Copyright 2013, 3CX Ltd.

Transcription

1 Manual

2 Copyright 2013, 3CX Ltd. Information in this document is subject to change without notice. Companies names and data used in examples herein are fictitious unless otherwise noted. No part of this document may be reproduced or transmitted in any form or by any means, electronic or mechanical, for any purpose, without the express written permission of 3CX Ltd. 3CX Mobile Device Manager is a copyright of 3CX Ltd. 3CX is a registered trademark, and 3CX Mobile Device Manager and the 3CX logo are trademarks of 3CX Ltd. in Europe, the United States and other countries. Version 7.1 Last updated 15 May 2014

3 Manual Index Section 1 - On Premise Edition Requirements and Installation 1. Introduction, Benefits & Editions Available 2. System Requirements. 3. Installing Mobile Device Manager On Premise Edition 4. Configuring Mobile Device Manager Section 2 - Accounts & BackOffice 5. Creating the MDM Accounts 6. Accessing BackOffice

4 Introduction and Installation What is 3CX Mobile Device Manager? 3CX Mobile Device Manager is a platform to manage, secure and track your mobile devices. Mobile devices connect to corporate applications and have access to or store confidential corporate data. As mobile devices are used by more and more staff, it is imperative that these devices are managed and controlled. Benefits Security 3CX MDM secures your mobile devices by: Enforcing a strong password policy. Being able to remote lock phones when they are being misused. Wiping corporate data off phones when they are lost or the employee leaves the company. Deleting corporate accounts and the associated attachments downloaded and stored on the phone. Deleting corporate Wi-Fi networks and associated credentials stored on the phone. Furthermore, 3CX Mobile Device Manager allows administrators to monitor for rogue / malware apps being installed on phones which could compromise corporate data. Also, with GPS and Wi-Fi tracking, you can retrieve a lost or stolen device. Manage & Wi-Fi Configuration Supporting users on configuring corporate & Wi-Fi Network access on their smartphones can be cumbersome and time consuming process. With 3CX Mobile Device Manager, administrators can quickly push their account details as well as Wi-Fi network names and passwords. This, saves the administrator time and increases security as its easier to change and manage these. Monitor Data Usage & Calls

5 3CX MDM also helps companies monitor data usage and call costs. If employees aren t fully using their bandwidth or if they are using too much, the company can change the data-plan accordingly. Likewise, detailed call logs show administrators whether employees are making too many unnecessary calls. App Deployment 3CX MDM helps companies manage the applications on the devices. By remotely installing apps, companies avoid the hassle of having to manually install them, which can take a lot of time, especially if employees need assistance. Applications that connect to confidential company databases that companies don t want to be made public, can be deployed without needing Google Play or Apple App Store, which can be a time intensive task to administer. Reports show which apps are installed on each device, allowing easy monitoring for malware or inappropriate apps that waste company time, bandwidth or open up a company to legal issues. The version of approved apps that employees have installed can also be seen in order to ensure apps are all up to date. Find & Track Devices Track the routes your staff take to ensure they are using the most efficient routes when visiting customers and send them pinpointed locations via Google Maps. In case a phone is lost or stolen, it can be located. Platform Independent 3CX MDM is platform independent. It works with Android smartphones and tablets, ios based devices such as iphones and ipads, Windows 7/8 devices and soon Windows 8 phones. Platform independence is crucial as few companies use just one type of device. Cost of Manually Managing Devices in Business Manually managing mobile devices is not an option. According to Gartner, companies spend on average $2, per year manually managing a single device. UK Internet Service Provider, Timico, conducted a survey which showed that 42.5% of companies in the UK spent up to 5 hours each day manually managing mobile devices. 14% of these companies spend one working day per week managing their devices. ComputerWorld stated that a recent study revealed that two out of three companies are struggling in terms of not only defining but enforcing IT and business policies around mobile devices. The study also showed that 28% of companies surveyed reported a data breach because of a mobile device. The conclusion is that mobile device management is the best way to centrally secure and manage mobile devices. Editions Available 3CX Mobile Device Manager is available as either a hosted or an on-premise edition. Hosted / Cloud 3CX Mobile Device Manager is available in a hosted edition which allows you to manage your devices in the cloud. You can either pay your subscription fee yearly or every six months based on the number of devices that you are managing. This includes support, maintenance and system upgrades.

6 The hosted / cloud edition offers: Scalability, support from 5 to 5000 devices. Fully redundant data centers. High availability (HA). Easy to deploy. No significant investment. All software maintenance is handled by 3CX. On Premise 3CX Mobile Device Manager can be deployed, managed and maintained completely on-premise as well. You can choose to use dedicated or virtualized hardware or install it together with other enterprise apps. You will retain full control of the data being collected. For more information see chapter 'Installing 3CX MDM On Premise' On Premise customers purchase a perpetual software server license, based on the number of devices being managed. The perpetual software license includes one year of software updates. After the first year, you can purchase maintenance which ensures you continue to get free updates for the software.

