Prerequisites Guide. Fusion EMM Manage and maintain your IT environment

Transcription

1 Prerequisites Guide Fusion EMM Manage and maintain your IT environment

2 Table of Contents INFORMATION... 3 COPYRIGHTS... 3 DOCUMENT REVISION INFORMATION... 3 ABOUT THIS GUIDE AND WHO SHOULD USE IT... 4 TYPOGRAPHICAL CONVENTIONS... 4 INTRODUCTION... 5 ARCHITECTURE... 6 SYSTEM REQUIREMENTS AND SERVER SIZING... 7 COMPATIBILITY... 8 INSTALLATION PREREQUISITES CHECKLIST... 9 FOR FUSION EMM SERVER INSTALLATION... 9 PORT, SERVICE AND URL S TO WHITE LISTED REQUIREMENTS PORTS QUICK CHART REFERENCE PORTS, SERVICES AND URL S WHITE LISTED EXPLAINED FOR FUSION EMM S ANDROID MDM DOMAIN IDENTITY CONFIGURING ENTERPRISE SERVICE ACCOUNT (ESA) FOR FUSION EMM S APPLE IOS MDM DISCLAIMER Fusion EMM Prerequisites Guide Page 2 of 29

3 Information This document is a user guide and has been written by VXL Software Solutions Pvt. Ltd. The information within this guide is correct at the time this guide was authored, using the version of software available at that time. You may find that there are instances within this guide that vary with the actual version of software you are evaluating or using. We apologize for this and request that you check the VXL website at to see if there are any later revisions or addendums available for download. Every effort has been made to make this guide as complete and as accurate as possible, but no warranty of fitness is implied. The authors and the publisher shall have neither responsibility nor liability to any person or entity with respect to loss or damages arising from the use of information contained in this guide. Copyrights This guide and its contents are the copyright of VXL Software Solutions Pvt. Ltd All rights reserved Information in this document is subject to change without prior notice and does not represent a commitment on the part of the manufacturer. No part of this guide may be reproduced or transmitted in any form or means, electronic or mechanical, including photocopying and recording, for any purpose, without the express written permission of the manufacturer. The VXL Logo, Fusion EMM, Fusion EMM Logo, VXL Software logo are all trademarks and registered trademarks of VXL Software Solutions Pvt. Ltd. All other logos and names are the trademarks and registered trademarks of the respective owners. Document Revision Information Date of release Version number Information 8/12/2016 V1.0 Release of Prerequisites & System requirements for Fusion EMM Fusion EMM Prerequisites Guide Page 3 of 29

4 About this guide and who should use it This document is a user guide explaining prerequisites which are needed to configure for installation of Fusion EMM server. This guide assumes sufficient knowledge of the installation methods used by the operating system the software is installed on. Should you have any doubt on installing the software you should contact your partner or VXL for further assistance. Typographical Conventions This document uses the following typographical conventions: Command and option names appear in bold type in definitions and examples. The names of directories, files, machines, partitions, and volumes also appear in bold. Variable information appears in italic type. This includes user-supplied information on command lines. Screen output and code samples appear in monospace type. In addition, the following symbols appear in command syntax definitions. Square brackets [ ] surround optional items. Angle brackets < > surround user-supplied values. Percentage sign % represents the regular command shell prompt. Pipe symbol separates mutually exclusive values for an argument. Fusion EMM Prerequisites Guide Page 4 of 29

5 Introduction This prerequisite guide has been written with the aim of guiding you through the steps of correctly setting up and installing the Fusion EMM software suite. The architecture and deployment scenarios provided within the guide is an example and you should ensure that you plan the database server construction so that responses from the server are as fast as possible. We have included a System requirements and server sizing section within the guide, should you need to understand the best setup you require. For more technical supported knowledgebase, FAQ S and video tutorials please Fusion EMM Prerequisites Guide Page 5 of 29

6 Architecture Fusion EMM software is based on multi-tier Service oriented architecture (SOA) consisting of Smart client agent, SOAP based messaging framework and web services based middleware. The core application framework is based on web services architecture using SOAP over HTTP(S) protocol, thus inherits & exhibits the robustness, reliability, scalability, security & high availability features over LAN and WAN networks. The software can connect over Wireless (VSAT, GPRS, CDMA, and 3G) & wired networks (Dial up, Broadband & Leased line). The solution consists of following elements: Fusion EMM middleware software (IIS, MS SQL) Fusion EMM administrator GUI software (IIS) Fusion EMM Agent software Fusion EMM Prerequisites Guide Page 6 of 29

