Setting up the Sophos Mobile Control External EAS Proxy

Transcription

1 Setting up the Sophos Mobile Control External EAS Proxy

2 Setting up the External EAS Proxy This document tries to explain the concept of the Sophos Mobile Control External EAS Proxy which is available for download on Sophos.com and which can be installed separately. The requirements for the environment to use the EAS Proxy depend on the usage scenario. Possible scenarios, their requirements and installation steps are described below. This document only covers general environment requirements and does not cover explicit configuration steps for instances involved, e.g. reverse proxy, load balancer or Exchange server. Table of Contents 1. When is it required? Differences between the built-in and the External EAS Proxy How does it communicate with the SMC server? Usage scenario examples and environment requirements SMC and single External EAS proxy instance on different machines... 4 SMC server setup... 4 External EAS Proxy setup... 4 Environment requirements... 6 Advantages & Disadvantages SMC and single standalone EAS proxy on different machines behind a Reverse Proxy... 7 SMC Setup... 7 External EAS Proxy Setup... 7 Environment requirements... 8 Advantages & Disadvantages SMC and multiple standalone EAS proxy instances on different machines SMC Setup External EAS Proxy Setup Environment requirements Advantages & Disadvantages SMC and load balanced EAS proxies SMC Setup External EAS Proxy setup Environment requirements Advantages & Disadvantages... 16

3 1. When is it required? The external EAS Proxy should be used if one of the following scenarios applies: - If more than 300 devices should get s via the Sophos Mobile Control EAS Proxy - You use Lotus Traveler for non-ios devices - You want to support multiple backend servers - You want to set up load balancing for Exchange ActiveSync traffic 2. Differences between the built-in and the External EAS Proxy The built-in and External EAS Proxy differ in the used technology. For the built-in EAS Proxy a maximum of 2000 parallel connections is possible which depleted by 400 devices being registered on the SMC server as each device can open several connections to the SMC server. This limitation does not exist for the External EAS Proxy. Furthermore, the built-in EAS Proxy can handle only traffic for one server whereas the External EAS Proxy can handle connections to different servers using so called instances. Every instance listens on one specific port and forwards traffic to the server configured for that instance after device compliance is verified. 3. How does it communicate with the SMC server? The external EAS Proxy connects to the SMC server using the external URL of the SMC server. This connection is needed to get the access status for the devices which try to connect to the SMC server. If a device is allowed to receive the EAS Proxy caches the status for 10 minutes. If the device is not allowed to receive , this status is saved for 30 seconds. Once a timer expired, the EAS Proxy will ask for the status again. The communication is secured using a client certificate which is created during the creation of an instance within the External EAS Proxy. Those client certificates have to be uploaded to the Sophos Mobile Control server using the super administrator account. By uploading the client certificate to the SMC server, the SMC server and the EAS Proxy instance can create a secured connection to exchange data. If the SMC Server is not available, the EAS Proxy will continue to work for 60 minutes using the last known status of each device.

4 4. Usage scenario examples and environment requirements The External EAS Proxy can be used in many different ways. This chapter tries to explain the most common scenarios and the requirements for each scenario. A combination of the scenarios is also possible but not explained in that guide SMC and single External EAS proxy instance on different machines In this scenario it is assumed that the SMC server and the External EAS Proxy are installed on two separate machines. This might be required if different URLs should be used and the SMC server should not handle the load the traffic of the devices is causing. Furthermore, both components could use port 443 to communicate with the devices. Note: If you want to implement that scenario think about the URL the External EAS Proxy should be accessible from outside the network. This URL will be used within a Sophos Mobile Control configuration profile and by the devices to synchronize s. In this example, eas.company.com is used. SMC server setup The SMC server itself uses the URL smc.company.com. The certificate used for the SMC server URL smc.company.com can either be self-signed and created by the SMC setup or an officially certificate signed by a Certification Authority. An officially signed certificate is generally recommended and required if you want to manage Android devices. External EAS Proxy setup The External EAS Proxy is installed on a separate machine and uses a certificate to support incoming SSL traffic by the mobile devices. Therefore, a web server certificate was created for the URL eas.company.com and imported during the setup of the External EAS Proxy. A certificate signed by an official Certification Authority is recommended. Furthermore, one instance was created listening

5 on port 443 and forwarding all traffic to the server within the environment - in that case, exchange.company.com. After configuring the instance the following information pop up appears. After clicking on OK an explorer window will appear showing the client certificate located in C:\Program Files\Sophos\Sophos Mobile Control EAS Proxy\config\1\export. This certificate has to be uploaded to the SMC server. To do so, log in to the Sophos Mobile Control web console using super administrator credentials. Go to Settings System Setup and switch to the EAS Proxy tab. In there, press the browse button and choose the certificate you were directed to.