7 System Requirements Prerequisites 1. A machine running Windows Server 2008 R2 64-Bit or Windows Server Bit, with Microsoft.NET Framework 4.5 and Internet Information Services (IIS) installed. 2. Access to an SMTP server to use to send s (can be local or remote) 3. Microsoft SQL Server You are required to have a database instance installed either on the same machine running Mobile Device Manager or on a different machine within your network. The SA (System Administrator) account needs to be enabled. SQL Server Reporting Services is required to be enabled. If using the Express edition of SQL Server, advanced features are required. 4. A digital certificate valid for the hosting domain signed by a trusted Certificate Authority.A SSL signed certificate from a company which provides digital certificates. This certificate should also support wildcard functionality. 5. Google Cloud Messaging API - A Google account with Google Cloud Messaging API enabled is required. For more information on how to enable the GCM service and obtaining the API Key, please have a look at the following link: gcm/gs.html 6. SMS Gateway account with CardBoard Fish. - A HTTPS SMS account with CardBoard Fish is required for the messaging feature to work. More information can be found at the following link: 7. Make sure that the following firewall ports are open and in the case of the incoming, preferably port forwarded to the MDM server IP as they are vital for communication between your devices and your MDM server: Incoming Port TCP UDP Description 80 YES NO HTTP 443 YES NO HTTPS 587 YES NO SMTP 993 YES NO IMAP YES NO Bridge Handler (Web Browser Connection) Outgoing Port TCP UDP Description 2195 YES NO APNs 2196 YES NO APNs 443 YES NO APNs fallback Apple Devices Running ios: If you have any Apple devices you will also need to make sure that you have in addition to the above: 1. A Simple Certificate Enrollment Protocol (SCEP) - A separate server running the SCEP service is required to issue digital certificates to ios devices. This is vital if you want to manage ios devices via the MDM portal. The service should also be configured to run using single-password mode. More information can be found at the following link: social.technet.microsoft.com/wiki/contents/articles/9063.network-device-enrollment-servicendes-in-active-directory-certificate-services-ad-cs.aspx

8 2. An Apple Enterprise Account - An Apple Enterprise Account is required in order to obtain the necessary MDM Vendor Certificate provided by Apple in a.pem format. More information can be found at the following link: IMPORTANT NOTE: All Certificates should be located in a folder that grants full access at least to the IIS users group (IIS_IUSRS) and SYSTEM. It is also highly recommended that all certificates are saved under the C:\ directory.

9 Installing Mobile Device Manager On Premise Edition Introduction Before you can manage your devices using MDM you first have to install and configure the On Premise edition on your server machine. Before doing so, first check whether your machine complies with the minimum hardware specifications (see System Requirements). Once confirmed, download the Mobile Device Manager On Premise edition setup file from here: Setup and File Installation 1. Double click the Mobile Device Manager setup file to begin the installation. Confirm the machine which Mobile Device Manager is going to run on meets the system requirements and click Next to continue.

10 2. Subsequently, review the End-User License Agreement, and click next to continue. Note that you must accept the terms in order to continue the installation. 3. You will then be prompted to define the path where the installation folder will be created. Alternatively, click on the browse button to change the directory if needed.

11 4. Click Install to confirm the previous steps and start the installation process. 5. Once setup starts the file installation process, you shall be prompted to install Microsoft SQL Server System CLR Types. Click on the Next button to proceed. Note that you must accept the terms in order to continue the installation.

12 6. Further define the machine administrator and company name, click Next and subsequently Install to confirm and start the installation process. The installation process shall complete and the Mobile Device Manager On Premise edition installed on your server machine.

13 Configuring Mobile Device Manager Introduction After the file installation is completed, the MDM Install Wizard will start up and guide you through the necessary stages needed to configure your newly installed MDM On Premise edition service. There are a total of 7 settings to be configured. Certificate Configuration 1. In this part of the installation and configuration wizard fill in the following fields: Server Address: Enter your MDM server FQDN here (Example - mdm.company.com). If you already have a PFX certificate available, proceed to configure the below: Certificate (PFX Format): Define the path where the PFX file is stored. Certificate password: Enter the certificate password.

