Installation and Upgrade Guide

Installation and Upgrade Guide BES12 Version 12.4

Published: 2016-05-31 SWD-20160531105238577

Contents Planning...6 Steps to plan your BES12 environment...6 Identifying your organization's needs...6 EMM solution... 6 Users...7 Devices... 7 Device control... 8 Security...8 Licenses... 9 Databases... 9 High availability... 10 Hardware... 11 Network... 12 Support... 13 Apps... 13 Extra software...14 Budget... 14 Reviewing BES12 requirements... 15 Hardware requirements... 15 Hardware requirements: BES12 with Good Dynamics...19 Third-party software requirements... 21 Additional BES12 requirements... 21 Designing a deployment plan for BES12... 21 Planning tools...22 Installing or upgrading to the latest version of BES12...23 Upgrading from BES10 to BES12... 23 Upgrading from BES5 to BES12... 25 Upgrading from BES5 and BES10 to BES12... 35 Migrating data to BES12... 35 Special situations... 35 Supporting the deployment...37 Hardware issues... 37

Software issues...38 Network issues... 38 User, device, device control, and license issues...39 Database issues... 39 Returning to a previous environment... 40 Preinstallation and preupgrade checklist... 41 Installation and upgrade... 43 Steps to install BES12... 43 Applications that are installed with BES12...43 Steps to upgrade BES12... 44 Supported upgrade environments... 44 Steps to upgrade from BES10 to BES12... 45 Steps to upgrade from BES5 to BES12... 45 Port requirements...46 Configuring ports... 46 How BES12 selects listening ports during installation... 50 Preinstallation and preupgrade tasks... 53 Configure permissions for the service account...54 Configuring connections for the BES12 database... 54 Backing up the BES12 database... 55 Creating or upgrading a BES12 database using CreateDB... 55 Performing a test upgrade of the BES12 database... 58 Using the BES12 Readiness Tool...59 Configuring database high availability using Microsoft SQL Server AlwaysOn...60 Updating perpetual licenses... 63 Preparing a BES5 database for an upgrade to BES12... 64 Prerequisites: Installing or upgrading the BES12 software...65 Prerequisites: Upgrading BES5 to BES12... 65 Installing or upgrading the BES12 software...66 Install BES12...66 Upgrade BES12...69 Install or upgrade BES12 using the command prompt window...69 Install the BES12 management console or BES12 Core on a separate computer... 71 Installing BES12 in a DMZ...72 Installing a standalone BlackBerry Router... 73 Install a standalone BlackBerry Router...73

Logging in to BES12 for the first time... 73 Log in to BES12 for the first time... 74 Additional information...74 Best practice: Running BES12... 75 Configuring database permissions using Microsoft SQL Server roles... 75 Installing the BlackBerry Collaboration Service...76 Using the BES12 Configuration Tool... 76 Troubleshooting BES5 roles... 77 Removing the BES12 software... 78 Glossary... 80 Legal notice...81

Planning Planning 1 Steps to plan your BES12 environment When you deploy BES12 in your environment, you perform the following actions: Step Action Identify your organization's needs. Review BES12 requirements. Design a deployment plan. Support the deployment. Identifying your organization's needs Part of planning for BES12 is to document your organization s current environment and consider what you want BES12 to provide for your organization. Using this information, you can figure out what your organization must do to get from your current environment to an implementation of BES12 that meets your needs. To help you identify your organization's needs, see the Compatibility matrix and download the Performance calculator. EMM solution Your organization's current environment Do you currently have another EMM solution from BlackBerry (BES5, BES10, or BES12), an EMM solution from another vendor, or no previous EMM solution? Considerations for BES12 Knowing which EMM solution you already have helps you identify whether you should plan for an installation or upgrade: What you need After you know the type of BES12 deployment you need, you can determine the requirements to implement it. 6

Planning Your organization's current environment Considerations for BES12 If your organization's network already has an EMM solution from BlackBerry, you can upgrade to the latest version of BES12. If you have no previous EMM solution from BlackBerry, you can install a new instance of BES12. What you need If you are upgrading from BES5, the software must be at BES5 version 5.0.4 MR10 or later. If you are upgrading from BES10, the software must be at BES10 version 10.2.3 or later. Users Your organization's current environment Considerations for BES12 What you need You should gather the following information about your organization s users: How many users How technically savvy they are Whether any users have more than one device You can download the Performance calculator and use it to determine how many instances of BES12 are required to handle the number of users in your organization. Knowing the level of technical expertise of your users helps you tailor the activation email they receive, if they activate their own devices using BES12 Self-Service. You may need to obtain more computers to handle a large number of users. Devices Your organization's current environment Considerations for BES12 What you need Determine which types of devices the current EMM solution in your organization manages: Number and types of devices (BlackBerry 10 OS, BlackBerry To determine which configuration of BES12 instances you require to support the various device types, see the Compatibility matrix and download the Performance calculator. You can determine whether any users must Your users may need to upgrade or change their device hardware, or upgrade their device software. Before they can function on BES12, ios devices must have the latest version of Good for BES12 and Android and 7

Planning Your organization's current environment OS, ios, OS X, Android, and Windows) The models and software versions of the devices Considerations for BES12 upgrade their hardware or software so that their devices work with BES12. What you need Windows Phonedevices must have the latest version of the BES12 Client. You may need to obtain more computers to handle the number and types of devices. Device control Your organization's current environment Find out about the level of control your organization currently has over your users devices. Considerations for BES12 When you know the level of control your organization currently has over users devices, you can decide whether you want to maintain that level, change it, or implement it differently. For example, do you want: Separate personal and work spaces The ability to wipe the devices remotely To implement a bring-yourown-device (BYOD) policy This helps you determine the activation types to use for your organization's devices. What you need You may need to obtain new licenses or new types of licenses. Security Your organization's current environment How is security for devices and EMM implemented in your organization s environment? Considerations for BES12 Beyond device security, you should determine the level of security that your What you need If your organization s business is regulated, you may require a DMZ, firewall, TCP proxy server, or the 8

Planning Your organization's current environment Considerations for BES12 organization requires for your installation of BES12. What you need BlackBerry Router. You can install the BlackBerry Router and BES12 in a DMZ. You may require more computers to install these components. Licenses Your organization's current environment Gather information about your organization s existing BlackBerry licenses, such as the types and number of licenses. Considerations for BES12 Determine the types of licenses your organization needs for BES12. Consider the types of devices supported by your organization and the level of control you want over devices. Determine how many licenses you require. Every activated device uses a single license. Determine whether you want to buy licenses from BlackBerry (or a BlackBerry partner) or from your service provider as part of your current service agreement. For more information about BES12 licenses, see the Licensing content. What you need Obtain BES12 licenses. Depending on your current licenses, your level of technical support, and current licensing promotions, you may be able to claim some licenses for BES12. Perpetual licenses are valid only for the version of BES12 that they are issued for. If your BES12 domain includes perpetual licenses, obtain and activate perpetual licenses for the version of BES12 that you are upgrading to. For more information, visit support.blackberry.com/kb to read article KB36805. Databases Your organization's current environment Considerations for BES12 What you need If you have an EMM solution from BlackBerry, make sure that you know the names and locations of the databases. (For example, the default name for the BES12 handles roles differently than BES5. BES12 allows only one role for each user, and BES5 allows multiple roles for each user. BES12 requires an entire role to be assigned to one, some, If you are upgrading from BES5 to BES12, you must review the BES5 roles to remove any conflicting privileges, otherwise the BES12 setup application stops when it tries to resolve the roles. 9

Planning Your organization's current environment Considerations for BES12 What you need BES10 BlackBerry Configuration Database is BDSMgmt). or all groups. BES5 allows each privilege within a role to be assigned to one, some, or all groups. To migrate BES10 users, devices, IT policies, profiles, and groups to BES12, defragment the indexes of the BES10 BlackBerry Configuration Database and the BES10 Management Database before you begin migration. To migrate BES12 users, devices, IT policies, and profiles to another BES12 database, defragment the indexes of both databases before you begin migration. If you are upgrading from BES10 to BES12, perform defragmentation tasks on the BES10 BlackBerry Configuration Database, the BES10 Management Database, and the BES12 database (if one exists) before you start the migration process. If you are migrating a large number of users, you should defragment the BES12 database after you migrate each group of users. High availability Your organization's current environment Is your organization s current EMM solution set up for high availability? Considerations for BES12 To determine if your organization requires multiple BES12 instances to support high availability, think about whether: Users can tolerate some interruptions in service, or if they require minimal service interruptions while you resolve server issues or perform upgrades Your organization wants to load-balance user and device data across multiple BES12 instances Your organization wants to retain database service and What you need Install more than one BES12 instance to create a high availability configuration, and configure database high availability using Microsoft SQL Server features. 10