7 System Requirements and Server Sizing The following is the recommended server set-up for POC/Testing and for a live production environment for hosting a Fusion EMM installation; POC / Testing Up to 1000 endpoint devices Single Server Up to 2000 endpoint devices Single Server Up to 6000 endpoints devices Single Server Up to endpoint devices All Management suite services hosted on one server OS options: Microsoft 2008 R2 and above CPU: Intel Xeon Dual Core or Intel i7 Quad Core 64-bit processor RAM: 4 GB HDD Sizing: 4 GB of free disk space on 7.2K RPM or faster drives or arrays Database: Microsoft SQL Express, Microsoft SQL All Management Suite Services Hosted on One Server OS options: Microsoft 2008 R2 and above CPU: Intel Xeon Dual Core or Intel i7 Quad Core 64-bit processor RAM: 6 GB min Architecture: Central system, no high availability Average system utilisation <70% Network Adapter: Gigabit Network adapter HDD Sizing: 250 GB of free disk space on 7.2K RPM or faster drives or arrays Database: Microsoft SQL Express, Microsoft SQL All Management Suite Services Hosted on One Server CPU: Intel Xeon Quad Core 64-bit processor RAM: 8 GB min Architecture: Central system, no high availability Average system utilisation <70% Network Adapter: Gigabit Network adapter HDD Sizing: 250 GB of free disk space on 7.2K RPM or faster drives or arrays Database: Microsoft SQL Express, Microsoft SQL Server 1 The IIS Server CPU: Intel Xeon Quad Core 64-bit processors RAM: 16GB Min Network Adapter: Gigabit Network adapter HDD Sizing: 250 GB of free disk space on 7.2K RPM or faster drives or arrays Server 2 - The Database Server CPU: Dual Intel Xeon Quad Core 64-bit processor RAM: 32 GB Min Network Adapter: Gigabit Network adapter HDD Sizing: 500 GB of free disk space on 7.2K RPM or faster drives or arrays Database: Microsoft SQL Full For larger environments than those listed, please refer to server sizing documentation or speak to your VXL representative Fusion EMM Prerequisites Guide Page 7 of 29

8 Compatibility Fusion EMM has been strenuously tested on various different platforms and environments. Software Type Compatibility detail Microsoft Windows 2008 R2 64 bit all (GUI editions) Server OS Microsoft Windows Server 2012 / R2 64bit all (GUI editions) Citrix Xen Desktop, Microsoft Hyper V &VMware virtualized instances of any of the above IIS Version IIS 7.5 for Windows Server 2008 R2; IIS 8.0 for Windows Server 2012.net runtime version Microsoft.NET Framework 4.5 full version ( ) and above Microsoft.NET Framework full version ( ) and above SQL Database: SSL certificate SQL Server 2008, 2012 and its express editions OpenSSL compatible SSL certificate for HTTPS & FTPS communication. Microsoft Internet Explorer version 10.0 & 11.0 and Edge browser 12 and above Admin console Internet browser Mozilla Firefox version 30 and above (for Windows, Linux & Android OS) Google Chrome version 28 and above (for Windows, Linux & Android OS) Apple Safari Browser and above (for Windows, MAC OSX, ios) All devices based upon the below Mobile or Tablet Devices Android OS (Lollipop) Android OS 6.0 (Marshmallow & above) Android OS 7.0 (Nougat) ios versions 4.0 and above Fusion EMM Prerequisites Guide Page 8 of 29

9 Installation Prerequisites Checklist For Fusion EMM Server Installation The installation requires full Administrator user login (local/domain) on the host/server operating system to install the Fusion EMM server application, modules and other components needed. IIS 7.5 or later with following server components included IIS Management Console, IIS Management Scripts and Tools IIS Management Service, Default Document, Directory Browsing, Static Content, HTTP Errors, Static content, HTTP errors, Static content compression and Request filtering. If IIS 8.0 is required, include the optional ASP.net 4.5 component as well. For assistance on Server components install please refer to this section within the guide Microsoft.NET Framework 4.5 full version (For Windows 2008 R2) is required to be installed Downloadable from Microsoft SQL 2008 and above including express editions Downloadable from In addition to although not required we recommend adding the SQL Management tool, should the SQL database require managing; Downloadable from For assistance on MS SQL database configuration please refer to this section within the guide Ports and Service requirements are needed to be adhered to. For assistance on Port and service requirements please refer to this section within the guide. Fusion EMM Prerequisites Guide Page 9 of 29

