Wi-Fi Implementation Supplement

Transcription

1 Wi-Fi Implementation Supplement

2 Wi-Fi Implementation Supplement Last modified: 16 May 2008 Document ID: Version 26 At the time of publication, this documentation supplements the documentation for the following releases: BlackBerry Enterprise Server Version 4.1 SP3 or later Blackberry Professional Software Version 4.1 SP4 or later 2008 Research In Motion Limited. All rights reserved. BlackBerry, RIM, Research In Motion, SureType and related trademarks, names, and logos are the property of Research In Motion Limited and are registered and/or used as trademarks in the U.S., Canada, and countries around the world. Bluetooth is a trademark of Bluetooth SIG. GSM is a trademark of the GSM MOU Association. IBM, DB2, DB2 Universal Database, Domino, and Lotus are trademarks of International Business Machines Corporation. IEEE, 802.1X, , a, b, g, and i are trademarks of the Institute of Electrical and Electronics Engineers, Inc. Microsoft, Active Directory, and SQL Server are trademarks of Microsoft Corporation. Novell and GroupWise are trademarks of Novell, Inc. RSA and RSA SecurID are trademarks of RSA Security. Wi-Fi, Wi-Fi Protected Access, WPA, and WPA2 are trademarks of the Wi-Fi Alliance. All other trademarks are the properties of their respective owners. The BlackBerry smartphone and other devices and/or associated software are protected by copyright, international treaties, and various patents, including one or more of the following U.S. patents: 6,278,442; 6,271,605; 6,219,694; 6,075,470; 6,073,318; D445,428; D433,460; D416,256. Other patents are registered or pending in the U.S. and in various countries around the world. Visit for a list of RIM (as hereinafter defined) patents. This documentation including all documentation incorporated by reference herein such as documentation provided or made available at is provided or made accessible "AS IS" and "AS AVAILABLE" and without condition, endorsement, guarantee, representation, or warranty of any kind by Research In Motion Limited and its affiliated companies ("RIM") and RIM assumes no responsibility for any typographical, technical, or other inaccuracies, errors, or omissions in this documentation. In order to protect RIM proprietary and confidential information and/or trade secrets, this documentation may describe some aspects of RIM technology in generalized terms. RIM reserves the right to periodically change information that is contained in this documentation; however, RIM makes no commitment to provide any such changes, updates, enhancements, or other additions to this documentation to you in a timely manner or at all. This documentation might contain references to third-party sources of information, hardware or software, products or services including components and content such as content protected by copyright and/or third-party web sites (collectively the "Third Party Products and Services"). RIM does not control, and is not responsible for, any Third Party Products and Services including, without limitation the content, accuracy, copyright compliance, compatibility, performance, trustworthiness, legality, decency, links, or any other aspect of Third Party Products and Services. The inclusion of a reference to Third Party Products and Services in this documentation does not imply endorsement by RIM of the Third Party Products and Services or the third party in any way. EXCEPT TO THE EXTENT SPECIFICALLY PROHIBITED BY APPLICABLE LAW IN YOUR JURISDICTION, ALL CONDITIONS, ENDORSEMENTS, GUARANTEES, REPRESENTATIONS, OR WARRANTIES OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING WITHOUT LIMITATION, ANY CONDITIONS, ENDORSEMENTS, GUARANTEES, REPRESENTATIONS OR WARRANTIES OF DURABILITY, FITNESS FOR A PARTICULAR PURPOSE OR USE, MERCHANTABILITY, MERCHANTABLE QUALITY, NON-INFRINGEMENT, SATISFACTORY QUALITY, OR TITLE, OR ARISING FROM A STATUTE OR CUSTOM OR A COURSE OF DEALING OR USAGE OF TRADE, OR RELATED TO THE DOCUMENTATION OR ITS USE, OR PERFORMANCE OR NON-PERFORMANCE OF ANY SOFTWARE, HARDWARE, SERVICE, OR ANY THIRD PARTY PRODUCTS AND SERVICES REFERENCED HEREIN, ARE HEREBY EXCLUDED. YOU MAY ALSO HAVE OTHER RIGHTS THAT VARY BY STATE OR PROVINCE. SOME JURISDICTIONS MAY NOT ALLOW THE EXCLUSION OR LIMITATION OF IMPLIED WARRANTIES AND CONDITIONS. TO THE EXTENT PERMITTED BY LAW, ANY IMPLIED WARRANTIES OR CONDITIONS RELATING TO THE DOCUMENTATION TO THE EXTENT THEY CANNOT BE EXCLUDED AS SET OUT ABOVE, BUT CAN BE LIMITED, ARE HEREBY LIMITED TO NINETY (90) DAYS FROM THE DATE YOU FIRST ACQUIRED THE DOCUMENTATION OR THE ITEM THAT IS THE SUBJECT OF THE CLAIM.