Planning Your organization's current environment Considerations for BES12 What you need data integrity if issues occur with the BES12 database Hardware Your organization's current environment Considerations for BES12 What you need What hardware do you already have? For example: The number of computers The specifications of these computers (processors, RAM, hard disk) Any application servers Do you use monitoring tools? Use the information in this Planning section, see the Compatibility matrix and download the Performance calculator to determine whether your organization has: Enough disk space to install BES12 Hardware that can provide the level of performance your organization needs Hardware limitations, to identify whether you are limited to a single-server installation or if a multiple server installation is possible Whether you can use some or all of your existing hardware for BES12 If your existing computers do not meet your organization s needs for BES12, you may need to add or upgrade computers. For more details on SNMP monitoring with BES12, see the Configuration content. There are many tools that you can use for monitoring various aspects of BES12: Windows Event Viewer System logging (Syslog) BES12 performance counters BES12 Resource Kit Performance calculator BES12 Dashboard 11

Planning Your organization's current environment Considerations for BES12 What you need You can also use third-party SNMP tools to monitor the activity of the BES12 Core. Network Your organization's current environment Considerations for BES12 What you need Identify known network issues such as latency and determine the overall network performance. Document the top-level architecture of the network, for example: Does it have multiple domains? How many instances of an EMM solution from BlackBerry and where are those servers located? Does your network use a proxy server? Do you need to increase the network s overall performance? Do you need to consolidate domains? If your network has servers from a single domain in multiple regions, it is possible that a user from one region might get moved to a server in another region during an upgrade to BES12. Performance issues may result, for example, if a user in the United States is on a BES12 instance in the United Kingdom. If your organization requires a proxy server, install a BlackBerry Router in the BES12 domain, or use a TCP proxy server that is already installed in your environment. Installing BES12 to a mapped network drive is not supported. BES12 components support only IPv4 for TCP/IP connections. To manage BlackBerry OS (version 5.0 to 7.1) devices from BES12, you must observe the same MAPI latency restrictions with your BES12 as you do with your BES5. Consolidate domains before installing BES12, because it is not possible to move users from one BES12 domain to another in this release of BES12. You can make sure that users stay in a specific region by creating a dedicated BES12 domain for each region. If you decide to install a proxy server or a BlackBerry Router in a DMZ, you must set up both an internal and an external firewall. 12

Planning Support Your organization's current environment Considerations for BES12 What you need Consider your current support structure and needs. For example: Does your organization have an in-house support team and an in-house development team for writing and porting apps? Do you need to change your support organization at all to accommodate BES12? Document new tasks for the support organization. Training for the support organization. Are most users mobile workers who rely on their devices to do much of their work (critical resources) or are the devices more of a perk of the business? Do users activate their own devices? Apps Your organization's current environment Considerations for BES12 What you need Take stock of the apps currently used in your organization. Depending on the answers, the types of apps can have implications for several areas, including software development, security, and network capacity. Some considerations are: Custom apps that might need to be ported to other device types Required or optional apps Secured apps Find out which apps your users consider important. App assignments cannot be moved from BES10 to BES12. Plan for software development to: Port custom apps to other device types Secure apps Develop new custom apps Make sure that any required apps are added to BES12 before moving users and devices. 13

Planning Your organization's current environment Considerations for BES12 What you need Plans for apps to add to your EMM environment Extra software Your organization's current environment Considerations for BES12 What you need Does your organization use instant messaging? Beyond basic EMM features, your organization may require other software, such as: A dedicated enterprise instant messaging solution Special VPN requirements or network requirements Productivity tools that work with devices that can be deployed to the users' desktops or laptops To support enterprise instant messaging, you must install BES12 version 12.1 or later. BES12 supports BlackBerry Collaboration Service 12. If you have a supported instant messaging server in a BES12 environment, you can install BlackBerry Collaboration Service 12. For more information about planning your installation, hardware requirements, installation instructions, and additional tasks after installing BlackBerry Collaboration Service 12, see the BlackBerry Enterprise IM for BES12 content. Budget Your organization's current environment Considerations for BES12 What you need What is the budget for your current EMM solution and devices? Your organization s budget for the BES12 installation has an impact on several areas, including: Plan for phased implementation. Plan IT policies, profiles, and groups. Buy appropriate licenses. 14

Planning Your organization's current environment Considerations for BES12 What you need Determining how much BYOD to allow Whether you need to start with a scaled-back solution, with plans for growth, or if you can afford to accommodate all your requirements right away How you can use policies, profiles, and groups to help reduce roaming charges and data costs Which types of licenses to buy Reviewing BES12 requirements BES12 requirements for hardware depend on the size of your environment. BES12 also has requirements for third-party software compatibility. Hardware requirements To determine the CPU and disk space requirements for BES12, you must consider the number of devices that you plan to activate, the type of connection that devices use, and the level and type of user activity on devices. For more information about calculating hardware requirements for a BES12 environment, download the Performance calculator. The following guidelines apply to a BES12 environment that supports email messages and app downloads. The environment can include BlackBerry 10 OS, BlackBerry OS (version 5.0 to 7.1), ios, OS X, Android, and Windows devices. Hardware requirements for up to 1000 devices For up to 1000 devices, install BES12 and Microsoft SQL Server or Microsoft SQL Server Express (and optionally BES5 version 5.0.4 and the BlackBerry Administration Service) on one computer. A domain of this configuration can have a maximum of 1000 devices. The total of 1000 devices can include up to 500 BlackBerry OS (version 5.0 to 7.1) devices. 15

Planning Server BES12 and Microsoft SQL Server or Microsoft SQL Server Express (and optionally BES5 version 5.0.4 and the BlackBerry Administration Service) Requirement One processor, Quad Core, 2.7 GHz (4 cores) or 4 vcpu 12 GB of available memory 64 GB of disk space Hardware requirements for up to 5000 devices For up to 5000 devices, install BES12 and optionally BES5 version 5.0.4 on one computer. Install Microsoft SQL Server on a separate computer. If you installed BES5 version 5.0.4, install the BlackBerry Administration Service on a separate computer. One instance of this configuration can support up to 5000 devices, of which 2000 can be BlackBerry OS (version 5.0 to 7.1) devices. The best practice is to have a maximum of 1000 BlackBerry OS (version 5.0 to 7.1) devices. You can have multiple instances of BES12 (including BES5 components) and multiple instances of the BlackBerry Administration Service. Multiple instances of BES12 require increased database CPU and memory. The best practice for this configuration is to have a maximum of eight BES12 instances. The computers that BES12 are on must be physically located near the computer with the Microsoft SQL Server database. If BES5 version 5.0.4 components are installed on any computers, they must be physically located near the mail and messaging computers. The computers with the BlackBerry Administration Service must be physically located near the computer with the Microsoft SQL Server database. Server BES12 (and optionally BES5 version 5.0.4 with up to 2000 BlackBerry OS (version 5.0 to 7.1) devices) Microsoft SQL Server Requirement Two processors, Quad Core, 2.7 GHz (8 cores) or 8 vcpu 12 GB of available memory 64 GB of disk space For 5000 devices: One processor, Quad Core, 2.7 GHz (4 cores) or 4 vcpu 4 GB of available memory 64 GB of disk space For 40,000 devices: Two processors, Quad Core, 2.7 GHz (8 cores) or 8 vcpu 12 GB of available memory 64 GB of disk space, 600 IOPS throughout BlackBerry Administration Service (optional) One processor, Quad Core, 2.7 GHz (4 cores) or 4 vcpu 4 GB of available memory 16

Planning Server Requirement 64 GB of disk space Hardware requirements for up to 25,000 devices For up to 25,000 devices, install BES12 and Microsoft SQL Server on separate computers. The total of 25,000 devices can include any mix of BlackBerry 10, ios, OS X, Android, and Windows devices. Additional features and configurations create more connections and sessions between devices and the BES12 instances, which limits the number of devices that one instance can support. To support more devices, add more instances of BES12. You can download the Performance calculator and use it to determine the minimum number of BES12 instances for your device configuration and workload. The computers that BES12 is installed on must be physically located near the computer with the Microsoft SQL Server database. The BES12 computers do not need to be near the mail and messaging computers. Server Requirement BES12 Two processors, Quad Core, 2.7 GHz (8 cores) or 8 vcpu 12 GB of available memory 64 GB of disk space Microsoft SQL Server One processor, Dual Core, 2.7 GHz (2 cores) or 2 vcpu 6 GB of available memory 64 GB of disk space Hardware requirements for up to 150,000 devices For up to 150,000 devices, install multiple instances of BES12 and optionally, multiple instances of BES5 version 5.0.4, and the BlackBerry Administration Service. One instance of BES12 can support up to 25,000 BlackBerry 10, ios, OS X, Android, and Windows devices. Additional features and configurations create more connections and sessions between devices and the BES12 instances, which limits the number of devices that one instance can support. To support more devices, add more instances of BES12. You can download the Performance calculator and use it to determine the minimum number of BES12 instances for your device configuration and workload. The computers that BES12 is installed on must be physically located near the computer with the Microsoft SQL Server database. The BES12 computers do not need to be near the mail and messaging computers. One instance of BES5 version 5.0.4 can support up to 2000 BlackBerry OS (version 5.0 to 7.1) devices. The computers with the BlackBerry Administration Service must be physically located near the computer with the Microsoft SQL Server database. 17

