first having to open the Pulse Workspace Client. To create a shortcut, press and hold the app you would like to make a shortcut for and drag it up to the Create shortcut button. Page 37

38 Workspace User and Device Management Page 38

39 Add a New User Pulse One users with a Workspace license entitlement will be able to manage Workspace from the Mobile Workspaces tab. This article will walk you through the steps to add a new user to your domain. Open Workspace Management Click the Mobile Workspaces tab and select Workspace Management. Open New User dialog box From the Actions drop-down list, click Add. Page 39

40 Enter user information Enter the user information into the Create New User dialog box and then click Create. If you want to create another user, select the Create another check box and then click Create. Required fields Username - User's name (This must be unique and can be used to configure the client inside the workspace during the provisioning process) Full Name - User's full name Workspace - account to which workspace notifications are sent (This account can also be used to configure the client inside the workspace during the provisioning process) Provision - account to which the welcome is sent Optional fields Phone Number - Phone number to which the welcome SMS is sent Tags - Tags assigned to this user (used for policy assignment) Device Match - String used to limit the device a user can provision (for example, entering "Apple" would limit the user to provisioning Apple devices). Carrier, IMEI, IMSI, manufacturer, model_number, os_version, phone_number or serial_number can be used in the Device Match field. Options Create Space for this user Send the welcome to this user Send the welcome SMS to this user Page 40

41 Delete a User Account This article will walk you through the steps to delete a user from your domain. Select the user Click the Mobile Workspaces tab, and select Workspace Management. Select the user you want to delete. In this example we are deleting the user Rick Darling. The user details are displayed on the right pane. Note: You can optionally search for the user using the search box. Page 41

42 Delete user account Once you have selected the user account, from the Actions list click Delete. In the Confirm dialog box, click Yes to confirm the user deletion. Page 42

43 Add a Policy Tag to a Workspace User Account Tags are used to apply policies to users accounts. Once a policy is tagged, just add the same tag to the user to apply the policy to that user's device. This article will walk you through the steps to apply a policy tag to a Workspace User Space. Select the user Click the Mobile Workspaces tab and select Workspace Management. Select the user you would like to manage. In this example we are adding the tag to Rick Darling. You can optionally search for the user using the search box. Page 43

44 Add the tag Click the Tag text box located at the corner of the user details pane. Select the tags From the policy tags drop-down list, select the tag and click Save. Page 44

45 Workspace Actions This article will walk you through the steps to perform administrative actions on a workspace. Select the user Click the Mobile Workspaces tab and select Workspace Management. Select the user and then the Workspace you want to manage. In this example we are managing Rick Darling's Workspace. You can optionally search for the user using the search box. Page 45

46 Open Actions menu and select the action Select Actions from the Workspace pane. Then select the action you want to perform. Push Space - sends the latest policy to the users device and forces a check-in Resend Invitation - resends the Workspace Welcome or SMS with a new registration token Note: This action is only available before the Workspace has been provisioned. Reset Passcode - resets the Workspace passcode Clear Errors - clears secure shortcut errors from Android devices Lock Workspace - locks this device Note: Locking an Android Workspace will prevent the user from using the Workspace until an administrator resets the users passcode. Wipe Workspace - wipes all data in this Workspace Delete Workspace - deletes the Workspace record from the Management server Note: When a Workspace is deleted, no further administrative actions can be performed on the Workspace, including wiping the Workspace. Page 46

47 Understanding the Workspace Details Window Workspace pane The Workspace Pane allows you to view the overall status of the Workspace. 1. Device Manufacturer/Model - used to identify the Workspace 2. Workspace State - the current status of the Workspace 3. Workspace Apps - the apps installed in the Workspace 4. Space Details - the Workspace client details 5. Device Details - information gathered from the device Page 47

48 Workspace compliance The Compliance window displays the current status of device properties and if they are compliant with the Workspace security policy. Policy Expired - Policy is expired Device allows USB debugging - USB debugging is enabled Device allows root access - root access is enabled Device allows unknown market install - Side loading apps is enabled Note: This must be enabled for devices that do not support silent installation Device allows process debugging - Process debugging is enabled Device is using encryption - Device is encrypted Page 48