3 TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW IN YOUR JURISDICTION, IN NO EVENT SHALL RIM BE LIABLE FOR ANY TYPE OF DAMAGES RELATED TO THIS DOCUMENTATION OR ITS USE, OR PERFORMANCE OR NON-PERFORMANCE OF ANY SOFTWARE, HARDWARE, SERVICE, OR ANY THIRD PARTY PRODUCTS AND SERVICES REFERENCED HEREIN INCLUDING WITHOUT LIMITATION ANY OF THE FOLLOWING DAMAGES: DIRECT, CONSEQUENTIAL, EXEMPLARY, INCIDENTAL, INDIRECT, SPECIAL, PUNITIVE, OR AGGRAVATED DAMAGES, DAMAGES FOR LOSS OF PROFITS OR REVENUES, FAILURE TO REALIZE ANY EXPECTED SAVINGS, BUSINESS INTERRUPTION, LOSS OF BUSINESS INFORMATION, LOSS OF BUSINESS OPPORTUNITY, OR CORRUPTION OR LOSS OF DATA, FAILURES TO TRANSMIT OR RECEIVE ANY DATA, PROBLEMS ASSOCIATED WITH ANY APPLICATIONS USED IN CONJUNCTION WITH RIM PRODUCTS OR SERVICES, DOWNTIME COSTS, LOSS OF THE USE OF RIM PRODUCTS OR SERVICES OR ANY PORTION THEREOF OR OF ANY AIRTIME SERVICES, COST OF SUBSTITUTE GOODS, COSTS OF COVER, FACILITIES OR SERVICES, COST OF CAPITAL, OR OTHER SIMILAR PECUNIARY LOSSES, WHETHER OR NOT SUCH DAMAGES WERE FORESEEN OR UNFORESEEN, AND EVEN IF RIM HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW IN YOUR JURISDICTION, RIM SHALL HAVE NO OTHER OBLIGATION, DUTY, OR LIABILITY WHATSOEVER IN CONTRACT, TORT, OR OTHERWISE TO YOU INCLUDING ANY LIABILITY FOR NEGLIGENCE OR STRICT LIABILITY. THE LIMITATIONS, EXCLUSIONS, AND DISCLAIMERS HEREIN SHALL APPLY: (A) IRRESPECTIVE OF THE NATURE OF THE CAUSE OF ACTION, DEMAND, OR ACTION BY YOU INCLUDING BUT NOT LIMITED TO BREACH OF CONTRACT, NEGLIGENCE, TORT, STRICT LIABILITY OR ANY OTHER LEGAL THEORY AND SHALL SURVIVE A FUNDAMENTAL BREACH OR BREACHES OR THE FAILURE OF THE ESSENTIAL PURPOSE OF THIS AGREEMENT OR OF ANY REMEDY CONTAINED HEREIN; AND (B) TO RIM AND ITS AFFILIATED COMPANIES, THEIR SUCCESSORS, ASSIGNS, AGENTS, SUPPLIERS (INCLUDING AIRTIME SERVICE PROVIDERS), AUTHORIZED RIM DISTRIBUTORS (ALSO INCLUDING AIRTIME SERVICE PROVIDERS) AND THEIR RESPECTIVE DIRECTORS, EMPLOYEES, AND INDEPENDENT CONTRACTORS. IN ADDITION TO THE LIMITATIONS AND EXCLUSIONS SET OUT ABOVE, IN NO EVENT SHALL ANY DIRECTOR, EMPLOYEE, AGENT, DISTRIBUTOR, SUPPLIER, INDEPENDENT CONTRACTOR OF RIM OR ANY AFFILIATES OF RIM HAVE ANY LIABILITY ARISING FROM OR RELATED TO THE DOCUMENTATION. Prior to subscribing for, installing, or using any Third Party Products and Services, it is your responsibility to ensure that your airtime service provider has agreed to support all of their features. Installation or use of Third Party Products and Services with RIM's products and services may require one or more patent, trademark, copyright, or other licenses in order to avoid infringement or violation of third party rights. You are solely responsible for determining whether to use Third Party Products and Services and if any third party licenses are required to do so. If required you are responsible for acquiring them. You should not install or use Third Party Products and Services until all necessary licenses have been acquired. Any Third Party Products and Services that are provided with RIM's products and services are provided as a convenience to you and are provided "AS IS" with no express or implied conditions, endorsements, guarantees, representations, or warranties of any kind by RIM and RIM assumes no liability whatsoever, in relation thereto. Your use of Third Party Products and Services shall be governed by and subject to you agreeing to the terms of separate licenses and other agreements applicable thereto with third parties, except to the extent expressly covered by a license or other agreement with RIM. The terms of use of any RIM product or service are set out in a separate license or other agreement with RIM applicable thereto. NOTHING IN THIS DOCUMENTATION IS INTENDED TO SUPERSEDE ANY EXPRESS WRITTEN AGREEMENTS OR WARRANTIES PROVIDED BY RIM FOR PORTIONS OF ANY RIM PRODUCT OR SERVICE OTHER THAN THIS DOCUMENTATION. Certain features outlined in this documentation require a minimum version of BlackBerry Enterprise Server Software, BlackBerry Desktop Software, and/or BlackBerry Device Software and may require additional development or Third Party Products and Services for access to corporate applications. This product includes software developed by the Apache Software Foundation ( and/or licensed pursuant to Apache License, Version 2.0 ( For more information, see the NOTICE.txt file included with the software. Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.

4 Research In Motion Limited 295 Phillip Street Waterloo, ON N2L 3W8 Canada Research In Motion UK Limited 200 Bath Road Slough, Berkshire SL1 3XE United Kingdom Published in Canada

5 Contents 1 Using the Wi-Fi Implementation Supplement...9 Supported environments... 9 Required BlackBerry Enterprise Server documentation...9 BlackBerry Enterprise Server administrative roles Technical overview BlackBerry Enterprise Server architecture overview...11 Wi-Fi environment overview...11 Wi-Fi coverage types...12 Wi-Fi connection options...13 Supported IEEE wireless networking standards...13 Architecture: Options for Mobile and Wi-Fi connections...14 Architecture components...14 BlackBerry Enterprise Server components...14 BlackBerry Enterprise Server remote components...15 BlackBerry Enterprise Server support for Wi-Fi enabled BlackBerry devices...15 Wireless access points...16 BlackBerry Enterprise Server process flows Installation and configuration overview...17 Quick reference Configuring security in your environment Security for Wi-Fi enabled BlackBerry devices...19 Prerequisites: Configuring layer 2 access security...19 Prerequisites: Configuring layer 3 VPN access security...20 Configuring software tokens...20 Configuring MAC access control lists...21 Configuring service-specific access security...21 Configuring a captive portal...21