Planning Server BES12 BES12 management console only Requirement Install enough instances of BES12 to support the number of devices. Two processors, Quad Core, 2.7 GHz (8 cores) or 8 vcpu 12 GB of available memory 64 GB of disk space Each computer that hosts only the management console can support a maximum of 20 administrators in a domain of up to 150,000 devices. (In smaller domains, each computer can support more administrators.) To support up to 20 administrators on each computer in this configuration, disable the management console on the computers that host the BES12 Core. The latency between the computers that host the management console instances and the computers that host the BES12 Core and database instances should be no more than 50 ms. Two processors, Quad Core, 2.7 GHz (8 cores) or 8 vcpu 12 GB of available memory 64 GB of disk space BES5 version 5.0.4 BlackBerry Administration Service (for BES5 version 5.0.4) Install as many BES5 instances as required to support the number of devices, up to a maximum of 50 pairs of BES5 servers, which can be regionally distributed and must be physically located near the applicable mail and messaging computers. Up to six BlackBerry Administration Service instances, which must be physically located near the computer with the Microsoft SQL Server database. Microsoft SQL Server Two processors, Hex Core, 2.7 GHz (12 cores) or 12 vcpu 12 GB of available memory 64 GB of disk space, 2200 IOPS for 150,000 devices Hardware requirements: BlackBerry Router The following requirements apply to the computer that you install a standalone BlackBerry Router on. Number of activated devices Requirement 1 to 150,000 One processor, Quad Core, 2.7 GHz (4 cores) or 4 vcpu 4 GB of available memory 64 GB of disk space 18

Planning Hardware requirements: BES12 with Good Dynamics The following guidelines apply to a BES12 environment with Good Dynamics servers that support ios and Android devices. Hardware requirements for up to 1000 devices To provide support for up to 1000 ios and Android devices in a BES12 environment with Good Dynamics, install BES12 and Microsoft SQL Server on the same computer. Any combination of devices and features is supported. Server Requirement BES12 and Microsoft SQL Server One processor, Quad Core, 2.7 GHz (4 cores) or 4 vcpu 12 GB of available memory 64 GB of disk space Hardware requirements for up to 2000 devices To provide support for up to 2000 ios and Android devices in a BES12 environment with Good Dynamics, install BES12 and Microsoft SQL Server on separate computers. Any combination of devices and features is supported. Server Requirement BES12 (for ios and Android devices) One processor, Quad Core, 2.7 GHz (4 cores) or 4 vcpu 12 GB of available memory 64 GB of disk space Colocated with database Microsoft SQL Server One processor, Dual Core, 2.7 GHz (2 cores) or 2 vcpu 6 GB of available memory 64 GB of disk space Hardware requirements for up to 25,000 devices To provide support for up to 25,000 ios and Android devices (including up to 6000 Android for Work and Samsung KNOX Workspace devices using BlackBerry Secure Connect Plus) in a BES12 environment with Good Dynamics, install BES12 and Microsoft SQL Server on separate computers and use 8-core processors for the BES12 computer. Up to 25,000 devices are supported on one BES12 instance. To maintain high availability, install more BES12 instances in an Active-Active configuration. 19

Planning For custom hosted apps, you can assign a custom app to a group of up to 5000 users for each BES12 instance. Server Requirement BES12 (for ios and Android devices) Two processors, Quad Core, 2.7 GHz (8 cores) or 8 vcpu 12 GB of available memory 64 GB of disk space Colocated with database Microsoft SQL Server One processor, Dual Core, 2.7 GHz (2 cores) or 2 vcpu 6 GB of available memory 64 GB of disk space Hardware requirements for up to 150,000 devices To provide support for up to 150,000 ios and Android devices (including up to 36,000 Android for Work and Samsung KNOX Workspace devices using BlackBerry Secure Connect Plus) in a BES12 environment with Good Dynamics, install each instance of BES12 and Microsoft SQL Server on separate computers and use 8-core processors for the BES12 computer. Each BES12 instance can support up to 25,000 devices (including up to 6000 Android for Work and Samsung KNOX Workspace devices using BlackBerry Secure Connect Plus). For custom hosted apps, you can assign a custom app to a group of up to 5000 users for each BES12 instance, to a maximum of 15,000 devices. For example, with three or more BES12 instances, you can have a group size of up to 15,000 devices. As you add more BES12 instances to support more devices, the hardware requirements for the database server increase. Server BES12 (for ios and Android devices) Requirement For each instance supporting up to 25,000 devices: Two processors, Quad Core, 2.7 GHz (8 cores) or 8 vcpu 12 GB of available memory 64 GB of disk space Colocated with database Microsoft SQL Server Two processors, Hex Core, 2.7 GHz (12 cores) or 12 vcpu 12 GB of available memory 64 GB of disk space, 2200 IOPS for 150,000 devices 20

Planning Third-party software requirements For more information about which third-party software is compatible with BES12, see the Compatibility matrix. Additional BES12 requirements BES12 has some specific software requirements to be aware of. BlackBerry Secure Connect Plus If your BES12 domain will support more than 1000 devices per server using BlackBerry Secure Connect Plus at the same time, you must install Windows Server 2012 R2 or later on the computers that host BES12. BlackBerry Secure Gateway Service If you are using the BlackBerry Secure Gateway Service, the computer you install BES12 on must have 16 GB of available memory. The BlackBerry Secure Gateway Service supports ios. The BlackBerry Secure Gateway Service supports the following mail servers: Microsoft Exchange 2010, Microsoft Exchange 2013, Microsoft Exchange 2016, and Microsoft Office 365. Log files The size of log files for BES12 varies based on the number of devices in your organization's environment, the level of user activity on devices, and the logging levels that BES12 uses. It is a best practice to monitor and control the amount of disk space that the BES12 log files take up. For more information about configuring logging, see the Administration content. Designing a deployment plan for BES12 You can deploy BES12 in your organization s environment in several ways, depending on whether or not you have other EMM solutions from BlackBerry installed. You can install BES12 if your organization has: Note: BES12 BES10 BES5 no other EMM solutions from BlackBerry You cannot install BES12 on a computer that has both BES5 and BES10 installed on it. 21

Planning You cannot install BES12 on a computer that has the BlackBerry Cloud Connector installed on it. Follow the instructions in Steps to install BES12 to install BES12. Follow the instructions in Steps to upgrade BES12, Steps to upgrade from BES10 to BES12, or Steps to upgrade from BES5 to BES12 to upgrade to the latest version of BES12. After the installation is complete, see the Licensing content and the Configuration content to finish setting up your BES12. Related information Hardware requirements, on page 15 Planning tools In addition to all of your planning considerations, BES12 has some tools that you can use to assist you in planning your BES12 installation or upgrade: BES12 Readiness Tool BES12 Configuration Tool Using the BES12 Readiness Tool You can use the BES12 Readiness Tool to check system requirements before you run the BES12 setup application. The BES12 Readiness Tool checks the following requirements: Proxy server setting validation Minimum operating system requirements Minimum hard disk space Secure connection SRP connection Required ports Account permissions Database validation The BES12 Readiness Tool does not check for the following requirements: Microsoft.NET Framework 4.5 The BES12 Readiness Tool is included with the BES12 software. You can also download the tool from help.blackberry.com/ BES12tools. Using the BES12 Configuration Tool If your organization plans to support more than 500 users, use the BES12 Configuration Tool to calculate the number of SRP IDs you require. After you install BES12, run the BES12 Configuration Tool to import the SRPs into the BES12 database before you 22

Planning add or migrate users. The BES12 Configuration Tool is included with the BES12 software. You can also download the tool from help.blackberry.com/bes12tools. The BES12 Configuration Tool: Allows you to update or change the BES12 database properties, including: Microsoft SQL Server name Database name Port configuration Database authentication Windows username Windows password Allows you to calculate the number of SRP IDs required for BES12 based on the projected total number of users. Allows you to import extra SRP IDs into the BES12 database. For more details on the BES12 Configuration Tool, visit support.blackberry.com/kb to read article KB36443. For more information about obtaining and importing SRP IDs, visit support.blackberry.com/kb to read article KB36435. Installing or upgrading to the latest version of BES12 The BES12 setup application upgrades the BES12 software and database to the latest version of BES12. Upgrading from BES10 to BES12 You can use the BES12 management console to manage BlackBerry OS (version 5.0 to 7.1), BlackBerry 10, ios, OS X, Android, and Windows devices. Decisions Decide if you want to move your BES10 IT policies, profiles, groups, users, and devices to BES12. If you do want to move your BES10 IT policies, profiles, groups, users, and devices to BES12, decide if you want to install BES12 on the same computer as BES10 or on another computer. Decide when the particular stages of the migration will be done, and who will do them. Considerations Same computer Different computer Additional hardware required No Yes Service outage for all BES10 users Yes (when you uninstall BES10) No 23

Planning Considerations Same computer Different computer Move a pilot group of users for testing before moving the rest of the users Performance issues Yes Possible (if the number of users and devices exceed the optimum for a single computer environment) see Tip Yes Unlikely Tip: If you expect to exceed the recommended number of users and devices in a single computer environment, you can install additional instances of BES12 after the upgrade to accommodate more users and devices. Installing BES12 on the same computer as BES10 When you install BES12, the setup application creates a BES12 database. Note: If you plan to retain the BES10 instance for a long period of time, do not install BES12 on the same computer. If you install BES12 on the same computer as BES10, make sure that the computer has enough memory to meet the requirements of both BES10 and BES12. Do not stop the BES10 services when you install BES12 on the same computer as BES10. If you do, BES12 may use some of the ports that BES10 is already using, which will cause port conflicts. CAUTION: After you install BES12 on the same computer as a BES10 instance, do not modify or upgrade the BES10 instance. If you install BES12 on the same computer as BES10, you should migrate your IT policies, profiles, groups, users, and devices from BES10 to BES12 as soon as possible, and then uninstall the BES10 instance. When you install BES12 on the same computer as BES10, there is a service interruption when you uninstall BES10 after the upgrade is complete. 24

