ios Mobile: Setup Guide for Umbrella ios Mobile Devices

ios Mobile: Setup Guide for Umbrella ios Mobile Devices

Overview The Mobile App protects ios mobile devices (e.g. smartphones, tablets) regardless of where they are in the world or how they connect to the Internet. The solution works by enforcing a secure channel for all Internet-bound traffic via an automatic or on demand VPN. The secure channel passes traffic through one of our OpenDNS Global Network data centers distributed worldwide. The OpenDNS Global Network uses Anycast routing to always connect your device to the easiest to reach datacenter for optimal performance. All traffic regardless of application, protocol or port will be protected by the OpenDNS Global Network and the acceptable use policy you assign. Umbrella protects your mobile devices and sensitive data from becoming compromised. This guide explains how to use provisioning profiles to connect your devices to the OpenDNS Global Network. Prerequisites To use the Mobile App you must have: Supported Mobile Operating Systems and Devices Apple ios 5.1.1, ios 6.x., ios 7.x Apple iphones (3GS and above), ipad (all) and ipod Touch (4 th generation and above).!note: Android OS and related devices will be supported in a later release.!note: Jailbroken devices are not supported. Appropriate Network Permissions While the main purpose of the solution is to protect mobile devices while connecting to the Internet from third-party networks, use on your network is also possible. The solution utilizes standard IPSec VPN and HTTP/S ports, which must be opened for both source and destination addresses: o UDP 500 o For networks using NAT-T: UDP 4500 o IP Protocol 50/ESP o TCP 80 and 443.!NOTE: The Mobile App utilizes standard Apple ios mobile provisioning profiles. It does not explicitly require an app to be deployed or installed, though one is available. ios Mobile Setup Guide for Umbrella Page 2

Step 1: Provision Profile Provisioning uses a push model, pull model, or combination of the two. The default and recommended option is App Invitation. In this option, you can invite users (via email) to install an App from the Apple App Store that will enable them to register their devices to your account within the Dashboard. Users simply have to click the link to install the App (from the App Store), return to the email and click the Activate button to activate the app, then finally complete the registration steps within the App itself. For devices in the field, this option provides a scalable model for adding users. The App additionally provides help information and usage statistics to the end users. Alternatively, when sending an email invitation, you can optionally select the VPN Profile Only by checking the box in the lower right corner of the email entry field. In this case, users will be directly sent a configuration file to apply to their ios devices that will connect them to the OpenDNS Global Network s cloud-delivered network security. The Umbrella dashboard will help you track pending installations to ensure that users follow up. For devices in the field, this option provides a scalable model for adding users, in cases where you would prefer they did not use the App. Finally, a pull model is available whereby the user installs the The Umbrella Mobile App from the itunes App Store, authenticates with an Umbrella account, and registers the device into Umbrella. The app additionally provides help information and usage statistics. When IT or Help Desk staffs wish to manually provision mobile devices, we recommend the mobile device app option, especially if devices do not have email accounts available. A mixture can be used as well. Push Provisioning: Invitation by Email IT staffs can invite users via email to add an app, or alternatively just a VPN profile, to their ios devices that will connect them to Umbrella. The Umbrella dashboard will help you track pending installations to ensure that users follow up. For devices in the field, this option provides a scalable model for adding users. 1) Log into the Umbrella dashboard and navigate to Configuration > Identities > Mobile Devices 2) Click add a new device and enter one or more email addresses for the devices you wish to provision. 3) Optionally, check Send VPN-only profile invitations if you do not want users to have the Mobile App.!IMPORTANT! Invitations CAN be re-used by multiple users and across multiple devices UNLESS the VPNonly option is utilized. If the VPN-Only option is selected, each provisioning profile is unique and should not be re-used.!note: If there is not a unique email address available per device you may re-generate multiple profiles to the same email address. And then move these additional profiles to additional devices via a file sharing solution (e.g. DropBox). 4) The email addresses should appear in the device list appended by a unique ID number (e.g. user@domain.com_12345678). These devices will appear in a pending provision state indicated by. It is ios Mobile Setup Guide for Umbrella Page 3

normal at this point for the Last Request to be Never with a warning icon. 5) From those mobile devices, open the invitation email. a) Install the Mobile App via the itunes link. After installation, return to the email and click the activation link. Then, follow the instructions in the app. b) If VPN-only profile was checked in step 3, then the user will only click on the attached mobile provisioning profile. Pull Provisioning: Installation Initiated from the App Store IT staffs or end-users themselves can install the Umbrella by OpenDNS App from the itunes App Store and authenticate with your organization s Umbrella account to register the device with Umbrella. 1. Download the app from itunes: https://itunes.apple.com/us/app/umbrella-byopendns/id557639276?ls=1&mt=8 2. Open the application and authenticate with your Umbrella credentials. 3. Follow the instructions in the app, such as registering the device using a different non-default name. Then, click Install Profile. ios Mobile Setup Guide for Umbrella Page 4