49 Edit The Edit window allows you to view and edit the Workspace Device Match and Phone Number fields. Device Match - string used to limit the device a user can provision (for example, entering "Apple" would limit the user to provisioning Apple devices). Carrier, IMEI, IMSI, manufacturer, model_number, os_version, phone_number or serial_number can be used in the Device Match field. Phone Number - phone number to which the welcome SMS is sent Activities The Activities window displays the log of Workspace activity. Double click an activity to see the detailed view. Page 49

50 Policy History The Policy History window displays the current and previous policies applied to a Workspace. Actions The Actions menu displays the list of actions available for the Workspace. Page 50

51 Appliance ActiveSync Configuration This feature introduces the ability on Pulse Connect Secure gateway to function as activesync proxy for Mobile devices that are Onboarded through Pulse Workspace Server. Pulse Connect Secure gateway will be able to filter out and reject activesync connection requests coming from unauthorized mobile devices and allow only those devices that have been successfully provisioned on Pulse Workspace Server. Workspace settings Click the Settings tab and select Workspace Settings. Then click the Workspace Properties link. Page 51

52 ActiveSync property Field Activesync Provider must be set to the Connect Secure device. Click the Edit icon to modify the ActiveSync property of the policy. Page 52

53 Policy Management Page 53

54 Creating a New Policy This article will walk you through the steps to create a new policy. Open the Add Policy dialog box Select the Policies tab. Click Add from the Manage Policies frame. Page 54

55 Set Policy attributes Set a Policy Name. This is a label for you to identify the policy. Set the policies target criteria and LDAP Group. Click Save. Note: Policy name is not unique, means two or more policies can have same name. Policies are unique based on their search criteria, and not based on the policy names. Page 55

56 Add Apps and Properties When a policy is created it starts in the edited state. You can now add applications and properties to the policy before applying the policy to your mobile devices. Publish the policy Once you have completed editing the policy, click Publish. You will see the policies state change to publishing and then published. This will apply the policy to the mobile devices. Page 56

57 Policy Properties This article describes the Policy Properties available in the Workspace Properties Policy Properties ActiveSync Device ActiveSync Accept All Certs - If this is set to true, the Workspace client will accept an untrusted server certificate. Activesync Domain - The domain set for the Workspace ActiveSync connection. The ActiveSync domain must be the enterprise domain which should be the same as the exchange server domain. ActiveSync Server - This should be set to ActiveSync Server Proxy address of the Pulse Connect Secure (PCS) if proxy uses PCS. ActiveSync Server Proxy - This must be set to Security Appliance if PCS is used. Otherwise, it should be set to None. ActiveSync SSL - Determines if the Workspace client will connect to the ActiveSync server using an SSL connection. ActiveSync UserID Field - This must be set to Username if ActiveSync Server Proxy uses PCS. Otherwise, it should be set to . Allow Policy Profile Removal - If this is set to true, the user will be able to remove the policy profile. Device Encryption - If this is set to true, the user will be required to encrypt the device. Enable Bug Report - If this is set to true, the user will be able to send bug reports. Jail Break Detection - Determines the action the client should take when it determines a device is Jailbroken. The options are allow, notify, lock or wipe. Rooted Detection - Determines the action the client should take when it determines a device is Rooted. The options are allow, notify, lock or wipe. USB Debugging - Determines the action the client should take when it determines a USB debugging has been enabled. The options are allow, notify, block, lock or wipe. Page 57