Planning Installing BES12 on a separate computer from BES10 Install BES12 on a different computer than the existing BES10 instance. The setup application creates a BES12 database. When you install BES12 on another computer, there is no service interruption because you can uninstall BES10 or decommission the BES10 computer without affecting the new BES12 computer. Upgrading from BES5 to BES12 You can use the BES12 management console to manage all your domain users, groups, apps, policies, profiles, BlackBerry OS (version 5.0 to 7.1), BlackBerry 10, ios, OS X, Android, and Windows devices. However, you must use the BlackBerry Administration Service to configure VPN profiles, Wi-Fi profiles, and software updates for BlackBerry OS (version 5.0 to 7.1) devices. Note: After the upgrade, distributed BES5 components remain in place and continue to perform the same functions for the BlackBerry OS devices as they did before the upgrade. If you install BES12 on the same computer as the BES5 BlackBerry Administration Service component, the BlackBerry Administration Service may not be accessible. For more information, visit http:// support.blackberry.com/kb to read article KB37180. The BlackBerry Router that you originally installed with your BES5 continues to work only for the components that are used to manage BlackBerry OS devices. If you install a new instance of the BlackBerry Router with BES12, you can configure it to work with all components. CAUTION: After an upgrade from BES5 to BES12, you cannot roll back to the BES5 database. Before you begin an upgrade, back up the BES5 database. The BES12 setup application backs up the database by default. 25

Planning BES12 Migration Kit You can use a BES12 migration kit to move users from one computer that has an initial BES5 instance to another computer that has a second BES5 instance. You can upgrade this second BES5 instance to BES12 and then move the IT policies, profiles, users, and devices in increments to the BES12 instance. The BES12 migration kit allows you to install a second BES5 instance on another computer using the following: BES5 SRP BES5 software with setup application One user CAL Upgrading from BES5 to BES12 in an existing domain To upgrade from BES5 to BES12 in an existing domain, you can install BES12 on the same computer as or on a different computer than an existing BES5 database. Follow the instructions in the Upgrade section to install BES12 and point it to the BES5 database to upgrade. Note: If you install BES12 on the same computer as the existing BES5 database, make sure that the computer meets the hardware requirements for BES12. Note: If you install BES12 on the same computer as the existing BES5 database, performance issues can occur if the number of users and devices exceed the optimum for a single computer environment. To accommodate more than the recommended number of users and devices for a single computer environment, install BES12 on a separate computer, or install additional instances of BES12 after the upgrade is complete. Choose this option if: 26

Planning You want to upgrade an existing BES5 BlackBerry Configuration Database to a BES12 database. If you do not need to consolidate any domains You need to retire existing BES5 instances You do not want to deploy another instance Pros The ability to have BlackBerry OS (version 5.0 to 7.1) devices supported in BES12 You do not necessarily need another computer Cons A global service interruption while the BES5 database is upgraded The existing BES5 environment is affected Upgrading from BES5 to BES12 in a new domain To upgrade from BES5 to BES12 in a new domain, install a BES5 instance on a new computer (to do this, you need another SRP, an authentication key, and CALs). Follow the instructions in the Installation section to install BES12 on the new computer. The BES12 setup application upgrades the new BES5 BlackBerry Configuration Database to a BES12 database. Next use BlackBerry Enterprise Transporter to move the IT policies, profiles, users, and devices in increments from the original BES5 to the BES12 database on the new computer. Service interruptions occur only for the batch of users that you are moving from the original BES5 database to the new BES12 database. 27

Planning Choose this option if: You want to retire existing BES5 instances It is too time-consuming to upgrade existing BES5 instances to BES5 version 5.0.4 MR10 or later Pros The ability to have BlackBerry OS (version 5.0 to 7.1) devices supported in BES12 You can move data at your own pace No impact to the existing BES5 environment Cons You must build a new BES5 domain You must install another server Upgrading a large BES5 environment to BES12 Large environments have unique considerations, such as: Distributed BES5 components installed at remote locations Multiple BlackBerry Router or proxy server deployments Network latency 28

Planning A large BES5 environment before an upgrade to BES12 This diagram shows a BES5 environment hat consists of three sites. Site A has one instance of BES5 configured for high availability. Site B has a BES5 instance installed for disaster recovery purposes. Site C is a smaller site that has a standalone BES5 instance that communicates with the BlackBerry Configuration Database at Site A. The following remote components are installed at sites A and B: BlackBerry Administration Service BlackBerry Attachment Service BlackBerry Collaboration Service for BES5 BlackBerry MDS Connection Service for BES5 BlackBerry Router for BES5 Site C also hosts a BlackBerry Attachment Service and BlackBerry MDS Connection Service for BES5. 29

Planning 30

Planning Stage 1 During the first stage of the upgrade, you should do the following things. First, make sure that all BES5 components at all sites, including the BlackBerry Configuration Database, are the latest version of BES5. If components are not updated to the latest version, they will not be able to communicate with the upgraded database. Second, upgrade the BlackBerry Configuration Database at sites A and B. Do not upgrade the BES5 instances to BES12. If you upgrade the BES5 instances to BES12, you might interrupt the BES5 data traffic. Install the BlackBerry Router for BES12 at sites A and B. The BlackBerry Router for BES5 doesn't support BES12 instances. If your organization requires a proxy server, you must install the BlackBerry Router for BES12 or a TCP proxy server. Note: You can also install the BlackBerry Router for BES12 during stage 2. 31

Planning 32

Planning Stage 2 During the second stage of the upgrade, you should install BES12 instances at sites A and B to support BlackBerry 10, ios, OS X, Android, and Windows devices. You can also install BlackBerry Collaboration Service for BES12 at sites A and B. You should install the BlackBerry Router for BES12 or a TCP proxy server (if you didn't install them in stage 1). You don't need to make changes to any of the following distributed BES5 components: BlackBerry Administration Service BlackBerry Attachment Service BlackBerry Collaboration Service for BES5 BlackBerry MDS Connection Service for BES5 BlackBerry Router for BES5 Site C remains unchanged and now communicates with the upgraded BES12 database at site A. 33

Planning 34

Planning Upgrading from BES5 and BES10 to BES12 You can install BES12 if you have both a BES5 and a BES10 installed in your organization. Note: You cannot install BES12 on a computer that has both BES5 and BES10 installed on it. To upgrade from BES5 and BES10 to BES12, you must first do one of the following: Upgrade the BES5 database to BES12 Install a new BES5 instance, upgrade its database to BES12, and move the data from the original BES5 Second, move the BES10 data to the new combined BES5 and BES12 database. Related information Upgrading from BES5 to BES12, on page 25 Migrating data to BES12 For instructions about how to move data to a BES12 domain, see the Configuration content. You use the BES12 management console to move the data to the new BES12 domain. To move data from BES12 to BES12, the source and destination BES12 instances must both be at version 12.1 or later. To move data from BES10 to BES12, the source BES10 instance must be at version 10.2.3 or later. After all BES10 data has been moved, you can uninstall BES10 and delete or archive the BlackBerry Configuration Database and Management Database. Special situations Not all installations are covered by the standard deployment plan. You may also have to make additional plans if you: Plan to install the BES12 management console or BES12 Core on a separate computer Are upgrading a BES12 domain that is configured for high availability Have a large number of users and devices and require multiple SRPs Have a domain with multiple instances of BES12 and need to take into consideration load-balancing data Installing the BES12 management console or BES12 Core on a separate computer After you install BES12 on a computer, you can install the BES12 management console or BES12 Core on a separate computer. You can install BES12 components on separate computers for security reasons or if your computer has system resource limitations. Note: You should install BES12 on one computer before you install the management console or BES12 Core on separate computers. 35