Step 2: Verify Operation To check that the mobile device successfully connected to Umbrella: 1. On the device itself, check that the VPN icon appears in the top status bar of your device. For example:!note: It is normal for the VPN icon to turn off and on. It switches off when there is no network activity, and thus ios temporarily terminates the connection to Umbrella. It will start back up automatically when needed. The VPN icon also sometimes appears on the right side depending on what operations are active on the device. 2. Navigate to Configuration > Identities > Mobile Devices 3. Check that the devices now appear in a completed provision state indicated by and according to mode ((VPN Profile and/or Mobile App ). Also, the devices should indicate a recent Last Request.!NOTE: After 24 hours (default, this can be modified) without Internet activity, a warning icon will appear in the Last Request column. It does not necessarily mean that there is a problem, but it is likely that the user in question has either disabled the VPN or removed it entirely. 4. Optional: You may change the name of the device by selecting the table cell in the Umbrella dashboard containing the Name.!NOTE: Devices provisioned by pull provisioning (downloading the Mobile App) will list a name entered by the user who registered the device and may not take the form of an email address. The default for this field is the ios device name, which is commonly configured in itunes during initial setup. Step 3: Policy Configuration Once verifying that the ios Mobile Devices are operating successfully, define and apply security and acceptable usage policies to them. ios Mobile Setup Guide for Umbrella Page 5

1. Navigate to Configuration > Policies, and click add a new policy or click the name of an existing policy. 2. Check the Mobile Devices box if you want to apply a single policy for all provisioned mobile devices, or check the box next to one or more specific devices via the identity picker. To remove a selected device, either uncheck its box via the identity picker or click the red X icon to the right of its name. Then click next. 3. Select the 'Policy Settings', then 'Block Page Settings' you would like enforced for this policy. Then click next.!note: If you have not yet created any non-default settings, go to the 'Policy Settings' or 'Block Page Settings' pages to do so. 4. Set a meaningful description for the policy, then click save.!note: The policy you created will be applied within 60-90 seconds to any new connections coming into Umbrella from the selected computers. 5. Click and hold the drag handle icon to re-order the policy above or below any other existing policies.!note: Policy execution follows a top-down, first-match order of operations. The first policy assigned to an identity is enforced. Any subsequent policies assigned to the same identity are ignored. There is an editable, but immutable, Default Policy always ordered last, which is a catchall for any identity. ios Mobile Setup Guide for Umbrella Page 6

Appendix A: ios Settings App Help End users may access the ios Settings app to turn the VPN off/on or permanently remove it.!note: If an end user disables the VPN and fails to connect for a period of days (configurable with a default of 3 days), the Umbrella dashboard will indicate a warning next to the device listing. This can help IT or Help Desk staff to determine whether the end user has removed the solution.!note: It is possible to configure the VPN in an enforced mode so it cannot be disabled, provided the device is 'supervised' under Apple Configurator. Please contact support@opendns.com for more information about this. To turn the VPN off temporarily: To turn the VPN back on: To permanently remove the VPN profile: ios Mobile Setup Guide for Umbrella Page 7

Appendix B: De-Provisioning Devices 1. To de-provision a device, go to Settings > General > Profile via the ios device and permanently remove the VPN profile (refer to screenshots in Appendix A). 2. From the Umbrella dashboard, click the icon next to the mobile device you wish to de-provision. 3. Confirm that you wish to delete it forever by clicking Delete. 4. If the Mobile App is installed on the device, that should be removed as well. ios Mobile Setup Guide for Umbrella Page 8

Appendix C: Known Issues Apps Sometimes Hang Description: Occasionally, when ios attempts to re-establish the VPN connection after a period of network inactivity, the first app requesting Internet access doesn t see an available network, and hangs. This issue is limited to ios5 Frequency: Very Low. Severity: App dependent. Safari and Mail behave well. Facebook and Maps tend to suffer from this fairly severely and often require resolution. Resolution: The preferred resolution to upgrade to a later version of ios. VPN Session may terminate after an hour and 37 minutes Description: The VPN session is terminated after 1:37 (an hour and 37 minutes) of continuous connectivity due to an ios bug in IPSec VPN XAuth. Connectivity will be interrupted for 2 minutes, then automatically resume. In order to restore connectivity immediately, simply toggle the VPN to manual and back to automatic from Settings -> VPN. Frequency: Always. Severity: Minor. Resolution: No workaround, but his issue is being pursued both with Apple, and via a server-side fix from the OpenDNS service. ios Mobile Setup Guide for Umbrella Page 9

Umbrella is brought to you by OpenDNS. Trusted by millions around the world. The easiest way to prevent malware and phishing attacks, contain botnets, and make your Internet faster and more reliable. OpenDNS, Inc. www.opendns.com 1.877.811.2367 Copyright 2012 OpenDNS, Inc. All rights reserved worldwide. No part of this document may be reproduced by any means nor translated to any electronic medium without the written consent of OpenDNS, Inc. Information contained in this document is believed to be accurate and reliable, however, OpenDNS, Inc. assumes no responsibility for its use. ios-mobile-setup-guide-for-umbrella