58 ios ActiveSync ios ActiveSync Enabled - If enabled, the Workspace ActiveSync account will be configured on ios devices. ios ActiveSync Name - A user-visible name of the account, shown in the Mail and Settings applications. ios ActiveSync Prevent Move - If enabled, messages may not be moved out of this account into another account. ios ActiveSync Prevent Send By 3rd Party apps - If enabled, the Workspace account is not available for sending mail in third-party applications. ios Managed Domains ios Managed Domains - The domain set for the Workspace ActiveSync connection. The ActiveSync domain must be the enterprise domain which should be same as the exchange server domain. ios Managed Web Domains - ios POP/IMAP ios Description - A user-visible description of the account, shown in the Mail and Settings applications. ios Disable Mail Recents Syncing - If enabled, the Workspace account is excluded from address Recents syncing. ios Enabled - If enabled, an IMAP or POP account will be configured on ios devices. ios Incoming Auth - Designates the authentication scheme for incoming mail. ios Incoming Host - Designates the incoming mail server host name (or IP address). ios Incoming Port - Designates the incoming mail server port number. If no port number is specified, the default port for a given protocol is used. ios Incoming Use SSL - Designates whether the incoming mail server uses SSL for authentication. ios Outgoing Auth - Designates the authentication scheme for outgoing mail. ios Outgoing Host - Designates the outgoing mail server host name (or IP address). ios Outgoing Port - Designates the outgoing mail server port number. ios Outgoing Use SSL - Designates whether the outgoing mail server uses SSL for authentication. ios Prevent Move - If enabled, messages may not be moved out of this account into another account. ios Prevent Send By 3rd Party Apps - If enabled, the Workspace account is not available for sending mail in third-party applications. ios Type - Determines the type of account to set up. It can be IMAP or POP. ios Username - The Username set in the configuration. It is set to either the users username or their corporate address. ios Restrictions ios Allow App Installation - Disables user app installation when unchecked. ios Allow Camera - Disables the camera when unchecked. ios Allow Cloud Backup - Disables icloud backup when unchecked. ios Allow Cloud Document Sync - Disables icloud document sync when unchecked. ios Allow Cloud Keychain Sync - Disables icloud keychain sync when unchecked. ios Allow Enterprise Book Backup - ios Allow Handoff - ios Allow Managed App Cloud Sync - ios Allow Open From Managed To Unmanaged - If disabled, documents in managed apps and accounts only open in other managed apps and accounts. ios Allow Open From Unmanaged To Managed - If disabled, documents in unmanaged apps and accounts will only open in other unmanaged apps and accounts. ios Allow Screen Shot - Disables device Screen Shots when unchecked. Page 58

59 Mail Passcode Space ios Allow Siri - Disables Siri when unchecked. ios Allow Siri While Locked - Disables Siri while the device is locked when unchecked. ios Allow Spotlight Internet Results - Mailplus Allow Open In Mailplus Allow Print Mailplus Auto Config Enabled Mailplus Disable Copy Paste Mailplus License Key Mailplus Passcode Allow Simple Mailplus Passcode Alpha Numeric Required Mailplus Passcode Enabled Mailplus Passcode Length Mailplus Passcode Require Special Mailplus Passcode Time Out Auto Enter - If enabled, the Workspace will automatically log the user in when they have entered their passcode. Expiration Days - Specifies the number of days for which the passcode can remain unchanged. ios Allow Simple - Determines whether a simple passcode is allowed. A simple passcode is defined as containing repeated characters, or increasing/decreasing characters (such as 123 or CBA). ios Force Pin - Determines whether the user is forced to set a PIN. Simply setting this value (and not others) forces the user to enter a passcode. ios Max Grace Period - The maximum grace period, in minutes, to unlock the phone without entering a passcode. ios Max Inacitivity - Specifies the number of minutes for which the device can be idle (without being unlocked by the user) before it gets locked by the system. Lock Timeout - Defines the time in minutes where the Workspace will be locked if no Workspace app was in foreground. Max Tries - Specifies the number of allowed failed attempts to enter the passcode at the device's lock screen. Max Tries Action - Determines what to do when the user has reached the maximum password tries. The options are notify, delay, lock and wipe. Numeric Only - Determines whether the user is forced to set a PIN. Passcode History - When the user changes the passcode, it has to be unique within the last specified entries in the history. Passcode Length - Specifies the minimum overall length of the passcode. Require Lowercase - Requires the user to have at least one lowercase letter in their passcode. Require Number - Requires the user to have at least one number in their passcode. Require Special - Requires the user to have at least one special character in their passcode. Require Uppercase - Requires the user to have at least one uppercase letter in their passcode. Allow Art - If enabled, Android devices that run ART can be provisioned. Android Auto Config Enabled - If enabled, the Workspace ActiveSync account will be configured on Android devices. Android Manual Config Allowed - If enabled, the user can change the ActiveSync account settings in the Workspace. Crash Count - The number of times an app in the Workspace can crash in the Crash Period before the application is disabled. Page 59