Planning Upgrade a BES12 domain that consists of multiple instances of BES12 1. Shut down all instances of BES12 in the domain. 2. Upgrade one BES12 instance. The setup application also backs up and upgrades the BES12 database. The BES12 instance automatically starts after the upgrade. 3. Upgrade the rest of the BES12 instances. CAUTION: If the recommended upgrade path is to upgrade BES12 versions in stages, then you must upgrade all instances to the first stage, then shut them all down again, and upgrade them all to the second stage. For example, if the upgrade path from version 12.0 to 12.4 is that you must first upgrade to 12.2, then upgrade all the BES12 instances to version 12.2 first. Shut them all down and then upgrade all the instances to 12.4. For more information, see Supported upgrade environments and visit http:// support.blackberry.com/kb to read article 000037644. Tip: During the first stage of the upgrade, set the start.windows.services parameter in the deployer.properties file to false when upgrading each instance. Then you don t have to wait for the services to start before you begin the second stage. Multiple SRPs BES12 enterprise connectivity traffic for BlackBerry 10 devices includes email, organizer data, and browser network traffic. All of this traffic flows from the BlackBerry Dispatcher (one for each BES12 instance), to the active BlackBerry Affinity Manager within the BES12 domain, to the BlackBerry Infrastructure, and then to the device. In the path between the BlackBerry Affinity Manager and the BlackBerry Infrastructure, network conditions such as latency, packet loss, and packet reordering reduce the rate at which data can be transmitted over a single TCP connection due to the nature of the TCP/IP protocols. Adding SRPs allows the BlackBerry Affinity Manager to establish multiple connections to the BlackBerry Infrastructure, known as SRP connections. Each connection must have an SRP ID associated with it. By having multiple connections, you can compensate for these network effects by reducing the amount of data each connection must carry between the BlackBerry Affinity Manager and the BlackBerry Infrastructure. The BES12 Configuration Tool helps estimate how many SRP connections you need for your particular domain size and network conditions. 36

Planning It is a best practice to establish the correct number of SRP connections before you install BES12, to allow for a good distribution of BlackBerry 10 devices across the SRP connections. BlackBerry 10 devices are statically assigned to the least loaded SRP connection during activation. If an extra SRP connection is added later, new devices are assigned to the new SRP connection when they are activated until the new SRP connection reaches the same load as the other SRP connections. Load-balancing data for BlackBerry 10 devices If you install multiple instances of BES12 in the same domain, data for BlackBerry 10 devices is load-balanced equally across all healthy instances. For example, if you install three instances of BES12 and the domain includes 3000 BlackBerry 10 devices, BES12 assigns 1000 devices to each instance. Load-balancing occurs only if the domain includes more than 500 BlackBerry 10 devices. Each BES12 instance uses the same SRP ID and connects to the same BES12 database. The components on each instance are all running and actively managing data for all device types, except for the BlackBerry Affinity Manager and BlackBerry Work Connect Notification Service. Only one instance of the BlackBerry Affinity Manager and the BlackBerry Work Connect Notification Service are active. You can view the status of each instance in the management console. For more information about high availability and load balancing, see the Configuration content. Supporting the deployment Many of the items to consider when planning the support of your BES12 deployment are similar to items you looked at when you assessed your organization's environment. Hardware issues Possible issue The hardware does not work or does not meet BES12 requirements Not all hardware is available Mitigation options Before the planned installation date: Check all hardware before the planned installation date to verify that it is in working order and that it meets all BES12 hardware requirements. Prepare one or two extra computers in case a computer stops working on the planned installation date. During installation: If you must install multiple instances of BES12, stage the deployment so that you complete a full 37

Planning Possible issue Mitigation options installation on one computer first to make sure that all hardware is working. Install the BlackBerry Router later (if applicable). Software issues Possible issue Port conflicts The computer s operating system does not meet BES12 requirements The BES12 setup application does not work Mitigation options Before the planned installation date: Run the BES12 Readiness Tool on the computers you plan to install BES12 on. The BES12 Readiness Tool helps you determine whether or not the computers meet the minimum requirements for installing BES12. Make sure all application servers, such as Exchange ActiveSync and the mail servers, are active, running, and tested. Network issues Possible issue Required firewall ports are not open BES12 instances cannot communicate with each other BES12 cannot communicate with the BlackBerry Infrastructure BES12 cannot communicate with application or content servers Mitigation options Before the planned installation date: Run the BES12 Readiness Tool on the computers you plan to install BES12 on. The BES12 Readiness Tool helps you determine whether or not the computers meet the minimum requirements for installing BES12. Create a detailed list of the ports that are required. Confirm with your networking team that the ports are open. 38

Planning User, device, device control, and license issues Possible issue Users were added between the time of planning and the time of deployment The type of activation planned for each user group was changed Test activations are not working Mitigation options Depending on device type, number of devices, and activation type, you may have fewer licenses than you need when it is time to activate devices. In this case, you can activate only the key users and add more licenses as soon as possible. When dealing with activation, app, IT policy, or profile issues during deployment, make sure that: You have enough licenses for the activation type. You have created or imported the correct IT policies and profiles and assigned them to the user that you are testing. If you are not registering users with the BlackBerry Infrastructure, make sure that you have the correct BES12 web address to enter during activation. Application servers are accessible by the devices and by BES12. The devices are compatible with BES12. Database issues Possible issue The BES12 database does not install The existing BES5 database is not accessible The upgrade from BES5 to BES12 does not complete Mitigation options Before the planned installation date: Check all hardware before the planned installation date to verify that it is in working order and that it meets all BES12 hardware requirements. Install and test the database. Test all connectivity between the computer that will host BES12 and the database. Perform a test upgrade of a copy of the BES5 database. For more information about backing up the BES5 database before an upgrade, see the BES5 Administration Guide. 39

Planning Returning to a previous environment Most organizations cannot afford a long service interruption while troubleshooting. Therefore, before a database upgrade, you should plan for the ability to return to the previous environment, in case any issues arise. Returning to the previous environment is not as simple as stopping the upgrade, especially if data was being migrated when an issue occurred. To prepare to return to your previous environment, before the planned installation date: Back up the existing databases. (By default, the BES12 setup application backs up the existing database.) If you use a virtual environment, take a snapshot of it. If you encounter an issue during or after installing BES12, collect data about the issue before you return to your previous environment so that you can determine its root cause. For more information about backing up the BES5 BlackBerry Configuration Database, see the BES5 Administration Guide. For more information about backing up the BES10 BlackBerry Configuration Database, see the BES10 Upgrade Guide. For more information about backing up the BES12 database, see Backing up the BES12 database. 40

Preinstallation and preupgrade checklist Preinstallation and preupgrade checklist 1 Verify that the following requirements are met before you install BES12 version 12.4. You can also upgrade to BES12 version 12.4 from the following: BES5 version 5.0.4 MR10 or later BES10 version 10.2.3 or later BES12 version 12.2 or later For more information about configuring BES12 version 12.4, see the Configuration content. When you verify requirements in this document, see the Compatibility matrix. You can use the BES12 Readiness Tool to check system requirements before you run the BES12 setup application. To download this tool, visit help.blackberry.com/bes12tools. Minimum requirements for installing BES12 The following requirements apply when you need to configure additional computers or devices to support BES12 in your organization. Complete Requirement Verify that your computer is running an operating system that supports BES12. Verify that your computer is running Windows PowerShell 2.0 or later for the following: RRAS for BlackBerry Secure Connect Plus setup during the BES12 installation Exchange ActiveSync gatekeeping (optional). Verify that your ports are configured. For more information, see Port requirements. Verify that you have a mail server that supports BES12. Verify that the Exchange ActiveSync version meets the minimum requirements. Verify that you have Microsoft Exchange Server 2010 or later if you plan to enable Exchange ActiveSync gatekeeping on the mail server. Verify that you have a mail server that is supported for use with Secure Work Space for ios and Android devices (optional). 41

Preinstallation and preupgrade checklist Complete Requirement Verify that you have one of the following company directories: Microsoft Active Directory and users with Microsoft Active Directory accounts LDAP with anonymous authentication or simple bind authentication, with or without SSL Verify that your database server has a supported database management system. Verify that the TCP/IP network protocols are turned on for your BES12 database. Verify that you have DNS support for resolving IP addresses into host names. If you have VPN hardware in your environment, verify that you have one of the following: IPSec VPN hardware SSL VPN hardware If you have a remote BlackBerry Router instance or TCP proxy server in your organization, verify that you have a supported operating system. Verify that you have a supported browser on the computers that host the BES12 management console. Verify that you configure the following settings to support browser access: Support for JavaScript Cookies turned on Support for TLS The SSL certificate is installed to permit trusted connections to the consoles Verify that you have supported mobile operating systems for BlackBerry 10, ios, OS X, Android, and Windows devices. 42

Installation and upgrade Installation and upgrade 2 Steps to install BES12 The BES12 setup application installs the BES12 software and creates a BES12 database. For a new installation of BES12, perform the following actions: Step Action Review the port requirements. Complete the preinstallation tasks. Verify the prerequisites. Install BES12. Log in to BES12. Applications that are installed with BES12 You can use the BES12 installation process to install the following third-party applications: Microsoft.NET Framework 4.5 (if it is available in the setup application to enable through the Windows Server Manager) Microsoft Visual C++ 2008 SP1 Redistributable Package Microsoft Visual C++ 2010 Redistributable Package Microsoft SQL Server 2014 Express SP1 (if it is selected during the installation process) Microsoft SQL Server 2012 Native Client OpenVPN-TAP Windows RRAS for Windows Server 2008 or 2012 43