6 5 Installing and configuring the BlackBerry Enterprise Server...23 Verifying that you are ready to install the BlackBerry Enterprise Server Configuring the BlackBerry Enterprise Server environment Preparing to support Wi-Fi enabled BlackBerry devices Installing the BlackBerry Enterprise Server Adding administrators to roles Setting up the BlackBerry Enterprise Server environment Setting up user accounts on the BlackBerry Enterprise Server Setting up user accounts Adding user accounts Adding user groups Customizing organizer data synchronization Configuring WLAN and VPN settings...29 WLAN and VPN profiles...29 Configuring WLAN and VPN profiles...29 Configure a WLAN profile...29 Configure a WLAN profile based on an existing profile...30 Configure a VPN profile...30 Configure a VPN profile based on an existing profile...31 Associate a VPN profile with a WLAN profile...31 Assigning profiles Assign a WLAN profile to a user account Assign a VPN profile to a user account Managing profiles Change a setting in a WLAN profile Change a setting in a VPN profile Delete a WLAN profile Delete a VPN profile Managing WLAN and VPN settings using IT policies...34 Download the IT policy definitions file...34 Importing the IT policy rules...34 Configuring and assigning IT policies Configuring and assigning IT policies in BlackBerry Enterprise Server Version 4.0.x Configuring and assigning IT policies in BlackBerry Enterprise Server Version 4.1 or later...36 Configure a Wi-Fi profile manually on the BlackBerry device... 37

7 8 Configuring encryption and authentication methods on the BlackBerry device...39 Configure WEP encryption...39 Configure PSK encryption...40 Using the IEEE 802.1X and EAP authentication framework...40 Configure LEAP authentication...41 Configuring PEAP, EAP-TLS, or EAP-TTLS certificate-based authentication Configure PEAP authentication...43 Configure EAP-TLS authentication...45 Configure EAP-TTLS authentication Configure EAP-FAST authentication Configuring software tokens...51 Using software tokens on the BlackBerry device...51 Prerequisites: Minimum software versions for software token use...51 RSA Authentication Manager documentation resources...51 Preparing the RSA Authentication Manager for software token use...51 Configure PIN policies for software tokens...51 Import the token seed file into the RSA Authentication Manager Database Create a user record in the RSA Authentication Manager Database Issue a software token Synchronize the date and time on the BlackBerry device with the RSA Authentication Manager computer Set the default WLAN connection parameters for the BlackBerry Domain Set the default VPN connection parameters for the BlackBerry Domain Set the user s profile for software token use Implementing BlackBerry devices...55 Minimum software requirements...55 Implementing BlackBerry devices Activating BlackBerry devices over the enterprise Wi-Fi network...57 Using the BlackBerry Router for BlackBerry device activations over the enterprise Wi-Fi network. 57 Setting up the environment for BlackBerry device activations over the enterprise Wi-Fi network...58 Preparing to install a BlackBerry Router for BlackBerry device activations over the enterprise Wi-Fi network...58 Confirm the installation credentials...59

8 Configuring a BlackBerry Router for BlackBerry device activations over the enterprise Wi-Fi network...59 Install and configure a new BlackBerry Router...59 Configure an existing BlackBerry Router...60 Prerequisites: Activating BlackBerry devices over the enterprise Wi-Fi network...60 Create and send activation information...61 Reactivate an existing BlackBerry device...61 Confirm that the activation is successful Troubleshooting...63 Push settings to the BlackBerry device...63 Troubleshooting connection and configuration issues on a Wi-Fi enabled BlackBerry device...63 Troubleshooting connection issues on a Wi-Fi enabled BlackBerry device...64 Verify that the Wi-Fi connection is turned on...64 View basic diagnostic information on a Wi-Fi enabled BlackBerry device...64 View detailed diagnostic information on a Wi-Fi enabled BlackBerry device...64 Wi-Fi Diagnostics status indicators...64 Status indicator groups...64 Status indicator states...65 Wi-Fi connection status indicators...65 VPN connection status indicators...68 UMA/GAN connection status indicators BlackBerry Infrastructure connection status indicators Enterprise connection status indicators Verify whether the BlackBerry device can reach an IP address Resolve a host name to an IP address IT policy rules and configuration settings...75 Using WLAN IT policy rules with a WLAN configuration set WLAN IT policy group WLAN configuration settings...81 VPN IT policy group...86 VPN configuration settings...89 Glossary... 95

9 Using the Wi-Fi Implementation Supplement 1 Required BlackBerry Enterprise Server documentation BlackBerry Enterprise Server administrative roles Supported environments You can use this guide to supplement an installation of either the BlackBerry Enterprise Server or the BlackBerry Professional Software. In this guide, consider BlackBerry Enterprise Server to mean BlackBerry Professional Software in the relevant reference information or in the tasks that the BlackBerry Professional Software supports. Required BlackBerry Enterprise Server documentation The BlackBerry Enterprise Server Wi-Fi Implementation Supplement provides information that you might require when you install and administer a BlackBerry Enterprise Server in an environment in which some user accounts have Wi-Fi enabled BlackBerry devices. Use this supplement with the following BlackBerry Enterprise Server documentation for your messaging environment: BlackBerry Enterprise Server Installation Guide BlackBerry Enterprise Server System Administration Guide To complete some tasks described in this supplement, you might require one or more of the following documentation resources: BlackBerry Enterprise Server Capacity Calculator BlackBerry Enterprise Server Handheld Management Guide (BlackBerry Enterprise Server Version 4.0.x) BlackBerry Enterprise Server Performance Benchmarking BlackBerry Enterprise Solution Security Technical Overview Placing the BlackBerry Enterprise Solution in a segmented network Policy Reference Guide

