MaaS360 Cloud Extender

Transcription

1 MaaS360 Cloud Extender Installation Guide

2 Copyright 2013 Fiberlink Communications Corporation. All rights reserved. Information in this document is subject to change without notice. The software described in this document is furnished under a license agreement or nondisclosure agreement. The software may be used or copied only in accordance with the terms of those agreements. No part of this publication may be reproduced, stored in a retrieval system, or transmitted in any form or any means electronic or mechanical, including photocopying and recording for any purpose other than the purchaser s personal use without the written permission of Fiberlink Communications Corporation. All brands and their products are trademarks or registered trademarks of their respective holders and should be noted as such. Fiberlink Communications Corporation 1787 Sentry Parkway West Blue Bell, PA March 2013 Revision

3 Table of Contents Introduction...4 General Requirements...4 System Requirements for the Cloud Extender for Microsoft Exchange ActiveSync Module (MaaS360 for Mobile Devices)...5 System Requirements for the Cloud Extender for User Authentication and User Visibility Modules (MaaS360 for Mobile Devices)...5 System Requirements for the Cloud Extender for IBM Lotus Traveler Module (MaaS360 for Mobile Devices)...6 System Requirements for the Cloud Extender for BlackBerry Enterprise Server Module (MaaS360 for Mobile Devices)...7 What is the MaaS360 Cloud Extender for Certificate Services?...8 Installing and Configuring the Cloud Extender...10 Visibility Service...10 MaaS360 Cloud Extender Configuration Tool...13 Appendix A: Other Modules...25 Lotus Traveler Manager in the Cloud Extender Configuration Tool...25 BlackBerry Enterprise Server integration in the Cloud Extender Configuration Tool...26 Exchange 2010/2013 Integration in the Cloud Extender Configuration Tool...27 Office 365 Integration in the Cloud Extender Configuration Tool...29 BPOS-D Integration in the Cloud Extender Configuration Tool...30 Certificate Integration in the Cloud Extender Configuration Tool...32 Appendix B: Troubleshooting...34 Microsoft Exchange Activesync...34 IBM Lotus Traveler...34 BlackBerry Enterprise Server

4 Introduction The MaaS360 Cloud Extender can be downloaded from the customer area in the MaaS360 portal. The Cloud Extender is an executable, and once installed will automatically launch the MaaS360 Cloud Extender Configuration Tool. This tool can also be executed manually by an administrator after installation by using the shortcut All Programs/MaaS360/MaaS360 ActiveSync Configuration Utility. GENERAL REQUIREMENTS Before beginning the installation, make sure the following requirements are met: Item Meets Requirement Physical or Virtual Machine with Windows Server 2008 RC2, 2008, or 2003 as an installation target for the Cloud Extender software (see the Release Notes). You can also use Windows XP or Windows 7, but they are not recommended for use in a Production environment. Note: The Cloud Extender can be installed directly on the Exchange Server or Active Directory Server, but this is not recommended. Access to the following URLs from the Cloud Extender machine. (You should receive either the message or a blank page when the URL is referenced from a browser.) /16 4

5 SYSTEM REQUIREMENTS FOR THE CLOUD EXTENDER FOR MICROSOFT EXCHANGE ACTIVESYNC MODULE (MAAS360 FOR MOBILE DEVICES) The MaaS360 Cloud Extender is a small program that runs as a service on a Microsoft Windows machine in your network. The Cloud Extender creates an outbound connection over HTTPS to the MaaS360 portal that is used as a bidirectional communication facility and allows the MaaS360 portal to integrate with your Exchange Server. It performs the following functions: Uses Microsoft PowerShell commands to query the Exchange Server for vital information related to the ActiveSync enabled devices on the Exchange Server. Processes device and policy information and transmits it to the MaaS360 portal for reporting and management functions. Receives information from the MaaS360 portal including: o o o o ActiveSync policies Device visibility Device actions Policy assignments Uses Microsoft PowerShell commands to execute policy assignments and actions. The MaaS360 Cloud Extender requires that it be configured with an account with sufficient rights to run as a service and to access Exchange Servers. Item Meets Requirement Exchange Server 2007, 2010, or 2013; Office 365; BPOS-D Domain User and Exchange Organization Administrator (2007), Organization Management (2010/2013), Global Administrator (O365) Access Rights Local Admin access is required on the machine the Cloud Extender is installed on. Exchange 2007 only: Exchange Management Tools (The tools version must match the service pack version of the Exchange server itself). Windows PowerShell Version 2 or higher SYSTEM REQUIREMENTS FOR THE CLOUD EXTENDER FOR USER AUTHENTICATION AND USER VISIBILITY MODULES (MAAS360 FOR MOBILE DEVICES) MaaS360 Active Directory integration provides customers with the ability to leverage their existing corporate directory information as they manage devices. Administrators can choose to use Active Directory to authenticate enrollment requests and to place users into logical groupings to streamline the application of policies, actions and rules. 5