Installation and upgrade Note: If the setup application cannot install RRAS on your computer you must stop the installation, install it manually, and restart the installation. Windows PowerShell 2.0 or later is required to run RRAS when installing BES12. For more information about installing RRAS manually, visit technet.microsoft.com. Note: If your organization restricts the installation of new drivers, install the OpenVPN-TAP Windows driver manually. You can manually install the OpenVPN-TAP Windows driver after you download and extract the BES12 software and navigate to the tools > ext folders. To verify that the OpenVPN-TAP Windows driver has been installed, navigate to Control Panel > Programs and verify that Windows-TAP 9.9.2 is listed in the installed programs; in a command prompt window, type sc qc tap0901. Note: Uninstall the Microsoft SQL Server 2012 Native Client before installing BES12 if you are installing Microsoft SQL Server 2014 Express. For more information about the JRE version that is installed with BES12, see the Compatibility matrix. If you want to install the most recent version of JRE before you install BES12, visit www.java.com. If you want to install Microsoft SQL Server 2014 Express SP1 on a computer that does not host BES12, you can copy the BES12 installation files to the computer that you want to install Microsoft SQL Server 2014 Express SP1 on. In the BES12 installation files, navigate to the Tools > ext folders and run the sqlexpress.exe file (64-bit). Steps to upgrade BES12 The BES12 setup application upgrades the BES12 software and database to the latest version of BES12. For more information, see Upgrade a BES12 domain that consists of multiple instances of BES12. When you upgrade BES12 to the latest version, you perform the following actions: Step Action Review the port requirements. Complete the preupgrade tasks. Verify the prerequisites. Upgrade the BES12 software. Supported upgrade environments The supported upgrade paths to BES12 version 12.4 are as follows: 44

Installation and upgrade You can use the setup application to upgrade BES12 version 12.2 and later to BES12 version 12.4. If you have a version of BES12 earlier than version 12.2, you must first upgrade all instances to BES12 version 12.2 or version 12.3 before you can upgrade to BES12 version 12.4. You can use the setup application to upgrade from BES5 to BES12. You can install BES12 and migrate IT policies, profiles, groups, users, and devices from BES10 to BES12. When you upgrade BES12 to the latest version, you upgrade the management console and the BES12 database. After you upgrade, existing users are active and no additional administrative actions are required. When you upgrade from BES5 to BES12, distributed BES5 components remain in place and continue to perform the same functions for the BlackBerry OS devices as they did before the upgrade. For information about upgrading multiple instances of BES12, see Upgrade a BES12 domain that consists of multiple instances of BES12. Steps to upgrade from BES10 to BES12 You can install BES12 on the same computer as BES10 or on a separate computer. After you install BES12, you use the BES12 management console to migrate your existing BES10 IT policies, profiles, groups, users, and devices to BES12. For more information about upgrading from BES10 to BES12, see Upgrading from BES10 to BES12. When you upgrade from BES10 to BES12, you perform the following actions: Step Action Install BES12 by following the Steps to install BES12. Migrate BES10 data to BES12. For information about moving BES10 IT policies, profiles, group names, users, and devices from BES10 to BES12, see the Configuration content. Steps to upgrade from BES5 to BES12 You can upgrade from BES5 to BES12 in an existing domain, or in a new domain. For more information, see Upgrading from BES5 to BES12. CAUTION: After an upgrade from BES5 to BES12, you cannot roll back to the BES5 database. Before you begin an upgrade, back up the BES5 database. The BES12 setup application is set to back up the existing database by default. When you upgrade from BES5 to the latest version of BES12, you perform the following actions: 45

Installation and upgrade Step Action Review the port requirements. Complete the preupgrade tasks. Verify the prerequisites. Install BES12. Log in to BES12. Port requirements Before you install or upgrade BES12, familiarize yourself with how BES12 uses ports. Configuring ports The BES12 components use various ports to communicate with the BlackBerry Infrastructure and internal resources (for example, your organization's messaging software). The topics in this section indicate the default ports that BES12 uses for outbound connections, and also describe the internal connections that you should verify. Note that these port connections are required whether or not BES12 is installed in a DMZ. Outbound connections: BES12 to the BlackBerry Infrastructure BES12 must connect with and receive data from the BlackBerry Infrastructure to perform tasks. BES12 connects with the BlackBerry Infrastructure over the outbound-initiated, two-way port 3101 (TCP). Your organization's firewall must allow outbound two-way connections over port 3101 to <region>.srp.blackberry.com, <region>.bbsecure.com, and <region>.turnb.bbsecure.com. For more information about domains and IP addresses to use in your firewall configuration, visit http://support.blackberry.com/kb to read article KB36470. You have the option of routing data from BES12 through your organization's TCP proxy server or the BlackBerry Router to the BlackBerry Infrastructure. If you choose to send data through a proxy server, configure the firewall to allow the following outbound two-way connections: Use port 3102 as the default listening port to connect the BES12 components to the TCP proxy server or the BlackBerry Router 46

Installation and upgrade Use port 3101 as the default listening port to connect the components that manage BlackBerry OS devices to the TCP proxy server or the BlackBerry Router If you configure BES12 to use a TCP proxy server or the BlackBerry Router, verify that the proxy allows connections over port 3101 to <region>.srp.blackberry.com, <region>.bbsecure.com, and <region>.turnb.bbsecure.com. Activities initiated by the BES12 Core over the port 3101 connection to the BlackBerry Infrastructure Purpose Authenticate BES12 Enable licenses Request a signed CSR Activate and manage BlackBerry 10 devices Description Connect to the authentication service to authenticate the BES12 installation and allow the components to use the BlackBerry Infrastructure services. Connect to the licensing infrastructure to activate your organization s server licenses and to enable BlackBerry 10, ios, Android, and Windows devices to use SIM licenses obtained from your service provider. Connect to the signing infrastructure so you can request a certificate signing request (CSR) from BlackBerry. You use the signed CSR to obtain and register an Apple Push Notification Service (APNs) certificate, which you require to manage ios devices. Connect to the BlackBerry Infrastructure to: Activate and manage BlackBerry 10 devices Enable the work space on BlackBerry 10 devices Communicate with APNs Communicate with GCM Communicate with the BlackBerry push data service Connect to the BlackBerry Infrastructure to send data to the APNs. This connection is required so that you can manage and configure settings for ios devices. Connect to the BlackBerry Infrastructure to send data to the Google Cloud Messaging (GCM) service. This connection is required so that you can manage and configure settings for Android devices. Connect to the BlackBerry push data service so that you can manage and configure settings for BlackBerry 10 devices. 47

Installation and upgrade Purpose Discover server connection during activation Enable Secure Work Space Description Connect to the discovery service so that BES12 can find and use the server connection automatically when users activate devices. If you turn off this connection, users must specify the server manually when they activate devices. Connect to the BlackBerry Infrastructure to enable Secure Work Space on ios and Android devices. Control Secure Work Space Connect to the BlackBerry Infrastructure to control Secure Work Space on ios and Android devices. Manage Secure Work Space data Connect to the BlackBerry Infrastructure to: Allow ios and Android devices with Secure Work Space to access work data Send activation and management data over a secure connection between ios and Android devices and BES12 Allow ios devices to connect to APNs for device notifications Update device OS data Search for apps Purchase and push apps to ios devices Connect to the BlackBerry Infrastructure each day at midnight to check a hosted metadata file for new device or OS data. Updates are downloaded to the BES12 database. Connect to the BlackBerry Infrastructure and then to the App Store or BlackBerry World so that you can search for apps to add to the available app list. Connect to the BlackBerry Infrastructure and then to the App Store to allow you to buy and push apps to ios devices. Activities initiated by the BlackBerry Affinity Manager over the port 3101 connection to the BlackBerry Infrastructure Purpose Send and receive data for BlackBerry 10 devices Description Connect to the BlackBerry Infrastructure to send and receive data for BlackBerry 10 devices, including Exchange ActiveSync data and enterprise connectivity data (for example, intranet browsing and third-party app data). Activities initiated by BlackBerry Secure Connect Plus over the port 3101 connection to the BlackBerry Infrastructure Purpose Secure connection from work apps to work resources Description Connect to the BlackBerry Infrastructure to provide BlackBerry 10, Android for Work, and KNOX Workspace devices with a secure connection to work resources using BlackBerry Secure Connect Plus. 48

Installation and upgrade Outbound connections: Devices on a work Wi-Fi network BlackBerry 10, ios, Android, and Windows devices that use your work Wi-Fi network use the following outbound ports to connect to the BlackBerry Infrastructure and external services. Configure your organization's firewall to allow outbound two-way connections over these ports. From To Purpose Protocol Port BlackBerry 10 ios Android Windows devices BlackBerry Infrastructure To connect to the <region>.bbsecure.com subdomain when activating the device. 1. HTTP CONNECT to BlackBerry Infrastructure; creates tunnel from device to BES12 443 2. TLS session between device and BES12 BlackBerry 10 Android BlackBerry Infrastructure To connect to the <region>.bbsecure.com subdomain so that administration commands can be applied to the devices. 1. HTTP CONNECT to BlackBerry Infrastructure; creates tunnel from device to BES12 443 2. TLS session between device and BES12 ios BlackBerry Infrastructure To connect to the <region>.bbsecure.com subdomain so that administration commands can be applied to the devices. TLS 443 Windows devices BlackBerry Infrastructure To connect to the <region>.bbsecure.com subdomain so that administration commands can be applied to the devices. HTTPS; includes TLS handshake using SNI 443 ios Android BlackBerry Infrastructure To connect to the <region>.swsmanager.bbsecure.com subdomain to enable the Secure Work Space. HTTPS 443 ios APNs To connect to gateway.push.apple.com to receive notifications from APNs. TCP 5223 49