10 Wi-Fi Implementation Supplement BlackBerry Enterprise Server administrative roles In BlackBerry Enterprise Server Version 4.1 or later, the BlackBerry Enterprise Server uses predefined roles, which correspond to common corporate administrative roles, to control who can perform specific tasks and limit who can access sensitive data in your organization. To perform many of the tasks, you require security administrator or enterprise administrator permissions. For information about the tasks for each administrative role, see the BlackBerry Enterprise Server System Administration Guide. 10

11 2 Technical overview BlackBerry Enterprise Server architecture overview Wi-Fi environment overview Architecture: Options for Mobile and Wi-Fi connections Architecture components BlackBerry Enterprise Server process flows BlackBerry Enterprise Server architecture overview The BlackBerry Enterprise Server consists of services and components. The BlackBerry services are designed to provide productivity toolssuch as , instant messaging, and organizer functionalityand data from your organization s applications to BlackBerry device users. The BlackBerry components are designed to monitor the BlackBerry services; process, route, compress, and encrypt data; and communicate with the mobile network. Typically, user accounts with BlackBerry devices can connect to the mobile network. No changes to the BlackBerry Enterprise Server architecture are required to support Wi-Fi enabled BlackBerry devices. For more information about the BlackBerry Enterprise Server architecture, see the BlackBerry Enterprise Server Feature and Technical Overview for your messaging environment. Wi-Fi environment overview With a Wi-Fi enabled BlackBerry device, a user can access voice and data services across multiple radio technologies. Most BlackBerry device users connect over the mobile network to the BlackBerry Enterprise Server for access to productivity tools and your organization s data and applications. If a user s mobile network provider makes UMA technology (GAN technology) available, and the user has subscribed to the UMA feature, a Wi-Fi enabled BlackBerry device can access the mobile network provider s voice and data services over a mobile network or using a Wi-Fi connection. In addition, the user can establish concurrent connections to data services over a Wi-Fi connection during a call over the mobile network. A BlackBerry device can establish a Wi-Fi connection from an enterprise Wi-Fi network or, in conjunction with a VPN session, from a personal Wi-Fi network or from a Wi-Fi hotspot to complete a direct route to the BlackBerry Router. In addition, using a direct Wi-Fi connection to the BlackBerry Router, with or without a VPN session, or using a Wi-Fi network that allows a connection to the Internet on port 443, a Wi-Fi enabled BlackBerry device is designed to establish a safe connection to the BlackBerry Internet Service, the BlackBerry Messenger, and PIN messaging. Verify with your wireless service provider that your service plan provides access to these services over a Wi-Fi connection.

12 Wi-Fi Implementation Supplement Wi-Fi coverage types Examples of Wi-Fi network types include a WLAN within an organization s environment, a personal Wi-Fi network, or a public hotspot that offers a Wi-Fi connection. Enterprise Wi-Fi networks An enterprise Wi-Fi network usually has multiple wireless access points to provide one of the following types of coverage: ubiquitous coverage: Access point coverage in a workplace is contiguous, and users can roam between access points anywhere in the workplace. hotspot coverage: Access points provide a Wi-Fi connection in specific areas, such as conference rooms and other common areas. If coverage areas are not contiguous, users cannot roam between access points. mixed coverage: Access points offer ubiquitous coverage in some areas of the workplace and hotspot coverage in other areas. Users might or might not be able to roam between access points. An enterprise Wi-Fi network typically has strong authentication and link layer security. An organization might consider an enterprise Wi-Fi network untrusted and require that all Wi-Fi connections to the internal network occur through a VPN concentrator. Personal Wi-Fi networks A personal Wi-Fi network typically uses a single wireless access point to provide Internet access through a broadband gateway. The broadband gateway usually implements NAT and allows VPN connections to traverse the firewall. A personal Wi-Fi network is typically configured with link layer security and uses password-based authentication. Hotspots Hotspots offered by an ISP, a mobile network provider, or a property owner can provide a Wi-Fi connection in public and semipublic areas. The network is typically an open network without link layer encryption, with a captive portal for authentication. The captive portal performs the following functions: blocks all network traffic except traffic that uses HTTP redirects HTTP requests to a login page After a hotspot user successfully logs in, the captive portal grants the user access to wireless network services. Hotspots usually have a firewall in place, and they usually allow VPN connections. 12

13 2: Technical overview Wi-Fi connection options Direct connection to the BlackBerry Router over an enterprise Wi-Fi network A Wi-Fi enabled BlackBerry device can establish a connection over an enterprise Wi-Fi network that provides a direct route to the BlackBerry Router. A Wi-Fi profile for the user must already be configured. The profile is either created manually on the device or sent to the device in an IT policy by an administrator. After associating with a Wi-Fi connection using a Wi-Fi profile, the BlackBerry device tries to make a direct IP connection to the BlackBerry Router. With some network architectures, a VPN session might be required to complete the direct BlackBerry Router connection. As a result, the BlackBerry device includes a built-in VPN client that can be configured and associated to any Wi-Fi profile on the BlackBerry device. If a direct BlackBerry Router connection is possible (with or without a VPN session), the BlackBerry Enterprise Server automatically passes data using the existing BlackBerry security methods. Connecting directly to the BlackBerry Router is typically used when a Wi-Fi enabled BlackBerry device is within an organization s existing Wi-Fi environment. Wi-Fi connection without a VPN connection or direct BlackBerry Router connection If a direct IP connection to the BlackBerry Router is not available (with or without a VPN connection) on a Wi-Fi network that can access the Internet (for example, a personal Wi-Fi network or hotspot), the Wi-Fi enabled BlackBerry device automatically establishes an SSL connection over the Internet to the BlackBerry Infrastructure. After the BlackBerry device connects to the BlackBerry Infrastructure, all of the user s provisioned data services automatically start to send data to the device using the existing BlackBerry Enterprise Solution security methods. After the initial connection to the Wi-Fi network is established from an existing or newly configured Wi-Fi profile, no user configuration is required. You must configure an outgoing TCP connection for the Wi-Fi network on port 443 to the Internet. No other configuration is required. Supported IEEE wireless networking standards Characteristic IEEE a IEEE b IEEE g frequency 5 GHz 2.4 GHz 2.4 GHz maximum speed 54 Mbps 11 Mbps 54 Mbps fallback speeds 48, 36, 24, 18, 12, 9, 6 Mbps 5.5, 2, 1 Mbps 48, 36, 24, 18, 12, 9, 6 Mbps nonoverlapping channels up to sources of interference Bluetooth wireless Bluetooth wireless Bluetooth wireless technology technology technology microwave ovens some satellite systems microwave ovens 2.4 GHz cordless phones 5 GHz cordless phones 2.4 GHz cordless phones 13