60 Crash Grace Time Sec - The number of seconds the Workspace will wait before allowing the app to start after killing it. Crash Period Sec - The timeframe for watching repeated app crash. Error Reporting Level - The detail of the logging information sent to the server when the user sends a debug log. Heartbeat Time Sec - The number of seconds between connection heartbeats. Policy Expiration days - Sets the number of days until a Workspace is considered to be out of compliance because it has not checked in with the server. Touchdown Note: Touchdown is not used anymore. Before, it was used for configuring a third party app. VPN WiFi Touchdown Allow Any Server Cert Touchdown Auto Config Enabled Touchdown Device Type Touchdown Disable Copy Contacts Touchdown Disable Copy Paste Touchdown Signature Touchdown External App Open Touchdown Inactivity Timeout Touchdown License Key Touchdown Passcode Alpha Numeric Required Touchdown Passcode Enabled Touchdown Passcode Expiration Days Touchdown Passcode History Touchdown Passcode Length Min Touchdown Passcode Max Tries Touchdown Passcode Require Special Touchdown Set Device Id VPN Certificate Auth - If selected, the VPN connection will be set to certificate authentication using the Workspace client certificate. VPN Connection Name - A user-visible description of the VPN account. Use L3 VPN - If selected, enables L3 VPN UDP support on ios platform. VPN Enabled - If selected, a VPN configuration will be sent down to the Workspace. VPN Group - Extends IPsec architecture to support PCS that are shared by a group of security appliances. VPN Host - Designates the VPN server host name (or IP address). VPN Realm - Designates the Realm the Workspace users will use. VPN Role - Designates the Role the Workspace users will use. VPN Save Password - If selected, the Workspace will cache the password used to connect to the VPN server. VPN Numeric Password - If selected, the Workspace will present the user with a pim pad rather than a keyboard to enter their password. VPN Safari Domains - VPN Type - Determines the VPN server being used. VPN UserID Field - The Username set in the VPN configuration. It is set to either the users username or their corporate address. VPN Verify Certificate - If enabled, the VPN client will accept an untrusted certificate. WiFi Enabled - If enabled, a WiFi configuration will be sent down to the mobile devices. WiFi Password - Password for WiFi network. Page 60

61 WiFi Protocol - Protocol used to connect to the WiFi Network. The options are WEP or WPA2. WiFi SSID - SSID of the Wi-Fi network to be used. Page 61

62 System Management Page 62

63 Changing Pulse One Properties Navigate to Pulse One Properties Click the Settings tab and select Pulse One Settings. Click Pulse One Properties to open the Pulse One Properties page. Edit Property Click the Edit button corresponding to the field you want to edit. Change the value and then click Save. Page 63

64 Properties Enterprise Connections Password Misc API Host - address of the host providing API service. Enable Single Sign On with SAML - select Yes to enable single sign-on. Console Password Expiration Days - how many days until an Administrator must change their console password Console Password Length - minimum length of a console password Console Password Require Lowercase - console password must contain at least one lowercase letter Console Password Require Number - console password must contain at least one number Console Password Require Special - console password must contain at least one special character Console Password Require Uppercase - console password must contain at least one uppercase letter Console Password Reset Timeout Hours - number of hours a console password reset link is valid Domain Allowed Password Attempts - number of login attempts until a console account is locked Welcome Timeout Hours - number of hours a registration token in a welcome is valid Created On - date the management console was created Locale - Console language code Server Version - current Management Server version NOTE: The Created On and Server Version fields are not editable. Page 64