6 After selecting the file and pressing Open, press the Upload button. Once uploaded do not forget to press the Save button to confirm the changes. With uploading the certificate the EAS Proxy instance is able to successfully connect to the SMC server and get the access status of devices. Now you can start the EAS Proxy service Environment requirements To successfully use this scenario an external DNS entry for your designated External EAS Proxy URL eas.company.com is required. Further requirements do not exist for this scenario. Advantages & Disadvantages Advantages: - Traffic load separated between SMC server and EAS Proxy, - Separate URL for Exchange ActiveSync traffic, Disadvantages: - Higher costs for official certificates for SMC- & EAS-Proxy-URL - EAS Proxy blocks port 443 completely on the installed operating system - Two external DNS entries required

7 4.2. SMC and single standalone EAS proxy on different machines behind a Reverse Proxy In this scenario it is assumed that the SMC server and the External EAS Proxy are installed on two separate machines. However, both should use the same URL. A certificate signed by an external Certification Authority exists for the server URL smc.company.com. Note: In this scenario it is assumed that the Reverse Proxy splits the SSL connection and initiates a new one to the internal network resources. SMC Setup The SMC server itself should be accessible using the external URL smc.company.com. The certificate used for the SMC server should be self-signed and created by the SMC setup covering the internal DNS name of the SMC server. External EAS Proxy Setup The External EAS Proxy is installed on a separate machine and uses the same self-signed certificate as the SMC server. Furthermore, one instance was created listening on port 81 and forwarding all traffic to the server within the environment - in that scenario, exchange.company.com. Once the instance was created on the EAS Proxy, the client certificate has to be uploaded to the SMC server to enable communication between the servers. After configuring the instance the following information pop up appears.

8 After clicking on OK an explorer window will appear showing the client certificate located in C:\Program Files\Sophos\Sophos Mobile Control EAS Proxy\config\1\export. This certificate has to be uploaded to the SMC server. To do so, log in to the Sophos Mobile Control web console using super administrator credentials. Go to Settings System Setup and switch to the EAS Proxy tab. In there, press the browse button and choose the certificate you were directed to. After selecting the file and pressing Open, press the Upload button. Once uploaded do not forget to press the Save button to confirm the changes. With uploading the certificate the EAS Proxy instance is able to successfully connect to the SMC server and get the access status of devices. Now you can start the EAS Proxy service. Environment requirements To successfully implement this scenario, a Reverse Proxy is required in front of the SMC Server and EAS Proxy. The Reverse Proxy must use the officially signed certificate of smc.company.com for

9 incoming traffic for the SMC server and EAS Proxy. Furthermore, two path forwarding rules must be created to forward SMC and EAS related traffic correctly. All traffic coming in for smc.company.com/microsoft-server-activesync has to be forwarded to port 81 of the server hosting the EAS Proxy. All other traffic for smc.company.com/* has to be forwarded to port 443 of the SMC server itself. The table below summarizes the required configuration on the Reverse Proxy, assuming the SMC server uses the internal hostname smc.internal.com and the EAS Proxy the name easproxy.internal.com. Incoming URL Reverse Proxy Action Destination smc.company.com/microsoft-server- Forward traffic to EAS instance easproxy.internal.com:81 ActiveSync smc.company.com/* Forward traffic to SMC server smc.internal.com:443 To successfully establish an SSL connection, it might be required for the Reverse Proxy that the CA certificate of the self-signed certificate created during the SMC setup has to be uploaded. This CA certificate can be found in the folder %MDM_HOME%\tools\Wizard\certs on the Sophos Mobile Control server and is called ca_cert.crt. Advantages & Disadvantages Advantages: - Less load on the SMC server - Only one officially signed certificate required - Only one external DNS entry required Disadvantages: - Higher implementation effort / costs

10 4.3. SMC and multiple standalone EAS proxy instances on different machines Within this scenario several Exchange Servers exist within the environment e.g. in different locations. All traffic should go via the SMC EAS Proxy and is forwarded to the necessary server accordingly. Each EAS Proxy instance should be accessible via a separated URL. The SMC Server itself is installed on a separate machine. A wildcard certificates exists for the URL *.company.com and is used on the Reverse Proxy. Note: In this scenario it is assumed that the Reverse Proxy splits the SSL connection and initiates a new one to the internal network resources. SMC Setup The SMC server itself is accessible via the external URL smc.company.com. The certificate used for the SMC server should be self-signed and created during the SMC setup covering the internal DNS name of the SMC server e.g. smc.internal.com. External EAS Proxy Setup The certificate used for the EAS Proxy should be self-signed and created during the EAS Proxy setup. It should cover the internal DNS name of the SMC server. Four instances were created listening on the ports 81, 82, 83 and 84. Every instance is configured to forward the traffic to a different server - in that case, exchange1, exchange2, exchange3 and exchange4.