14 Wi-Fi Implementation Supplement Architecture: Options for Mobile and Wi-Fi connections Mobile network Mobile network provider UNC/ GANC BlackBerry Infrastructure BlackBerry Internet Service Internet Wi-Fi connection Internet Personal or hotspot wireless access point Enterprise firewall Wi-Fi connection Enterprise Wi-Fi network Enterprise wireless access points Mobile network and Wi-Fi connections BlackBerry Enterprise Server Architecture components BlackBerry Enterprise Server components For information about the BlackBerry Enterprise Server components, see the BlackBerry Enterprise Server Feature and Technical Overview for your messaging environment. No additional BlackBerry Enterprise Server components are required for Wi-Fi enabled BlackBerry devices. 14

15 2: Technical overview BlackBerry Enterprise Server remote components Wi-Fi enabled BlackBerry devices can use the same distributed configurations as BlackBerry devices that access only the mobile network. For information about distributed BlackBerry Enterprise Server components, see the BlackBerry Enterprise Server Feature and Technical Overview for your messaging environment. BlackBerry Enterprise Server support for Wi-Fi enabled BlackBerry devices Feature BlackBerry Router per-user IT policy expanded groups of WLAN and VPN IT policy configuration settings multiple Wi-Fi and VPN profiles Description The BlackBerry Router is required for a BlackBerry device to connect to the BlackBerry Enterprise Server over a Wi-Fi connection for access to an organization s data. Per-user IT policies are designed to simplify the configuration of user-specific Wi-Fi and VPN information (such as user IDs and passwords). Expanded configuration settings provide the ability to control and manage Wi-Fi connections from BlackBerry devices. A new IT policy template file makes the additional configuration settings available for earlier versions of the BlackBerry Enterprise Server. Multiple Wi-Fi and VPN profiles are designed to address user needs in a variety of environments. BlackBerry Enterprise Server version SP2 4.1 SP3 4.1 SP4 4.1 SP5 wireless backup of Wi- Fi and VPN profiles BlackBerry device activation over the enterprise Wi-Fi network software token provisioning Activation over the enterprise Wi-Fi network is designed to simplify the activation or updating of BlackBerry devices. Software token provisioning is designed to provide the ability to centrally provision and manage the seed for software token authentication (for example, for VPN connections) on BlackBerry devices. 15

16 Wi-Fi Implementation Supplement Feature access to the BlackBerry Infrastructure over a Wi-Fi connection Description BlackBerry Enterprise Server version SP2 4.1 SP3 4.1 SP4 4.1 SP5 Wi-Fi enabled BlackBerry devices can connect directly to the BlackBerry Infrastructure over the Internet for access to voice and data services that a mobile network provider offers, even if UMA is not available. Verify with your wireless service provider that your service plan supports access to BlackBerry messaging services over a Wi-Fi connection. Wireless access points A wireless access point must conform to the IEEE a, IEEE b, or IEEE g wireless networking standard. To check the number of connections on each access point and to verify that users will be able to roam between access points, complete a site survey as directed in the documentation for your access points, and follow the recommendations for channel assignments. Types of wireless access points Wireless access points can be either thin or thick, with the following characteristics: A thin or controller-based access point is usually part of a centrally managed enterprise Wi-Fi network. This type of access point requires an external controller to manage network traffic. You can administer one or more thin access points through their controller. A thick access point, which is also referred to as an intelligent or autonomous access point, has the intelligence to operate as a standalone component without a controller. Thin access points with an external controller can provide a more seamless roaming experience for users with Wi-Fi enabled BlackBerry devices during data and voice sessions. Wireless access points and NAT If your organization uses NAT, wireless access points must support NAT traversal. BlackBerry Enterprise Server process flows Except for the differences in the network architecture, process flows for voice and data are the same, regardless of how a BlackBerry device connects to the mobile network provider. For more information about process flows, see the workflow information in the BlackBerry Enterprise Server Feature and Technical Overview for your messaging environment. 16