65 Changing Workspace Properties Navigate to Workspace Properties Click the Settings tab and select Workspace Settings. Click Workspace Properties to open the Workspace Properties page. Edit Property Click the Edit button corresponding to the field you want to edit. Change the value and then click Save. Page 65

66 Properties Enterprise Connections Misc Activesync Host - address of the Workspace that ActiveSync Proxy will forward ActiveSync connections to; This address must be accessible to the Workspace ActiveSync Proxy. Activesync Provider - Pulse Connect secure appliance to which Pulse One /Workspace will forward the activesync notifications. LDAP Provider - PCS appliance configured for User's group membership based auto-provisioning. Current Client Version - link to the currently deployed Android client; If the client is deployed from the server this will contain the APK name. Current Sandbox Version - link to the currently deployed Android VM; If the VM is deployed from the server this will contain the APK name. ios Vpp Stoken - Apple VPP Service Token Minimum Client Version - Minimum Android client version used with this server; If a Workspaces client is lower than this version, the user will be asked to update their client. Minimum Sandbox version - Minimum Android VM version used with this server; If a Workspaces VM is lower than this version, the user will be asked to update their VM. Samsung MDM Version - The version of Samsung MDM NOTE: The Current Client Version, Current Sandbox Version, Minimum Client Version, Minimum Sandbox version and Samsung MDM Version fields are not editable. Page 66

67 Viewing Licenses The Licenses screen displays the asset and corresponding number of licenses available, number of licenses in use, and the license expiration date. License details Click the Settings tab, and select Pulse One Settings. Click Licenses. The Licenses page displays the asset ID, number of licenses available and used, and license expiration date. Page 67

68 Activity Log The Activity Log displays information about the events registered in the Management Server. These include Pulse One and Workspace activities. You can view filtered Activities for Users, Workspaces or Policies. Navigate to Pulse One Activities Click the Settings tab and select Pulse One Settings. Click Activities to go to the Activities page. Page 68

69 Navigate to Workspace Activities Click the Settings tab and select Workspace Settings. Click Activities to go to the Activities page. Search for an Activity Type a search term into the Search box and press Enter to search for individual events. Examples of search terms for Workspace activities are usernames, event types and workspaceids. Page 69

70 Filter activities Click an Event type button to filter for a specific event type. Open Activity Details Click the Details button associated with the activity you want view the details. The Activity Details dialog displays the additional details. Page 70

71 Viewing, Adding and Removing Apps The Apps screen displays the apps that have been added to the management console. On this Screen you can see the App details, add a new app or remove an existing app. Navigate to Apps Click the Settings tab and select Workspace Settings. Click Apps to go to the Apple Apps management page. Click Columns and select the required fields you want to view in the Apps page. Page 71

72 Apps Screen 1. Search box - Allows the apps list to be filtered 2. Android, Apple or All - Allows the app list to be filtered to apps of a single platform 3. Add App - Allows adding apps from Google Play, Apple App Store or Manually 4. App - Displays information about each app in the system 5. Edit icon - Allows to edit the app setting Page 72

73 Edit an App To edit an existing app, click the Edit icon next to the app record in the apps list. After editing the app, click Update. Platform - The mobile OS that uses this app, either Android or ios Package - The unique identifier for the application Title - Displayed name for the application Creator - The name of the Company who created the application. Download URL - The location from which the Workspace downloads the application. Download URL should be blank for Apple App Store and Google Play Apps. Tags - The tags are used by the Management server to categorize app functions. Warning: Editing an app from the Apple App Store or Google Play may cause the app to stop functioning inside the Workspace. Warning: Changes made to an app take effect the next time a Workspace checks in. Page 73

74 Add an Android App From the Add App drop down list, select From Google Play. Copy and paste, or drag the app URL, and click the Add button. Open Google Play Click Google Play Store to open Google Play. Page 74

75 Copy the Apps URL Find the app in Google Play and copy the Apps URL from your browser's Address bar. Page 75

76 Add App Paste the app's URL into the URL field. Click the Retrieve button. Once you see the app details, click the Add button. Page 76

77 Add an ios App From the Add App drop down list, select From Apple App Store. Type the name of the application in the search box and press Enter. Select the App from the App list and click Add. Page 77