10 Port, Service and URL s to white listed Requirements To enable Fusion EMM to communicate from the server to endpoint and from the endpoint back to the server, various ports are required to be opened on your firewall. During the install and configuration of Fusion EMM these exceptions are added into the software firewall, but any ports may need to be open on the switch/vlans to allow full uninterrupted communication. Ports quick chart reference Listed below are ALL the ports which Fusion EMM uses; Source Destination Ports TCP/UDP Direction (Uni or Bi) Description Agent Server 443 TCP BI HTTPS Communication Agent Server 21 TCP Uni For Normal FTP(FTP) Agent Server 990 TCP Uni For Secure FTP(FTPS) Agent Server 5500 TCP Uni For VNC (Used by Fusion EMM Agent) Agent Server 5901 TCP Uni For VNC (Used for connection) Server Server 1433 TCP Uni For SQL Connection Listed below are ADDITIONAL ports which are used by Fusion EMM s Source Destination Ports TCP/UDP Direction (Uni or Bi) Description Server Apple Cloud 2195,2196 TCP BI Used by Profile Manager to send push notifications Server Apple Cloud 5223 TCP BI Used to maintain a persistent connection to APNs and receive push notifications. MDM Device Server 1640 TCP Uni Enrollment access to the Certificate Authority. Server ios 5228,5229,5230 TCP Uni For GCM to reach Fusion EMM server. Outbound from Corporate Network Firewall. Fusion EMM Prerequisites Guide Page 10 of 29

11 Ports, Services and URL s white listed explained HTTPS Port if you are doing a secure SSL installation of Fusion EMM server URL s to be whitelisted for Google and Apple certificate: Gatway.push.apple.com Admin.google.com Fusion EMM Prerequisites Guide Page 11 of 29

12 For Fusion EMM s Android MDM. The below prerequisites are required for administrators to monitor, manage, audit, and secure corporate data on Android mobile/tablet devices. Firstly, you need to complete the process of Google claimed customer Domain You need to create and configure customer enterprise service account (ESA) from Google developer Console, as per instructions mentioned in Fusion EMM administrator s user guide. Obtain the ESA ID, generate the OAuth secret key (.json) file for web application and generate (.json) file for directory api service account. Create/claim EMM token using the Google admin console. In case of bulk license management, Google apps subscription for concern customer is required. In case of private apps deployment, a play store publisher account is required for concerned customer domain. Android devices recommended minimum OS version onwards. The devices should also consist of the following OEM pre-installed system packages for BYOD/work profile support: android.software.managed_users, android.software.device_admin. List of officially supported devices are available at NOTE: For assistance configuring mobile device management please refer to the Administrator guide Fusion EMM Prerequisites Guide Page 12 of 29

13 Domain Identity Register Managed Domain Registration Process Step 1: Admin enters basic business contact information Step 2: Admin enters basic information about the business Business name Address Number of Employees Step 3: Create Admin Account Admin creates the account for the Managed Domain Fusion EMM Prerequisites Guide Page 13 of 29

14 Step 4: Finishing account creation. Verify Domain Ownership Admin verifies Domain ownership Option 1: Add Meta tag to corporate homepage Google verifies by scanning homepage Option 2: Add a TXT or CNAME record to domain s DNS Google verifies by checking DNS records Option 3: Add an HTML file to root of company s website Google verifies by scanning the company website Fusion EMM Prerequisites Guide Page 14 of 29

15 Generate EMM API Token Generated for binding to Customers EMM Provider Enables Android for Work management via API s Allows management of ONLY specific Managed Domain devices Configuring Enterprise Service Account (ESA) Creation & configure customer Enterprise Service Account (ESA) from Google developer console. Sign in using your administrator account (does not end Fusion EMM Prerequisites Guide Page 15 of 29

16 Step 1 - Create the project Register your application for Admin SDK in Google API Console. Google API Console allows you to manage your application and monitor API usage. Create a project where your application will be registered you can use one project to manage all of your applications, or you can create a different project for each application. To add the project, navigate to: Google API -> Project dropdown -> Create project. Here, we enter the Project name. Step 2 - Enable APIs for the project To get started using Admin SDK, you need to first use the setup tool, which guides you through creating a project in the Google API Console, enabling the API, and creating credentials. 1. On the developer s console page, go to API Manager. 2. Then go to Library. 3. Search and Enable APIs required for your project. The following APIs need to be enabled: Google Play EMM API Admin SDK Android Device Verification API App Engine Admin API Big Query API List of the enabled APIs will be displayed in Dashboard section. Fusion EMM Prerequisites Guide Page 16 of 29