17 3 Installation and configuration overview Quick reference Quick reference Task Set up your enterprise Wi-Fi network. Verify that your wireless access points comply with the IEEE a, IEEE b, or IEEE g standard, that they allow NAT traversal if you use NAT in your organization, and that you have addressed the recommendations in your access point documentation to provide sufficient coverage for the number of Wi-Fi connections in your environment. If necessary, set up the DHCP server. If necessary, set up NAT. Document Documentation for your enterprise Wi-Fi network components Configure security. Documentation for your security hardware and software BlackBerry Enterprise Solution Security Technical Overview Configure the firewall settings. Security documentation Open the required ports, as described in Placing the BlackBerry Enterprise Solution in a segmented network. If you use a proxying firewall, configure the proxy so that it is transparent to users. Verify that the BlackBerry network IP addresses that are relevant to your environment are permitted addresses. Configure the ports required for network traffic associated with a Wi-Fi network. BlackBerry Enterprise Server Wi-Fi Implementation Supplement Address hardware, software, operating system, messaging, networking, and database requirements for the BlackBerry Enterprise Server environment. BlackBerry Enterprise Server Capacity Calculator BlackBerry Enterprise Server Performance Benchmarking BlackBerry Enterprise Server Installation Guide Install the BlackBerry Enterprise Server. BlackBerry Enterprise Server Installation Guide Verify that the BlackBerry Enterprise Server can connect to the BlackBerry BlackBerry Enterprise Server Installation Guide Infrastructure. Verify that the enterprise Wi-Fi network can connect to the BlackBerry Router and that BlackBerry Enterprise Server Installation Guide the BlackBerry Router is in the DNS server. Add administrators to roles. BlackBerry Enterprise Server System Administration Guide Add users to the BlackBerry Enterprise Server. BlackBerry Enterprise Server System Administration Guide

18 Wi-Fi Implementation Supplement Task Configure the WLAN settings and the IT policy settings for Wi-Fi connections. BlackBerry Enterprise Server Wi-Fi Implementation Supplement Manually create a Wi-Fi profile on the BlackBerry device to verify connectivity to the enterprise Wi-Fi network. Document BlackBerry Enterprise Server Wi-Fi Implementation Supplement Implement BlackBerry devices. BlackBerry Enterprise Server Wi-Fi Implementation Supplement 18

19 4 Configuring security in your environment Security for Wi-Fi enabled BlackBerry devices Prerequisites: Configuring layer 2 access security Prerequisites: Configuring layer 3 VPN access security Configuring software tokens Configuring MAC access control lists Configuring a captive portal Security for Wi-Fi enabled BlackBerry devices When a user account in your environment is associated with a Wi-Fi enabled BlackBerry device, Wi-Fi networks extend your organization s LAN. You must protect your organization s extended network from unauthorized use. Protective measures might include the following: All wireless devices must complete authentication before gaining access to your organization s LAN. All wireless communication between wireless devices and the LAN must use some encryption process. The steps that you can take to provide security for BlackBerry devices that can access both the mobile network and one or more Wi-Fi networks are part of your organization s plan to provide security for your entire BlackBerry Enterprise Solution. This includes developing a plan for distributing sensitive information, such as authentication credentials. For more information about BlackBerry Enterprise Solution security, see the BlackBerry Enterprise Solution Security Technical Overview. In addition, refer to the documentation for your Wi-Fi components for recommendations and implementation suggestions. Prerequisites: Configuring layer 2 access security Layer 2 security methods and protocols at the IEEE link layer operate between a Wi-Fi enabled BlackBerry device and a wireless access point on the enterprise Wi-Fi network using encryption alone, or using encryption with user authentication. Component BlackBerry Enterprise Server Version 4.0 or later Requirement See the BlackBerry Enterprise Server Installation Guide for network operating system requirements. Verify that a local or remote BlackBerry Router is installed. Verify that you have configured the required WLAN and VPN settings. wireless access points Verify that all access points comply with the IEEE a, IEEE b, or IEEE g standard. access security using the layer 2 method Verify that you are using one of the supported layer 2 security methods.

20 Wi-Fi Implementation Supplement Component BlackBerry device Using the DNS lookup tool on the BlackBerry device, verify that the BlackBerry device has access to the DHCP server and the DNS server. Prerequisites: Configuring layer 3 VPN access security The Wi-Fi enabled BlackBerry device has a built-in VPN client that supports several VPN concentrators. To create a VPN profile, you configure the VPN client settings (for example, the IP address of the VPN concentrator, user names and passwords, and cryptographic methods used) either on the BlackBerry device directly or using VPN settings or IT policy rules. Depending on the security policy of your organization, you can save each user name and password to the BlackBerry device to prevent the BlackBerry device from prompting the user for credentials the first time (or each time) the BlackBerry device connects to the enterprise Wi-Fi network. You can associate a VPN profile with a WLAN profile so that the VPN profile opens automatically when the WLAN profile starts. Component BlackBerry Enterprise Server Version 4.0 or later Related topic VPN IT policy group Requirement Requirement See the BlackBerry Enterprise Server Installation Guide for network operating system requirements. Verify that you have configured the recommended WLAN and VPN settings. wireless access points Verify that all access points comply with the IEEE a, IEEE b, or IEEE g standard. VPN access security using IPSec VPN Verify that a supported VPN concentrator is installed. BlackBerry device Using the DNS lookup tool on the BlackBerry device, verify that the BlackBerry device has access to the DHCP server and the DNS server. Configuring software tokens BlackBerry Enterprise Server Version 4.1 SP3 or later is designed to work with the RSA Authentication Manager to provide software token support for use with layer 2 and layer 3 authentication on each supported BlackBerry device. The RSA SecurID Library (a cryptographic library) on the BlackBerry device allows a supported BlackBerry device to periodically generate a software token tokencode. The BlackBerry device combines the tokencode with a saved software token PIN that the BlackBerry device user provides as a prefix string to the tokencode to create a passcode for use with a two-factor authentication process on the BlackBerry device. When you configure a software token for a BlackBerry device user, the BlackBerry device is designed to automatically use the passcode to authenticate the BlackBerry device user to WLANs (using PEAPv1, EAP-GTC, and EAP-TTLS/EAP-GTC authentication methods) and VPNs. 20