6 The MaaS360 Active Directory integration capability is an optional component that can be configured to provide the following: Device Authentication Access Group information The MaaS360 Cloud-Extender for Active Directory integrates with your Active Directory Server to provide the necessary interaction. Before beginning the installation, make sure the following requirements are met: Item Meets Requirement Domain User Access Rights Local Admin access is required on the machine the Cloud Extender is installed on. Windows PowerShell Version 2 or higher SYSTEM REQUIREMENTS FOR THE CLOUD EXTENDER FOR IBM LOTUS TRAVELER MODULE (MAAS360 FOR MOBILE DEVICES) The MaaS360 Cloud Extender is a small program that runs as a service on a Microsoft Windows machine in your network. The Cloud Extender creates an outbound connection over HTTPS to the MaaS360 portal that is used as a bidirectional communication facility and allows the MaaS360 portal to integrate with your Lotus Traveler Server. It performs the following functions: Processes device and policy information and transmits it to the MaaS360 portal for reporting and management functions. Receives information from the MaaS360 portal including: o o Device visibility Device actions The MaaS360 Cloud Extender requires that it be configured with an account with sufficient rights to run as a service and to access Traveler Servers. Before beginning the installation, make sure the following requirements are met: Item Meets Requirement Lotus Domino or greater Lotus Traveler or greater The Cloud Extender must be installed on a machine that has the Notes client installed. 6

7 Item Meets Requirement A Domino account and credentials with sufficient rights to perform Domino/Traveler Admin functions. You should have at least access level of Server Remote Admin, Manager w/ delete access to Traveler.nsf..NET 3.5 or higher SYSTEM REQUIREMENTS FOR THE CLOUD EXTENDER FOR BLACKBERRY ENTERPRISE SERVER MODULE (MAAS360 FOR MOBILE DEVICES) The MaaS360 Cloud Extender is a small program that runs as a service on a Microsoft Windows machine in your network. The Cloud Extender creates an outbound connection over HTTPS to the MaaS360 portal that is used as a bidirectional communication facility and allows the MaaS360 portal to integrate with your BlackBerry Enterprise Server. It performs the following functions: Processes device and policy information and transmits it to the MaaS360 portal for reporting and management functions. Receives information from the MaaS360 portal including: o o o o Device visibility Device actions Policy assignments Device Activation Uses BlackBerry Administration Service and APIs commands to execute policy assignments and actions Performs Device Activation using BES APIs The MaaS360 Cloud Extender requires that it be configured with a BlackBerry Administrator Account with sufficient rights to run as a service and to access run the Administrator APIs. Before beginning the installation, make sure the following requirements are met: Item Meets Requirement BlackBerry Enterprise Server version 5.0 and above 7

8 Item Meets Requirement BlackBerry Administrator Account with the following details: Supported Authentication Types o o Exchange: Active Directory, BlackBerry Administration Account (Local Account) Domino: BlackBerry Administration Account (Local Account) Administrator Account should have the following access rights: o Following pre-defined BES Roles can be used: Security Manager The service account under which the Cloud Extender will operate should have HTTPS access to the APIs. BlackBerry Administrator APIs installed on the server that hosts the BlackBerry Administrative Console (BES 5.0 SP1 and above preinstalls these automatically)..net 3.5 or higher. WHAT IS THE MAAS360 CLOUD EXTENDER FOR CERTIFICATE SERVICES? MaaS360 Certificate Services Integration provides customers with the ability to leverage their existing Certificate Authority (CA) and auto-provision User Certificates to enrolled ios Devices. Administrators can create , Wi-Fi, and VPN policies & profiles that can use User based Certificates for authentication. The Cloud Extender interacts with Certificate Authority, and pushes the issued certificates down to enrolled ios devices. It performs the following functions: Processes User Certificate requests from MaaS360 when the users enroll their ios devices against a policy that requires User Certificates. Authenticates against the Certificate Authority (CA) / Registration Authority (RA) before requesting for Certificates. Requests User Certificates on behalf of enrolled ios devices. Encrypts the issued User Certificates and uploads the same to MaaS360. MaaS360 then pushes these certificates to these devices. Cloud Extender can Integrate with Microsoft CA installed on 2003 or 2008R2 and Symantec Managed PKI The MaaS360 Cloud Extender requires that it be configured with a Certificate Template with information regarding the CA server, and administrative credentials to authenticate and request device certificates. 8