Installation and upgrade From To Purpose Protocol Port Android GCM To connect to android.apis.google.com (ports 5228 and 5229) and android.googleapis.com (port 5230) to receive notifications from GCM. TCP 5228 5229 5230 Intranet connections Connections initiated by the BES12 Core To simplify administration and support certain device features, the BES12 Core must be able to connect to your organization's intranet applications. Examples of intranet applications include Microsoft Active Directory, an LDAP directory, Microsoft Exchange, or an SMTP server. Consult the documentation or support resources for your organization s applications to identify the ports that BES12 must be able to access. Connections initiated by BlackBerry 10 devices and devices with Secure Work Space BlackBerry 10 devices and ios and Android devices with Secure Work Space can access your organization's internal applications through BES12 using the outbound-initiated port 3101 connection. Examples of internal applications include your organization's messaging software, or work browser access to intranet sites (HTTP/HTTPS). Consult the documentation or support resources for your organization s applications to identify additional ports that BES12 must be able to access. Access to internal data from devices without Secure Work Space For ios and Android devices that do not have a work space, and for Windows devices, BES12 sends and receives only activation and management data through the outbound-initiated port 3101 connection. All other data, such as messaging data and data from third-party applications, require alternate inbound connections from devices directly to the application. Consult the documentation or support resources for your organization's messaging software and third-party applications to identify the ports that you must open, or investigate alternate access methods such as VPN. How BES12 selects listening ports during installation When you install BES12 for the first time, the setup application determines whether default listening ports are available for use. If a default port is not available, the setup application assigns a port value from the range of 12000 to 12999. The setup application stores the port values in the BES12 database. 50

Installation and upgrade When you install an additional BES12 instance in the domain, the setup application retrieves the listening port values from the database and uses those values for the current installation. If a defined listening port is not available, you receive an error message stating that you cannot complete the installation until the port is available for use. Note: BES12 uses port 8889 for identity management for BlackBerry 10 devices and to handle SCEP requests for BlackBerry Secure Connect Plus. BES12 must be able to access this port to support devices running BlackBerry 10 OS version 10.3 or later. BES12 listening ports When you install BES12 for the first time, the setup application determines whether the following default listening ports are available for use. If a default port is not available, the setup application assigns a port value from the range of 12000 to 12999. The setup application stores the port values in the BES12 database. When you install an additional BES12 instance in the domain, the setup application retrieves the listening port values from the database and uses those values for the current installation. If a defined listening port is not available, you receive an error message stating that you cannot complete the installation until the port is available for use. Port Purpose 1610 The port that the BES12 Core uses to provide SNMP monitoring data. 1611 The port that SNMP clients can use to query monitoring data for BlackBerry Secure Connect Plus. 1612 The default port that is used for SNMP monitoring for the BlackBerry Secure Gateway Service. This port can be changed in the management console. 1620 The port that the BES12 Core uses to send SNMP notifications in an IPv4 environment. 3202 The port that the active BlackBerry Affinity Manager listens on for RCP connections from the BlackBerry Dispatcher. 3203 The port that the BlackBerry Dispatcher listens on for BIPPe connections from the BlackBerry MDS Connection Service. 8000 443 The ports that BES12 Self-Service and the management console listen on for HTTPS connections. If 443 is not available, the setup application tries to use port 8008. If port 8008 is not available, the setup application assigns a port value from the range of 12000 to 12999. 8085 The port that the active BlackBerry Affinity Manager listens on for REST notifications. 8087 The port that BES12 sends BlackBerry Secure Gateway Service traffic to. 8091 The secure SSL port that the BlackBerry Work Connect Notification Service listens on. 51

Installation and upgrade Port Purpose 8093 The port that the administration console uses to connect to the BES12 Core. 8102 The port that the BES12 Core uses to check the status of BlackBerry Secure Connect Plus. 8103 The port that the BES12 Core uses to obtain the status of the BlackBerry Secure Gateway Service. The status is displayed in the management console. 8448 The port that is used for internal communication between the BES12 Core and the management console and BES12 Self-Service. 8881 The port that BES12 uses to receive management requests for BlackBerry 10 devices. The connection uses mutual authentication with ECC certificates. 8882 The port that BES12 uses to receive enrolment requests for BlackBerry 10 devices. 8883 The port that BES12 uses to receive enrolment requests for ios, Android, and Windows Phone devices. 8884 The port that BES12 uses to receive management requests for ios, Android, and Windows Phone devices. The connection uses mutual authentication with RSA certificates. 8885 An additional port that BES12 uses to receive management requests for ios devices. The connection uses mutual authentication with RSA certificates. 8887 The port that BES12 uses for authenticated connections to check the status of BES12 instances. 8889 The port that the BES12 Core uses for identity management for BlackBerry 10 devices and to handle SCEP requests for BlackBerry Secure Connect Plus (the BES12 Core acts as the CA). Note: BES12 must be able to access port 8889 to support devices running BlackBerry 10 OS version 10.3 or later. 8890 The port that BlackBerry Secure Connect Plus and the BlackBerry Gatekeeping Service use to obtain configuration and authorization data and certificates. The BlackBerry Gatekeeping Service also uses this port for gatekeeping operations. 8891 The mutually-authenticated port that certain BlackBerry Infrastructure services use to connect with BES12. 8900 The secure SSL port that the BlackBerry Gatekeeping Service listens on. 52

Installation and upgrade Port Purpose 10080 The HTTP port that the BlackBerry MDS Connection Service listens on for enterprise push data. 10443 The HTTPS port that the BlackBerry MDS Connection Service listens on for enterprise push data. This port is used when you turn on push encryption. 11001 The port that BlackBerry Secure Connect Plus uses to listen for signaling requests from the BlackBerry Infrastructure. 18084 The port that applications can use to send data to the BlackBerry Web Services. 38082 The port that the BES12 Core listens on to route email notification traffic through the BlackBerry Infrastructure to the APNs for ios devices. 38083 The port that the BES12 Core listens on for migration requests when you move devices from BES10 to BES12. 38085 The port that supports Secure Work Space traffic from ios and Android devices through the BES12 Core and BlackBerry Infrastructure to connect to work resources. 38086 The port that your organization s TCP proxy server or the BlackBerry Router listens on for data that BES12 sends to the APNs. Preinstallation and preupgrade tasks Complete the following tasks, if required, before you install or upgrade BES12. Task Install BES12 Upgrade BES12 Upgrade from BES5 to BES12 Configure permissions for the service account Yes No Yes Configuring connections for the BES12 database Yes No No Backing up the BES12 database No Optional No Creating or upgrading a BES12 database using CreateDB Optional Optional No Performing a test upgrade of the BES12 database No Optional No Using the BES12 Readiness Tool Optional Optional Optional Configuring database high availability Optional Optional Optional Updating perpetual licenses No Optional No 53

Installation and upgrade Task Install BES12 Upgrade BES12 Upgrade from BES5 to BES12 Preparing a BES5 database for an upgrade to BES12 No No Yes Configure permissions for the service account A service account is a Windows account that runs the services for BES12. The service account must be a member of the local Administrators group on the computer that you install BES12 on, and must have the Log on as a service permission. The service account must also have permission to access the Microsoft SQL Server. If your organization's environment includes another EMM solution from BlackBerry, you can use the same service account to install BES12. Otherwise, create a service account in your company directory or a local Windows account on the computer that you want to install BES12 on. Note: If you use Microsoft SQL Server authentication to connect to the BES12 database, the BES12 services run under the Local System account. 1. On the taskbar, click Start > Administrative Tools > Computer Management. 2. In the left pane, expand Local Users and Groups. 3. Navigate to the Groups folder. 4. In the right pane, double-click Administrators. 5. Click Add. 6. In the Enter the object names to select field, type the name of the service account (for example, BESAdmin). 7. Click OK. 8. Click Apply. 9. Click OK. 10. On the taskbar, click Start > Administrative Tools > Local Security Policy. 11. In the left pane, expand Local policies. 12. Click User rights agreement. 13. Configure Log on as a service permission for the service account. Configuring connections for the BES12 database The BES12 database is created using the BES12 setup application or by running CreateDB using the command prompt window. BES12 can connect to the BES12 database using Windows authentication or Microsoft SQL Server authentication. You can connect to the BES12 database using one of the following: 54

Installation and upgrade Service account that you use to complete the installation process Windows administrator account that has create_db role permissions Microsoft SQL Server account that you specify during the installation process Specifying database permissions to create the BES12 database Depending on the database option and the type of authentication that you select, you might need to assign database creator permissions to one of the following: Service account that you use to complete the installation process Microsoft SQL Server account that you specify during the installation process Database option Install Microsoft SQL Server Express during the BES12 installation Use an existing Microsoft SQL Server in your organization's environment Database permission If you choose Windows authentication, the setup application automatically assigns the required database permissions to the service account You must add the service account or Microsoft SQL Server account to the dbcreator server role Verifying database permissions to upgrade the BES12 database BES12 connects to the BES12 database on the database server using the login information that you specified during the installation process (Windows authentication or Microsoft SQL Server authentication). If you want to use the setup application to upgrade the BES12 database, the service account or Microsoft SQL Server account must have permissions on the database server to upgrade the BES12 database. You can configure database permissions using Microsoft SQL Server roles. You must verify that the service account or Microsoft SQL Server account is a member of the dbcreator server role. Backing up the BES12 database Back up the BES12 database so that you can restore it if the BES12 upgrade process does not complete. The setup application automatically backs up the database as part of the upgrade process. You can also use the backup and restore tools that are a part of Microsoft SQL Server to back up and, if necessary, restore the BES12 databases. For more information, see the Microsoft documentation for Microsoft SQL Server. Creating or upgrading a BES12 database using CreateDB Note: You cannot upgrade a BES10 database to a BES12 database. 55