21 4: Configuring security in your environment You can configure multiple software tokens for a BlackBerry device user. For example, you can configure one software token for use with Wi-Fi authentication and a second software token for use with VPN authentication. When the BlackBerry device user tries to establish a WLAN or VPN connection that requires two-factor authentication on the BlackBerry device, the BlackBerry device prompts the BlackBerry device user to type the software token PIN and submit the current tokencode for that connection type to create the passcode for twofactor authentication. Configuring MAC access control lists Each network client has a unique 48-bit MAC address. To program a MAC ACL, you add the MAC address of every device that is allowed to access a specific enterprise Wi-Fi network (a whitelist) or not allowed to access a specific enterprise Wi-Fi network (a blacklist) to the controller for each wireless access point. Configuring service-specific access security If you do not use layer 2 or layer 3 access security, you can help to protect access to your trusted LAN by installing the BlackBerry Router component in the DMZ, outside your organization s firewall. You can also allow access to the enterprise Wi-Fi network using a captive portal. Component BlackBerry Enterprise Server Version 4.0 or later Requirement See the BlackBerry Enterprise Server Installation Guide for network operating system requirements. Verify that you have applied the required WLAN and VPN settings. wireless access points Verify that all access points comply with the IEEE a, IEEE b, or IEEE g standard. BlackBerry device Verify that the BlackBerry device has access to the DHCP server, if you are not using static IP addresses, and to the DNS server. captive portal login Verify that a captive portal for your organization is configured. Verify that the WLAN Enable Authentication Page option is set to True to allow users to access the captive portal using the WLAN Login browser on the BlackBerry device. Configuring a captive portal A captive portal is a web-based mechanism for an enterprise Wi-Fi network client to authenticate to your organization s Wi-Fi network. The client gains access to the network and is placed in a walled garden using IP filters. A browser request from the client is directed to an HTML login page, which allows the network to authenticate the client before giving access to the network. If your organization has a captive portal, you can permit users to access the captive portal using the Wi-Fi login application on the Wi-Fi enabled BlackBerry device. Users must authenticate to the Wi-Fi login application using the login credentials that you provide. After authenticating to the captive portal, the user can visit other web sites using a web browser on the BlackBerry device. 21

22 Wi-Fi Implementation Supplement 22

23 5 Installing and configuring the BlackBerry Enterprise Server Configuring the BlackBerry Enterprise Server environment Preparing to support Wi-Fi enabled BlackBerry devices Installing the BlackBerry Enterprise Server Adding administrators to roles Verifying that you are ready to install the BlackBerry Enterprise Server BlackBerry Enterprise Server version BlackBerry Enterprise Server Version 4.0.x BlackBerry Enterprise Server Version 4.1.x Messaging environment Microsoft Exchange IBM Lotus Domino Novell GroupWise Microsoft Exchange IBM Lotus Domino Novell GroupWise Document BlackBerry Enterprise Server Installation Guide BlackBerry Enterprise Server Installation Guide Resource Preparing your environment System requirements Configuring the BlackBerry Enterprise Server environment BlackBerry Enterprise Server version BlackBerry Enterprise Server Version 4.0.x BlackBerry Enterprise Server Version 4.1.x Messaging environment Microsoft Exchange IBM Lotus Domino Novell GroupWise Microsoft Exchange IBM Lotus Domino Novell GroupWise Document BlackBerry Enterprise Server Installation Guide BlackBerry Enterprise Server Installation Guide Resource Configure required permissions Configure required network protocols Configuring your environment

24 Wi-Fi Implementation Supplement Preparing to support Wi-Fi enabled BlackBerry devices Component Minimum configuration wireless access point Install the access points for your enterprise Wi-Fi network. installation and configuration If you do not use a switched enterprise Wi-Fi network and you have multiple subnets, configure the subnets to cover the same physical area. The configuration can affect the user experience with calls. Assign an SSID to each access point or to each group of access points that share an SSID. If users will roam between access points, configure all relevant SSID profiles on each access point. If your organization uses NAT traversal, verify that your access points support NAT traversal. access point authentication Set authentication using one of the supported authentication methods. access point encryption Set encryption using one of the supported encryption methods. VPN concentrator (optional) Verify that a supported VPN concentrator is installed. Consult with your organization s firewall or VPN concentrator administrator to determine proper configuration settings. Set the VPN credentials on the BlackBerry device to match the VPN configuration. You can complete this task either manually on the BlackBerry device or using an IT policy (recommended). firewall Open the required ports, as described in Placing the BlackBerry Enterprise Solution in a segmented network. If you use a proxy firewall, configure the proxy to be transparent. ports for Wi-Fi network traffic Configure the following ports for network traffic associated with a Wi-Fi network (the port assignments might vary by mobile network provider): port 4101: from the BlackBerry device to the BlackBerry Router (incoming only; TCP) port 4500: from the BlackBerry device to the mobile network UMA infrastructure (outgoing only using IPSec and TCP) port 500: from the BlackBerry device to the mobile network UMA infrastructure (outgoing only using IPSec and TCP) port 443: from the BlackBerry device to the BlackBerry Router (optional; outgoing only using TCP; used only for direct Wi-Fi connections to the BlackBerry Infrastructure) DHCP server (optional) Configure the DHCP server for use with your enterprise Wi-Fi network. DNS server Verify that the BlackBerry device can access one or more DNS servers. AAA server (optional) Configure the AAA server to support your Wi-Fi authentication method. Authorize all access points for use with the AAA server. BlackBerry user accounts Create authentication credentials for the BlackBerry device user. If you are using EAP-TLS, EAP-TTLS, or PEAP authentication methods, permit access to a PKI infrastructure and certificates. BlackBerry Enterprise Server Install BlackBerry Enterprise Server Version 4.0 or later. If you use the BlackBerry Enterprise Server for Novell GroupWise, and you want the date and time on the BlackBerry device to synchronize from the BlackBerry Router over the mobile network, install BlackBerry Enterprise Server Version 4.0 SP2 or later. If necessary, import the correct IT policy template file. 24