9 Certificate Service Integration Requirements Checklist Before beginning the installation, make sure the following requirements are met: Item Meets Requirement Microsoft: Administrative Access to Microsoft Certificate Authority (CA) Server Symantec: Administrative Access to Symantec MPKI environment (Web URL) Microsoft: Administrative Access to a server on which Network Device Enrollment Service (NDES) can be installed. Could be 2003 or 2008R2 Enterprise or Data Center editions. Can be enabled on either the Cloud Extender server or the CA server itself. Symantec: Administrative Access to Symantec MPKI environment with admin access to get an RA certificate. Microsoft: Administrator credentials for the NDES environment Symantec: Administrative credentials on Symantec MPKI environment. Please refer to the Detailed Certificate Integration Guides for more details on Certificate Integration. 9

10 Installing and Configuring the Cloud Extender Launch the MaaS360 Cloud Extender installation package. This package can be downloaded using the Product Download link on the MaaS360 Portal. You will also need the License Key for installation. Click the Send License Key to have it sent to your address. As noted in the Introduction of this document, what is being installed is a version of the MaaS360 Visibility Service, which provides the underlying functionality for the Cloud Extender. Once the Visibility Service is installed, the MaaS360 Cloud Extender Configuration Tool will be launched and will take you through the steps required to configure the Cloud Extender for your environment. *The Configuration Tool can also be run later by the administrator manually using the shortcut to All Programs/MaaS360/MaaS360 ActiveSync Configuration Utility. VISIBILITY SERVICE The following screens are representative of what you will see as you step through the Visibility Service installation. 1. Double click the MaaS360 Cloud Extender executable. 2. Click Next to advance to the License Key screen. 3. Enter the License Key provided to you in the Welcome . 10

11 4. Click Next to advance to the Ready to Install the Program screen. 5. Click Install to continue the installation. 11

12 6. Click Next to continue the installation. 7. When prompted, click Finish. The MaaS360 Cloud Extender Configuration Tool will now launch. 12

13 MAAS360 CLOUD EXTENDER CONFIGURATION TOOL Once the Configuration Tool launches, during installation you will be taken through the following screens: 1. You will be prompted to select the mode of Internet Access. MaaS360 will try to auto-populate the detail found within the IE settings. a. If you are manually configuring your proxy settings, you also have the ability to set credentials if you are using an authenticated proxy. b. If no proxy is required to reach the Internet, use the Do not use any proxy option. 13

14 c. When Internet access is configured successfully a Green checkmark will appear on the Check for Internet connectivity screen as seen below. 14

15 2. Click Next to continue to select your services. 3. The following services are available: a. Exchange ActiveSync Manager b. Lotus Traveler Manager c. BlackBerry Enterprise Server Integration d. User Authentication e. User Visibility f. Certificates Integration (call Fiberlink for additional configuration options) 15

16 If you select Exchange ActiveSync Manager, additional options are displayed. 16

17 4. Select your services. A common configuration is: Exchange ActiveSync Manager On premises (Exchange 2007) User Authentication Active Directory User Visibility Active Directory 17

18 5. Click Next to verify the prerequisites were met. NOTE: This screen could vary based on your selections. 18

19 6. Click Next to configure the service account used to run the MaaS360 Visibility Service. 19

20 7. You will be notified if the authentication was successful. 20

21 8. Click Test Reachability to run the optional Reachability Test. If you do not want to run this test, click Next to move past it. The test will verify access to the services selected. Here is an example of what the results may look like. 21

22 9. The Cloud Extender Status screen appears. Each item will receive a checkmark as it becomes integrated with MaS360. Click Next to proceed. 22

23 10. Click Next to configure Automatic Updates and finish the configuration. NOTE: It is recommended that Automatic Update remain enabled so the latest modules are downloaded for the installation. After you have all the proper modules, Automatic Updates can be disabled. If the Automatic Updates checkbox is greyed out, that means the modules are still being downloaded. 11. Click Finish. 23

24 After a few minutes data will be collected and passed to MaaS360. You can check this process by logging into MaaS360 via portal.fiberlink.com and going to the Manage -> Manage MaaS360 Cloud Extenders workflow. 24