17 To enable the API, click on ENABLE button. After we enable a particular API, the button gets changes to DISABLE. Step 3 - Working with credentials You need credentials to access the APIs. Depending on the API, you need an API key, a service account or an OAuth 2.0 Client ID Creation of Service account key: Service account key enables server-to-server, app-level authentication using robot accounts Service account addition: To set up a new service account, do the following: 1. If the API Manager page isn't already open, open the console menu and select API Manager. 2. On the left, click Credentials. 3. Click Create credentials > and select Service account key. 4. On the create service account key form, click New Service account. 5. Enter the service account name and select the role as Project > Owner. 6. A service account id name will be automatically generated. 7. Click Create to generate a service account. Fusion EMM Prerequisites Guide Page 17 of 29

18 8. Your new public/private key pair (Service JSON) is auto-generated and downloaded to your machine. This information is required for configuring Fusion MDM. Please save this information in a separate folder. Important: It serves as the only copy of this key, so it is highly recommended to store it securely Domain Verification: You need to verify domain ownership to allow web hook notifications to be sent to your external domains. Google verifies that the user owns each of the listed domains via Search Console. 1. Domain Verification > Add Domain. Enter the name of the domain. 2. After successful addition of domain name, the entered domain gets listed on the Google console OAuth consent screen: If this is your first time creating a client ID, you can configure your consent screen by clicking OAuth consent screen. You won't be prompted to configure the consent screen after you do it the first time. Fusion EMM Prerequisites Guide Page 18 of 29

19 3.1.4 Domain-wide delegation 1. One last step remaining in Service account section. 2. Navigate to API Manager > Credentials. Next to Service accounts, click on Manage service accounts. The service accounts form will be displayed. 3. Find the service name you ve created previously. Click on the Options button next to it and select Edit. 4. On the Edit service account form, select the checkbox against Enable Domain-wide delegation. Click on Save to save the changes Creation of OAuth client ID: This id requests user consent so that an app can access user s data. To create an OAuth 2.0 client ID in the console: Fusion EMM Prerequisites Guide Page 19 of 29

20 1. If the API Manager page isn't already open, open the console menu and select API Manager. 2. On the left, click Credentials. 3. Click New Credentials, then select OAuth client ID. 4. Select the application type as Web application for project and enter any additional information as required. 5. Enter the OAuth client ID name. 6. Authorized JavaScript origins: For use with requests from a browser. This is the origin URI of the server/client application. (e.g.: 7. Authorized redirect URIs: For use with requests from a web server. This is the path in your application that users are redirected to after they have authenticated with Google. The path will be appended with the authorization code for access. Must have a protocol. Cannot contain URL fragments or relative paths. Cannot be a public IP address. Recommended urls are as follows (e.g. with edit URLs) a. b. c. d Click Create to create the Client ID. 9. Now, a Client JSON file is automatically generated which can be downloaded by clicking the Download JSON button on top of the page. 10. Along with the Client JSON, we also have a Client secret key listed below it. Fusion EMM Prerequisites Guide Page 20 of 29

21 This Client JSON & Client secret key information is required for configuring Fusion MDM. Please save this information in a separate folder API Key generation: Identifies your project using a simple API key to check quota and access. To create an API key in the console: 1. If the API Manager page isn't already open, open the console menu and select API Manager. 2. On the left, click Credentials. 3. Click New Credentials, then select API key. 4. On the create new key form, click on Server key. 5. Enter the name for the API key. 6. Click Create to generate the API Key. This API key should also be kept secret and is required for configuring Fusion MDM. Please save this information in a separate folder. Fusion EMM Prerequisites Guide Page 21 of 29

22 Important: It may take up to 1 hour for settings to take effect Project ID: The project we have created has an ID associated with it. 1. In order to retrieve the ID of the project, navigate to API manager, then click on Credentials. 2. Under the Service account keys section, click on Manage service accounts. 3. From the left menu, click on Settings. 4. On the Settings page, the Project number will be our required Project ID. This Project ID information is required for configuring Fusion MDM. Please save this information in a separate folder. With the above steps, our configuration on Google developer console is completed. Step 4 - Managing APIs We now move on to Google admin console. Sign in to with the same mail id which was used to login previously in Google developer console. The service account that you created needs to be granted access to the Google Apps domain s user data that you want to access. The following tasks have to be performed by an administrator of the Google Apps domain: 1. Click on Security > Show more > Advanced Settings > Manage API Client Access. Fusion EMM Prerequisites Guide Page 22 of 29