25 5: Installing and configuring the BlackBerry Enterprise Server Installing the BlackBerry Enterprise Server BlackBerry Enterprise Server version BlackBerry Enterprise Server Version 4.0.x BlackBerry Enterprise Server Version 4.1.x Messaging environment Microsoft Exchange IBM Lotus Domino Novell GroupWise Microsoft Exchange IBM Lotus Domino Novell GroupWise Document BlackBerry Enterprise Server Installation Guide BlackBerry Enterprise Server Installation Guide Resource Installing the BlackBerry Enterprise Server Installing the BlackBerry Enterprise Server software Adding administrators to roles BlackBerry Enterprise Server version BlackBerry Enterprise Server Version 4.0.x BlackBerry Enterprise Server Version 4.1.x Messaging environment Microsoft Exchange IBM Lotus Domino Novell GroupWise Microsoft Exchange IBM Lotus Domino Novell GroupWise Document BlackBerry Enterprise Server System Administration Guide Resource Mapping roles in your organization to BlackBerry roles Setting up the BlackBerry Enterprise Server environment BlackBerry Enterprise Server version BlackBerry Enterprise Server Version 4.0.x BlackBerry Enterprise Server Version 4.1.x Messaging environment Microsoft Exchange IBM Lotus Domino Novell GroupWise Microsoft Exchange IBM Lotus Domino Novell GroupWise Document BlackBerry Enterprise Server Administration Guide BlackBerry Enterprise Server System Administration Guide Resource Managing the BlackBerry Enterprise Server Setting up the BlackBerry environment 25

26 Wi-Fi Implementation Supplement 26

27 6 Setting up user accounts on the BlackBerry Enterprise Server Setting up user accounts Adding user accounts Adding user groups Customizing organizer data synchronization Setting up user accounts To set up a user account on the BlackBerry Enterprise Server, you complete the following tasks: add the user account to the BlackBerry Enterprise Server optionally, assign the user account to a group (BlackBerry Enterprise Server Version 4.1 or later) customize organizer data synchronization Adding user accounts BlackBerry Enterprise Server version BlackBerry Enterprise Server Version 4.0.x BlackBerry Enterprise Server Version 4.1.x Messaging environment Microsoft Exchange IBM Lotus Domino Novell GroupWise Microsoft Exchange IBM Lotus Domino Novell GroupWise Document BlackBerry Enterprise Server Administration Guide BlackBerry Enterprise Server Administration Guide BlackBerry Enterprise Server Administration Guide BlackBerry Enterprise Server System Administration Guide Resource Add a user Add a user from a local or foreign domain Adding user accounts Adding user accounts

28 Wi-Fi Implementation Supplement Adding user groups BlackBerry Enterprise Server version BlackBerry Enterprise Server Version 4.0.x BlackBerry Enterprise Server Version 4.1.x Messaging Document Resource environment Microsoft Exchange IBM Lotus Domino Novell GroupWise BlackBerry Enterprise Server System Administration Guide Managing user groups Customizing organizer data synchronization BlackBerry Enterprise Server version BlackBerry Enterprise Server Version 4.0.x BlackBerry Enterprise Server Version 4.1 BlackBerry Enterprise Server Version 4.1 SP2 and Version 4.1 SP3 Messaging environment Microsoft Exchange IBM Lotus Domino Novell GroupWise Microsoft Exchange IBM Lotus Domino Novell GroupWise Microsoft Exchange IBM Lotus Domino Novell GroupWise Document BlackBerry Enterprise Server Administration Guide BlackBerry Enterprise Server System Administration Guide BlackBerry Enterprise Server Administration Guide BlackBerry Enterprise Server System Administration Guide Resource Managing PIM synchronization Turn off or turn on wireless message reconciliation on the server Managing redirection filters Customizing PIM synchronization PIM synchronization Customizing PIM synchronization Organizer data synchronization Customizing organizer data synchronization 28

29 7 Configuring WLAN and VPN settings WLAN and VPN profiles Configuring WLAN and VPN profiles Assigning profiles Managing profiles Managing WLAN and VPN settings using IT policies Configuring and assigning IT policies Configure a Wi-Fi profile manually on the BlackBerry device WLAN and VPN profiles You can use WLAN and optional VPN settings to manage the access and behavior of your user accounts associated with BlackBerry devices that can operate on both mobile and Wi-Fi networks. In BlackBerry Enterprise Server Version 4.1 SP2 or later, you can manage these settings for individual user accounts on a BlackBerry Enterprise Server through WLAN and VPN profiles. You can create and assign one or more WLAN or VPN configuration profiles through the BlackBerry Manager, using a process that is similar to the process for creating an IT policy and assigning it to a user. If a user has a VPN profile, you can associate the profile with the user s WLAN profile. For groups, you assign the settings through WLAN and VPN IT policies. If you run a version of the BlackBerry Enterprise Server previous to Version 4.1 SP2, you manage WLAN and VPN settings through IT policies. Configuring WLAN and VPN profiles You can use configuration profiles to manage WLAN and VPN settings for individual user accounts on BlackBerry Enterprise Server Version 4.1 SP2 or later. Configure a WLAN profile 1. In the BlackBerry Manager, in the left pane, click BlackBerry Domain. 2. On the Global tab, click Edit Properties. 3. Click WLAN Configuration. 4. In the WLAN Configuration Administration section, double-click WLAN Configuration Sets. 5. Click New. 6. Double-click Name.