78 Add an Enterprise App From the Add App drop down list, select Manually. Type the app details in the Add App dialog box and click Add. Platform - The mobile OS that uses this app, either Android or ios Package Name - The unique identifier for the application Title - Displayed name for the application Creator - The name of the Company who created the application. Download URL - The location from which the Workspace downloads the application. Download URL should be blank for Apple App Store and Google Play Apps. Tags - tags are used by the Management Server to categorize app functions. Source - The source of the app. Page 78

79 Changing the Builtin Apps Builtin apps are used to add a device's native application to the Workspace. The Workspace client looks for a device's native Browser, Camera, Gallery and Office application. If a suitable application cannot be found, the Workspace will instead add the fallback application to the Workspace. You can use the Builtin Apps page to change the fallback apps used by the Workspace. This article will walk you through the steps to edit the fallback apps. Navigate to Builtin Apps Click the Settings tab and select Workspace Settings. Click Builtin Apps for Android to go to the Builtin Apps for Android page. Page 79

80 Open App Click the Edit icon next to the app, which you would like to edit, to open the Builtin App Mapping dialog box. Update App Start typing the name of the app you would like to use as the Fallback App in the Fallback App field. The app will appear in a list below the Fallback App field. If the desired app is not in the list below the Fallback App field, add the app in the Apps screen. Select the added app and click Update. Warning: This will update the Workspaces that have the fallback app installed the next time the devices checked in with the server. Page 80

81 LDAP Configuration Enterprises would like to assign policies based on the LDAP group. For example, staff in Sales needs access to specific set of Enterprise apps as against staff in Finance which needs a different set of.enterprise apps. You can configure LDAP groups and assign these groups to policies. These policies are then sent to Workspaces when users configure Workspaces on their mobile devices. If users are in multiple LDAP groups, then they get multiple policies. The order of policies applied to Workspaces depends on the order of polices configured on Workspace Server. Adding an LDAP Group Click the Settings tab and select Workspace Settings. Click LDAP Groups. The Manage LDAP Groups page displays a list of existing LDAP groups. Click Add Group to add a new LDAP group. You can add LDAP group based on Group Name (Domain) or Distinguished Name. Page 81

82 Provide LDAP Group details - using Group Name In the Add LDAP Group dialog, enter a label to the group, enter the domain name to which the group belongs, and provide a name to the group. Click Save to add the group. Provide LDAP Group details - using Distinguished Name In the Add LDAP Group dialog, enter a label to the group, select Distinguished Name, and enter the distinguished name. Click Save to add the group. When an LDAP Group is added, it is unverified. Pulse One (Pulse Workspace) checks validity of the group by sending message to designated (registered) VPN appliance. Once LDAP group is verified, it is ready to use. Note: Admin can assign only the verified LDAP Groups to policies. Page 82

83 Editing an LDAP Group In case the verification of LDAP Group fails, the group state will be shown as Invalid. You can edit the details and resubmit for verification. Click the More icon next to the Invalid state group, and select Edit Group from the options. In the Edit LDAP Group dialog, make the necessary changes and click Save. Click the More icon next to the Invalid state group, and select Verify Group to resubmit the group for verification. Note: You cannot edit an already verified group. Removing an LDAP Group To remove an LDAP Group, click the More icon next to the state of the group that you want to remove, and select Delete Group from the options. In the dialog displayed, click Yes to remove the group. Note: When the LDAP Group is deleted, it is removed from all the policies it is attached to. Page 83

84 Configuring the LDAP Provider Click the Settings tab and then select Workspace Settings. Click Workspace Properties to go to the Workspace Properties page. Click the Edit Properties icon corresponding to LDAP Provider. In the Edit Properties dialog that is displayed, select the LDAP Provider from the drop-down list and click Save. Page 84

85 LDAP Group in User Details Click the Mobile Workspaces tab and select Workspace Management. A list of Workspace users is displayed. Select a user. The User Details pane shows the LDAP Group to which the user is attached. Page 85