Installation and upgrade If your organization's security policies do not allow applications to have permissions to create or upgrade databases, you can run CreateDB on the database server to create a BES12 database or upgrade to a BES12 database instead of using the setup application. After you create or upgrade to the BES12 database using CreateDB, you can run the setup application using a service account that has minimum permissions on the database server. Create a BES12 database using CreateDB Before you begin: Verify that you configured the correct permissions on the database server. Note: If you do not want to run CreateDB on the database server, you must run it on a computer where BES12 is installed. The computer must be able to connect to the computer that hosts the database server that you want to create or upgrade the BES12 database on. 1. If you use a Windows account to create the BES12 database, log in to the computer using a Windows account that has database creator permissions. 2. Copy the BES12 installation files to the computer. 3. Extract the contents to a folder on the computer. 4. Navigate to <extracted_folder>\tools\ext. 5. Double-click the jre.exe file. 6. In the Java Setup screen, click Install. 7. Click Close. 8. Navigate to <extracted_folder>\tools\ext\unlimitedjcepolicyjdk8. 9. Copy all of the files from the UnlimitedJCEPolicyJDK8 folder. 10. Navigate to <java_install_dir>\lib\security. 11. Paste the files that you copied from the UnlimitedJCEPolicyJDK8 folder in the security folder. 12. Navigate to <extracted_folder>\db. 13. Open the CreateDB.properties file in a text editor. 14. Change the file to include information that is specific to your organization's environment. 15. Save and close the file. 16. Open a command prompt window. 17. Change the directory to <extracted_folder>\db. 18. Type one of the following commands to create or upgrade to a BES12 database: Database configuration Create a BES12 database Steps Type CreateDB.bat install CreateDB.properties. Press ENTER. 56

Installation and upgrade Database configuration Upgrade to a BES12 database Steps Type CreateDB.bat upgrade CreateDB.properties. Press ENTER. After you finish: Delete the CreateDB.properties file after you create or upgrade the BES12 database. CreateDB.properties file The following properties apply to the CreateDB.properties file, which contains configuration information for CreateDB. Property Database type Description This property specifies the type of database that integrates with BES12. By default, the database type property is "configuration.database.ng.type=sql_server". You should not modify this property as it is a default setting. Database server name This property specifies the database server name that hosts the database to create or upgrade to BES12. By default, the database server name property is "configuration.database.ng.server=localhost". Database instance name This property specifies the database instance name to create or upgrade to BES12. If you use a Microsoft SQL Server instance name; by default, the database instance name property is "configuration.database.ng.instance=microsoft_sql_server_instance name". Note: The default Microsoft SQL Server instance name in the CreateDB.properties file is BES. If you use another Microsoft SQL Server instance name than BES, configure the database instance name property to change BES to your Microsoft SQL Server instance name. If you do not use a Microsoft SQL Server named instance, verify that the Microsoft_SQL_Server_instance name value is deleted. Database port This property specifies the port that the database server uses. If you use a dynamic port configuration, verify that you have no ports listed for this property. 57

Installation and upgrade Property Description By default, the database port property uses a dynamic port configuration and you do not need to configure this property. If you use a static port configuration, configure your database port as "configuration.database.ng.port=static_port_number". Note: If you specify a static port, leave the database instance name property blank. Authentication type This property specifies the authentication type as follows: Windows authentication - by default, configured as INTEGRATED in this properties file Microsoft SQL Server authentication - can be configured as USER in this properties file If you use Windows authentication, by default your authentication type is "configuration.database.ng.authenticationtype=integrated". Note: If you use Windows authentication, you do not need to configure a user and password in the createdb.properties file. If you use Microsoft SQL Server authentication, configure your authentication type as "configuration.database.ng.authenticationtype=user". Username and Password - Microsoft SQL Server authentication (USER) If you use Microsoft SQL Server database authentication, these properties specify the username and password for the database account that has database creator permissions. By default, the username property you configure for Microsoft SQL Server authentication (USER) is "configuration.database.ng.user=user_name". By default, the password property you configure for Microsoft SQL Server authentication (USER) is "configuration.database.ng.password=password". Performing a test upgrade of the BES12 database You can perform a test upgrade of the BES12 database to help you identify and address issues that might occur during the database upgrade without affecting your production environment. You can also find out how long it takes to upgrade the BES12 database. When you perform a test upgrade of the BES12 database, you: 1. Back up the BES12 database. 2. Restore the backup version of the BES12 database to a database server that does not host the BES12 database. 58

Installation and upgrade 3. Run CreateDB using the command prompt window. Perform a test upgrade of the BES12 database This task should be performed by a database administrator with the appropriate permissions to back up, restore, and upgrade the BES12 database. Note: If you do not want to run CreateDB on the database server, you must run it on a computer where BES12 is installed. The computer must be able to connect to the computer that hosts the database server that you want to perform a test upgrade of the BES12 database on. Before you begin: Verify that you configured the correct permissions on the database server that you want to perform a test upgrade of the BES12 database on. 1. Log in to the computer that hosts the database server for the BES12 database. 2. Back up the BES12 database. 3. Log in to a computer that hosts a database server that you want to perform a test upgrade of the BES12 database on. 4. Restore the backup version of the BES12 database. 5. Copy the BES12 installation files to the computer. 6. Extract the contents to a folder on the computer. 7. Navigate to <extracted_folder>\tools\ext\unlimitedjcepolicyjdk8. 8. Copy all of the files from the UnlimitedJCEPPolicyJDK8 folder in the security folder. 9. Navigate to <java_install_dir>\lib\security. 10. Paste all of the files that you copied from the UnlimitedJCEPPolicyJDK8 folder in the security folder. 11. Navigate to <extracted_folder>\db. 12. Open the CreateDB.properties file in a text editor. 13. Change the file to include information that is specific to your organization's environment. 14. Save and close the file. 15. Open a command prompt window. 16. Change the directory to <extracted_folder>\db. 17. Type CreateDB.bat install CreateDB.properties and press ENTER. Using the BES12 Readiness Tool You can use the BES12 Readiness Tool to check system requirements before you run the BES12 setup application. The BES12 Readiness Tool checks the following requirements: 59

Installation and upgrade Proxy server setting validation Minimum operating system requirements Minimum hard disk space Secure connection SRP connection Required ports Account permissions Database validation The BES12 Readiness Tool does not check for the following requirements: Microsoft.NET Framework 4.5 The BES12 Readiness Tool is included with the BES12 software. You can also download the tool from help.blackberry.com/ BES12tools. Configuring database high availability using Microsoft SQL Server AlwaysOn Before you install BES12, decide if you want to configure high availability for the BES12 database. Database high availability allows you to retain database service and data integrity if issues occur with the BES12 database. You can use one of the following Microsoft SQL Server features for database high availability: AlwaysOn Failover Cluster Instances (FCI) for Microsoft SQL Server 2012 or 2014 (Standard Edition) AlwaysOn Availability Groups for Microsoft SQL Server 2012 or 2014 (Enterprise Edition) Database mirroring for Microsoft SQL Server 2008 or 2012 If you want to use an AlwaysOn feature, you must complete configuration steps before you install BES12. This section gives you instructions for configuring database high availability using AlwaysOn. You can configure database mirroring any time after you install BES12. For instructions, see the Configuration content. Note: Microsoft recommends using AlwaysOn because database mirroring will be deprecated in a future version of Microsoft SQL Server. Note that the AlwaysOn feature cannot be used if you upgrade from BES5 to BES12 (the BES5 database is upgraded to a BES12 database). AlwaysOn is not supported for the components that manage BlackBerry OS devices. AlwaysOn high availability BES12 supports AlwaysOn using a Failover Cluster Instance (FCI) or availability group. Both methods require a Windows Server Failover Clustering (WSFC) cluster where independent servers interact to provide a high availability solution for databases. For more information about WSFC, visit the MSDN Library to see Windows Server Failover Clustering (WSFC) with SQL Server. Instance-level high availability using an AlwaysOn Failover Cluster Instance 60

Installation and upgrade An FCI is an instance of Microsoft SQL Server that is installed across multiple computers (or nodes ) in a WSFC cluster. The nodes are members of a resource group, and all nodes have shared access to the BES12 database. One of the nodes has ownership of the resource group and gives the BES12 components access to the BES12 database. If the node that owns the resource group becomes unavailable (for example, a hardware or OS failure), a different node takes ownership of the resource group. As a result, BES12 database service continues with minimal interruption. For more information, visit the MSDN Library to see AlwaysOn Failover Cluster Instances (SQL Server). Database-level high availability using an AlwaysOn availability group 61