23 Manage API Class Access: API class access allows admins to control access to user data by applications that use OAuth protocol. Here, we require two things: 1. Client Name - Authorized API clients. Your client name will be the Client key generated previously on Google developer console. Navigate to Google developer console page. Then from left menu, go to API Manager > select Credentials. In the OAuth 2.0 client IDs section, click on the Client name you ve previously created. The Client ID on this page will be required. Copy the client ID and paste it into the Google admin page > Manage API Client Access > Client name section. 2. API scopes - API client domains are registered with Google and authorized to access data for your users. You can directly use the following links as API scopes which are recommended: Fusion EMM Prerequisites Guide Page 23 of 29

24 Copy the above links all together and paste them in API scopes section. 4. Click on Save to save your settings. Your service account now has domain-wide access to the Google Admin SDK Directory API for all the users of your domain. You are ready to instantiate an authorized Admin SDK Directory service object on behalf of your Google Apps domain's users. Step 5 - Working with Service account & Tokens 4.1 Service account A service account's credentials include a generated address that is unique, a client ID, and at least one public/private key pair. If your application runs on Google App Engine, a service account is set up automatically when you create your project. If your application doesn't run on Google App Engine or Google Compute Engine, you must obtain these credentials in the Google Developers Console. 1. In order to retrieve the ID of the project, navigate to API manager, then click on Credentials. 2. Under the Service account keys section, click on Manage service accounts. 3. Select the service account name that we have created previously. 4. The value in the Service account ID column against that service account name is our required Service Account This Service account will be required further in MDM Configuration process. Fusion EMM Prerequisites Guide Page 24 of 29

25 5.2 - Generating the token: Part of binding your third-party provider involves sharing your company s EMM token with the provider. After you generate a token, you have 30 days to share it. If the token expires, you have to generate a new one. 1. Sign in to the Google Admin console as a super administrator to generate an EMM token or see an unexpired one. 2. Click Security > Android for Work Settings. Copy the token (a string of characters) or click Generate Token to generate a new token. Fusion EMM Prerequisites Guide Page 25 of 29

26 Important: When a new token is generated, copy the token and save it as a token once generated cannot be retrieved again. After successful enrolment with MDM Configuration, the service account used for configuration is only displayed on Google admin console. In General Settings section, the checkbox against the Enforce EMM policies on Android devices is unchecked by default. Make sure you have checked the checkbox. Fusion EMM Prerequisites Guide Page 26 of 29

27 You can't view previously generated token or generate a new token. A new token can only be generated when the MDM Configuration is unenrolled from the server. Fusion EMM Prerequisites Guide Page 27 of 29

28 For Fusion EMM s Apple ios MDM. 1. Apple ID is required for Push certificate generation. Refer to below link to know more about creating a new apple id Optional DEP & VPP enrolment for supervised device management. Refer to the below link: Fusion EMM Prerequisites Guide Page 28 of 29

29 Disclaimer Installation Guide Published on 8 th Dec 2016 Last Updated on 8 th Dec 2016 Document Version 1.0 Documentation Disclaimer Screenshots and graphics in this manual may differ slightly from your product due to differences in your product release version or your computer operating system. Reasonable efforts were made to ensure that the information in this document was complete and accurate. VXL Software Solutions Pvt. Ltd. assumes no liability for any errors. Changes and corrections to the information in this document may be incorporated in future releases. Copyright VXL Software Solutions Pvt. Ltd. Information in this document is subject to change without prior notice and does not represent a commitment on the part of the manufacturer. No part of this guide may be reproduced or transmitted in any form or means, electronic or mechanical, including photocopying and recording, for any purpose, without the express written permission of the manufacturer. Registered trademarks are properties of their respective owners. Every effort has been made to make this guide as complete and as accurate as possible, but no warranty of fitness is implied. The authors and the publisher shall have neither responsibility nor liability to any person or entity with respect to loss or damages arising from the use of information contained in this guide. Trademarks The VXL Logo, Fusion EMM, Fusion EMM Logo, VXL Software logo are all trademarks and registered trademarks of VXL Software Solutions Pvt. Ltd. All other logos and names are the trademarks and registered trademarks of the respective owners. VXL Support To access our support systems please navigate to and log a ticket. VXL Software Solutions Pvt. Ltd. 241/242, Solitaire Corporate Park, Chakala, Andheri(E), Mumbai Fusion EMM Prerequisites Guide Page 29 of 29