86 Adding an ios MDM Certificate This article will walk you through the steps to add an Apple MDM push certificate to your Workspace management console. An Apple MDM push certificate allows your Workspace management console to push policies, updates and actions to your managed ios devices. Note: An Apple MDM certificate is required to provision and manage ios devices. Open Apple MDM Cert page Click the Settings tab, and select Workspace Settings. Click Apple MDM Cert to go to the Apple MDM Cert management page. Page 86

87 Download signing request Click the Download the signing request cert (CSR file) link to download the MDM push certificate's CSR (Certificate Signing Request) file. Then save the file to your computer. Follow link to the Apple Push Certificates Portal Click the link to go to the Apple Push Certificates Portal web site. Page 87

88 Log in to the Apple Push Certificates Portal Sign in to the Apple Push Certificates Portal using your organizations Apple ID. Page 88

89 Create a new certificate Click Create a Certificate to create a new MDM push certificate. Page 89

90 Accept Terms of Use Review and accept the terms of use. Page 90

91 Upload Certificate Signing Request Click Browse and then select the CSR file downloaded from your MobileSpaces console. Click Upload. Page 91

92 Download signed certificate Click Download to download the MDM push certificate's PEM file. Save the file to your computer. Page 92

93 Upload signed certificate Return to the Apple MDM Cert page in your Workspace management console. Click Browse and select the PEM file you downloaded from the Apple Push Certificates Portal. Click Upload. Review certificate You can now review the MDM push certificate information in your Workspace management console. Page 93

94 Renew certificate Page 94

95 Renew Push Certificate Add notes, click Choose File to select the CSR file, and then click Upload to renew push certificate. Page 95

96 VPN Certificate The Workspace Management Server includes an integrated Certificate Authority (CA) and Online Certificate Status Protocol (OCSP) server. These can be used to issue certificates to workspaces for client certificate based VPN authentication. You can use the VPN Cert window to download your Workspace Root CA certificate. This will be used when configuring your VPN. Download VPN Root Certificate Click the Settings tab and select Pulse One Settings. Click VPN Cert to go to the VPN Certificate download page. Click the cert link to download the CA Certificate for this Management console. Page 96

97 Changing the Enterprise Usage Agreement The Enterprise Usage Agreement must be agreed when you provision the Workspace. This should be modified with your Enterprise Usage Agreement. This article will walk you through the steps to edit the Enterprise Usage Agreement. Navigate to Enterprise Usage Agreement Click the Settings tab and select Pulse One Settings. Click Enterprise Usage Agreement to go to the Enterprise Usage Agreement management page. Page 97

98 Edit Agreement Edit the text in the Enterprise Usage Agreement and then click Save. Page 98

99 Appliance Management Page 99

100 Appliance Registration The first step in start using Pulse One services is registration of appliance. The registration process involves: Configuration on appliance to be registered Provisioning/creating appliance record on Pulse One console If the domain/customer has licensing for Security Appliance integration, a Cloud Admin should be able to add a Security Appliance to the console with a name/label. The Cloud Admin should then be given a way to link a Security Appliance with the cloud API so that it can be configured by the cloud API. When a Unity Cloud Console server admin enables Pulse Connect Secure on the Console, it provides a registration code. This code would be used when Pulse Connect Secure initiates the registration request. Register new appliance Click Appliances tab. Click Add Appliance. In the Register New Appliance dialog box, enter the name of the appliance. Click Save to receive a registration code and URL. When registration process is complete, Pulse One console displays appliance status as Online on Appliance tab. Note: The registration code and URL need to be entered in the Pulse Connect Secure and Pulse Policy Secure devices for Cloud Management configuration. Page 100

101 Appliance Configuration This feature introduces the ability of Pulse Connect Secure gateway to function as an activesync proxy for Mobile devices that are Onboarded through Pulse Workspace Server. Pulse Connect Secure gateway will be able to filter out and reject activesync connection requests coming from unauthorized Mobile devices and allow only those devices that have been successfully provisioned on Pulse Workspace Server. Registration In the Connect Secure Device screen: 1. Select Administrators > Pulse One > Settings tab. 2. Enter the Registration URL. 3. Enter the Registration Code. 4. Click Save Changes. The Status information displays the Registration Status in Green color. Page 101