11 After configuring each of the instances the following information pop up appears: After clicking on OK an explorer window will appear showing the client certificate located in C:\Program Files\Sophos\Sophos Mobile Control EAS Proxy\config\X\export, while X is the number of the instance you have created. So if you have created four instances, you will have four different folders. The instance certificates located in the export folders have to be uploaded to the SMC server. To do so, log in to the Sophos Mobile Control web console using super administrator credentials from the server where the EAS Proxy is installed. Go to Settings System Setup and switch to the EAS Proxy tab. In there, press the browse button and choose the certificate you were directed to.

12 After selecting the file and pressing Open, press the Upload button. Once uploaded do not forget to press the Save button to confirm the changes. With uploading the certificates the EAS Proxy instances are able to successfully connect to the SMC server and get the access status of devices. Now you can start the EAS Proxy service. Environment requirements To successfully implement this scenario, a Reverse Proxy is required in front of the SMC Server and EAS Proxy. The Reverse Proxy must use the officially signed wildcard certificate for *.company.com. Furthermore, an external DNS entry for each of your designated External EAS Proxy URLs eap1.company.com, eap2.company.com, eap3.company.com and eap4.company.com is required. On the Reverse Proxy, five path forwarding rules must be created to forward SMC and EAS related traffic correctly. All traffic for smc.company.com has to be forwarded to port 443 of the SMC server itself. The table below summarizes the required configuration on the Reverse Proxy, assuming the SMC server uses the internal computer name smc.internal.com and the EAS Proxy the name easproxy.internal.com.

13 Incoming URL Reverse Proxy Action Destination eap1.company.com Forward traffic to EAS instance easproxy.internal.com:81 eap2.company.com Forward traffic to EAS instance easproxy.internal.com:82 eap3.company.com Forward traffic to EAS instance easproxy.internal.com:83 eap4.company.com Forward traffic to EAS instance easproxy.internal.com:84 smc.company.com/* Forward traffic to SMC server smc.internal.com To successfully establish an SSL connection, it might be required for the Reverse Proxy that the CA certificate of the self-signed certificate created during the SMC setup has to be uploaded. This CA certificate can be found in the folder %MDM_HOME%\tools\Wizard\certs on the Sophos Mobile Control server and is called ca_cert.crt. Advantages & Disadvantages Advantages: - Less load on the SMC server - Every instance has a separate URL, more detailed SMC profile configuration possible Disadvantages - Highest implementation effort - High costs for wildcard certificate

14 4.4. SMC and load balanced EAS proxies Within this scenario it is assumed that two EAS proxies should be used to handle the traffic. To distribute the traffic between the two proxies, a load balancer is placed in front of the EAS Proxies. Two URLs should be used in that scenario - one for the EAS Proxies and one for the SMC server. Note: In this scenario, it is assumed that the load balancer does not inspect or split the SSL traffic. SMC Setup The SMC Server is set up using a certificate signed by an official certification authority. The server uses the URL smc.company.com. External EAS Proxy setup The two EAS Proxies are installed on separate machines. Both Proxies should use one officially signed certificate. Therefore, a web server certificate was created for the URL eas.company.com. It has to be used by both EAS Proxies and imported during the EAS Proxy setup. During the configuration one instance was created was created on both EAS Proxies listening on port 81 and forwarding the traffic to the Exchange server exchange.internal.com.

15 After configuring the instance the following information pop up appears. After clicking on OK an explorer window will appear showing the client certificate located in C:\Program Files\Sophos\Sophos Mobile Control EAS Proxy\config\1\export. The certificates of both EAS Proxy instances have to be uploaded to the SMC server. To do so, log in to the Sophos Mobile Control web console using super administrator credentials. Go to Settings System Setup and switch to the EAS Proxy tab. In there, press the browse button and choose the certificate you were directed to. After selecting the file and pressing Open, press the Upload button. Once uploaded do not forget to press the Save button to confirm the changes. Once both certificates were uploaded the EAS Proxy tab should look similar to this:

16 With uploading the certificate the EAS Proxy instance is able to successfully connect to the SMC server and can verify the access status of devices. Now you can start the EAS Proxy service Environment requirements To implement this scenario, two external DNS entries must exist. One is required for the SMC server itself (e.g. smc.company.com ), and one for the EAS Proxy URL (e.g. eas.company.com ). All traffic for the SMC server URL is directly routed to the actual SMC server. Traffic for the URL easproxy.company.com/microsoft-server-activesync is accepted by the load balancer. The load balancer has to be configured that way, that it forwards the traffic to one of the two EAS Proxies using either the IP or the internal name. Assuming the EAS Proxies use the name EAS1.internal.com and EAS2.internal.com, the required routing configuration would look like that: Incoming URL Routing action Destination eas.company.com Load balancer forwards traffic to EAS EAS1.internal.com:81 Proxy 1 eas.company.com Load balancer forwards traffic to EAS EAS2.internal.com:81 Proxy 2 smc.company.com Traffic is directly routed to the SMC server smc.internal.com Advantages & Disadvantages Advantages: - Higher reliability in case one EAS Proxy is not available - Less load on the SMC server Disadvantages: - High costs to implement