14 If you require to generate a PFX certificate from scratch, enable the I do not have a PFX Certificate checkbox and further configure: Certificate: Select your SSL certificate obtained by a Certificate Authority (CA) company. The file should end with a.pem extension*. Root Certificate: Select the Root Certificate file obtained by a Certificate Authority (CA) company. The file should end with a.cer extension. Private Key:Select the Private Key you were provided with by your Certificate Authority (CA) company. The file should end with a.pem extension. Private Key Password: Insert the password used during the generation of your Private Key. Export Password: The password to be used for the new PFX file * Signed digital certificate must support wildcards. Database Configuration

15 2. In the Database Settings dialog window, fill in the following: Location: Specify the IP address of the machine hosting your SQL database. If the database is located on the same machine you are installing Mobile Device Manager, you can also use localhost. Password: Fill in the password of your SA database account. Note: Click Test Connection to confirm the MDM server is able to connect to the configured database.

16 3. During this process the installer will start performing the following operations: Generate the PFX certificate. Create the database users. Configuration

17 4. Next, you shall be requested to fill in the Settings to be used by MDM. SMTP Server: Fill in the SMTP server to be used. Port: Fill in the port number to be used for sending out s. Fill in the address that you want to be shown when s are sent out. Username: Fill in the username to be used if the mail server requires authentication. Password: Password for the username provided if the mail server requires authentication. Use SSL: Tick this box if your SMTP server requires an SSL connection. SMS Settings Configuration 5. In the next page you are requested to fill in the SMS Settings provided to you by CardBoard Fish. CardBoardFish is an online service that provides, high quality, reliable, and low cost SMS delivery services. This step is necessary in order to be able to send out SMS s for features such as the Lock & Wipe function: Username: Fill in the username obtained from CardBoard Fish. Password: Fill in the password for your CardBoard Fish account. ios Settings Configuration

18 6. Next, you will be asked to fill in the ios settings obtained from your SCEP server in order for ios devices to be able to connect and communicate with your MDM server: SCEP Server URL: The URL pointing to your certificate SCEP server. Challenge Password: Input the challenge password generated by your certificate SCEP server. MDM Vendor Certificate Path: Select the path to the certificate provided to you by Apple. MDM Vendor Private Key Path: Select the path to the private key previously generated to obtain the certificate by Apple. MDM Vendor Private Key Password: Insert the password of your Private Key. MDM Vendor Export Password: Define the password for the Apple certificate which will be generated. * Signed digital certificate must support wildcards Google Messaging Settings

19 7. In the next dialog window you are asked to fill in the GCM settings obtained from your Google Cloud Messaging project. This is used to send PUSH notifications to Android devices. GCM API Key: Insert the API Key obtained by the Google Cloud Messaging project. GCM Project Id: Insert the project ID obtained by the Google Cloud Messaging project. BackOffice Account Configuration

20 8. After that, you will be asked to fill out the details for the admin account to access the Mobile Device Manager BackOffice. Name, Surname: Insert the administrator s name and surname. Insert the administrator s address. Username: The username that will be used by the admin to log into BackOffice. Password: The password that will be used by the administrator to log into BackOffice. Confirm Password: Re-insert the password to be used by the admin to log into Back Office.

21 9. During this process the Install Wizard will finalize the initial setup and perform a few modifications to the IIS web server on your machine before prompting you with a Completed Successfully message.

22 10.Finalise the installation by clicking finish and optionally select to launch Mobile Device Manager upon completion.

23 Creating the MDM Accounts Introduction After completing the file and the server configuration you will need to create an account on which your devices will be registered on. Setting Up Your Account 1. You may now set up your Mobile Device Manager account: 1. Go to MDM Domain>/signup 2. Specify an account name. You will use this account name to enroll mobile devices and to log in to your On Premise MDM portal. 3. Specify your name and Specify and confirm a password (to login to the account). 5. Read and accept the Terms of Service document (required to proceed). 6. Enter the CAPTCHA and click Sign up. 7. Activate your account by clicking on the link included in the welcome sent to you. 8. You can now logon to the portal by specifying your account name, and password at: MDM Domain>/Admin/Login/LogOnActivate 2. You are now able to access the Mobile Device Manager administration pages through the following URL s: MDM Domain>/signup - Used to create accounts in order to further assign and manage your devices. MDM Domain> - Used to log into your account, assign devices and further manage them. MDM Domain>/backoffice - Used to log into the backend of the system and manage the accounts and change system configuration settings.

24 Accessing BackOffice Accessing and Configuring Your BackOffice 1. To access the BackOffice of your MDM system, you need to access: MDM Domain>/backoffice 2. Fill in the Username and Password provided previously in step 8 of chapter 17 (Configuring 3CX Mobile Device Manager) to access your BackOffice. 3. From the BackOffice you can perform the following actions: Account - You can view, disable, enable, delete or administer existing accounts created through the MDM Domain>/signup Administration - You can view, add and delete users and groups which can access this Mobile Device Manager BackOffice Portal. Additionally, Dashboard displays the total number of activate accounts, inactive accounts, devices currently connected and devices currently registered on the system.