102 ActiveSync Handler configuration on Pulse Connect Secure In the Connect Secure Device screen: 1. Select Administrators > Pulse One > Command Handlers tab. The Pulse Workspace Handler screen appears. 2. Select a role where a secure is enabled. 3. Select authentication servers to use for group look up, and click Add. 4. Click Save Changes. Note: To delete the device records set by the Pulse Workspace Console Server, click Clear Active Sync Device Records. To create a user rule, refer Pulse Connect Secure Administration Guide. Page 102

103 CPU, Memory and Disk Utilization The Appliance tab displays all the added appliances. On selecting an appliance that is online, a detailed panel shows the health of the appliance. The panel shows the following status: CPU, memory and disk utilization Number of concurrent users connected Throughput of the appliance Number of authentication failures Click the Appliances tab. A list of appliances is displayed. Select the appliance with status "Connected" of which you want to see the CPU, memory and disk usage information. The panel on the right gives pictorial representation of the usage. Page 103

104 Activities Log The log details of the activities happening between Pulse One console and various appliances will help Administrator to troubleshoot and resolve any issues. The Activities panel in Appliances provides details such as appliance reboot, configuration upload, etc. Activities details Click the Appliances tab. A list of appliances is displayed. Select the appliance with status "Connected" of which you want to see the activities log. The panel on the right gives the activities details. Page 104

105 Configuration Change History The Configuration Changes panel in the Appliances tab provides the configuration change history for each appliance. View configuration changes Click the Appliances tab. A list of appliances is displayed. Select the appliance with status "Connected" of which you want to see the configuration changes on the appliance. The panel on the right gives the configuration changes history with timestamps of when the change occurred on the appliance. Page 105

106 Reboot Appliance Rebooting appliances will be necessary when services on appliance have to be restarted or any issues with the appliances have to be resolved. After the reboot, appliance will connect back to the network and Pulse One will indicate the appliance's Online status in the appliance dashboard. Reboot option Click the Appliances tab. From the list of appliances, select the appliance that you want to reboot and click Actions in the Appliance Health pane.. From the options menu displayed, click Reboot Appliance. Page 106

107 Reboot confirmation In the Reboot Appliance confirmation dialog displayed, ensure that you have selected the right appliance and then click Yes. Page 107

108 Remove Appliance To re-register an appliance, the appliance should be removed from Pulse One and then re-provisioned. Remove appliance Click the Appliances tab. A list of appliances is displayed. From the list of appliances, select the appliance that you want to remove and click Actions in the Appliance Health pane. From the options menu displayed, click Remove Appliance. Confirm the remove appliance In the confirmation window, click Yes to remove the selected appliance. Page 108

109 Dashboards Page 109

110 Overall Dashboard Dashboard gives the administrator a view of overall system health, appliance health information, and mobile Workspace details. Overall system health Click Dashboard and select the Overall System Health icon on the left navigation pane. Administrator can view the following information: Overall appliance statistics Pulse Connect Secure versions Pulse Policy Secure versions CPU utilization Non-compliant and Compliant device logins information in the past 24 hours, with hourly graph Critical appliance events with timestamp Page 110

111 Appliance health Click Dashboard and select the Appliance Health icon on the left navigation pane. When users report any issues, for example unable to connect or VPN connection is slow, the administrator can see if any particular appliance has any issue like high CPU utilization or disk utilization. Administrator can view the following information: Number of Pulse Connect Secure and Pulse Policy Secure appliances Maximum concurrent user licenses for PCS and PPS appliances Number of deployed clusters Licenses consumed for PCS and PPS appliances SSL/VPN appliance OS versions NAC appliance OS versions Page 111

112 Mobile Workspaces information Click Dashboard and select the Mobile Workspaces icon on the left navigation pane. Administrator can view the following information: Workspace statistics Workspace allocation Devices and carriers Workspace connectivity Coverage by policy Workspace registration Page 112