25 Appendix A: Other Modules LOTUS TRAVELER MANAGER IN THE CLOUD EXTENDER CONFIGURATION TOOL 1. Click the + button to add the names of your Traveler server(s) 2. Browse to the Notes.ini File Path 3. Browse to the Notes ID file 4. Enter the password for the Notes ID file being used for the MaaS360 Visibility Service 25

26 BLACKBERRY ENTERPRISE SERVER INTEGRATION IN THE CLOUD EXTENDER CONFIGURATION TOOL 1. Enter your BAS Server Name 2. Select your Mailbox Server and click Get Authentication Types 3. Enter the detail for the Service Account being used by the MaaS360 Visibility Service 26

27 EXCHANGE 2010/2013 INTEGRATION IN THE CLOUD EXTENDER CONFIGURATION TOOL 1. The tool will check to see if the necessary applications are installed. If they are, click Next. 27

28 2. Enter your Remote PowerShell URL: 3. Enter your MDM Service account credentials. 28

29 OFFICE 365 INTEGRATION IN THE CLOUD EXTENDER CONFIGURATION TOOL 1. Enter the Office 365 Server URL 2. Enter the detail for the Service Account (note: this can be a local account to O365 with Global Admin rights, or a member of Organization Management in your local AD, if configured to sync with O365) 29

30 BPOS-D INTEGRATION IN THE CLOUD EXTENDER CONFIGURATION TOOL 1. The tool will check to see if the necessary applications are installed. If they are, click Next. 30

31 2. Enter the BOPS Server URL. 3. Enter the username and password for the account. 31

32 CERTIFICATE INTEGRATION IN THE CLOUD EXTENDER CONFIGURATION TOOL 1. Add a new Template. 32

33 2. Complete the template information based on your PKI Microsoft or Symantec 33

34 Appendix B: Troubleshooting MICROSOFT EXCHANGE ACTIVESYNC During configuration, there are issues accessing the specified CAS server URL on Exchange 2010/2013. Troubleshooting steps: 1. Please verify that the service account specified has the Organization Management access right, and that you are logged onto the machine with the service account. 2. Ensure that the CAS server you have specified is the FQDN of an actual host, rather than an array or load-balancing URL. 3. Verify that the CAS server can be pinged from the Cloud Extender machine. The configuration utility detects the Management Tools for Exchange 2007 or 2010, but no devices are showing up in the portal. Troubleshooting steps: 1. Verify that the Management Tools match both the year and service pack version of the Exchange server itself. 2. Log into the portal and verify that Manage -> Configure Services shows that ActiveSync Manager is enabled. 3. Verify that devices/mailboxes can be viewed directly from the Exchange Management Console. When performing the reachability tests, some of my mailbox servers are marked as unreachable. Troubleshooting steps: 1. If mailbox servers contain redundant databases or exist for DR purposes, they may show as unreachable. This failure is expected, and you can continue through the wizard. 2. If the unreachable servers pertain to a different version of Exchange than what you are trying to configure, this error can be safely ignored. 3. If there are no mailboxes on this serve the error can be safely ignored. IBM LOTUS TRAVELER The configuration tool completed successfully, but no devices are showing in the portal. Troubleshooting steps: 1. Verify that the Lotus client is not running on the Cloud Extender machine. 2. Log into the portal and verify that Manage -> Configure Services shows that Lotus Traveler Manager is enabled. 3. Verify that the Lotus client has been configured on this machine and then exited. BLACKBERRY ENTERPRISE SERVER During configuration, there are issues accessing the specified BlackBerry Administration Service URL. Troubleshooting steps: 1. To the URL specified in Config utility, concatenate "/webconsole/login/" 2. Enter this URL from a browser on the device where MaaS360 Cloud Extender is installed and ensure this is reachable. If not, there may be firewall rules preventing access to the BES setup which must be fixed 34

35 What should I do if no devices are visible in "View All Devices" workflow even after successful Cloud Extender configuration? Troubleshooting steps: 1. Ensure that.net 3.5 or higher is installed 2. Log into the portal and verify that Manage -> Configure Services shows that Blackberry Enterprise Server Manager is enabled. I cannot execute the Send Message action. What should I do? Troubleshooting steps: 1. Perform the action from the BES console to see if it works correctly. Sometimes BES settings for outgoing s may not be configured properly, which could result in this issue. 2. Make sure there are no special characters in the message. 35