MaaS360 On-Premises Cloud Extender...5 MaaS360.com+ System Requirements for the Cloud Extender for...

MaaS360.com

MaaS360 On-Premises Cloud Extender Installation Guide

2

MaaS360.com

Copyright © 2014 Fiberlink Communications Corporation. All rights reserved.

Information in this document is subject to change without notice. The software described in this document is furnished under a license agreement or nondisclosure agreement. The software may be used or copied only in accordance with the terms of those agreements. No part of this publication may be reproduced, stored in a retrieval system, or transmitted in any form or any means electronic or mechanical, including photocopying and recording for any purpose other than the purchaser’s personal use without the written permission of Fiberlink Communications Corporation.

All brands and their products are trademarks or registered trademarks of their respective holders and should be noted as such.

Fiberlink Communications Corporation

1787 Sentry Parkway West

Blue Bell, PA 19422

Jan 2014

Revision 7

002

3

MaaS360.com

Table of Contents

Introduction .................................................................................................................. 4 General Requirements ................................................................................................. 4 System Requirements for the Cloud Extender for Microsoft Exchange ActiveSync Module .................. 5 System Requirements for the Cloud Extender for User Authentication and User Visibility Modules ....... 6 System Requirements for the Cloud Extender for IBM Lotus Traveler Module ................................. 6 System Requirements for the Cloud Extender for BlackBerry Enterprise Server Module .................... 7 What is the MaaS360 Cloud Extender for Certificate Services? .................................................. 8

Installing and Configuring the Cloud Extender ......................................................................... 10 Visibility Service ......................................................................................................... 10 MaaS360 Cloud Extender Configuration Tool ....................................................................... 13

Appendix A: Other Modules ................................................................................................ 26 Lotus Traveler Manager in the Cloud Extender Configuration Tool ............................................. 26 BlackBerry Enterprise Server integration in the Cloud Extender Configuration Tool ......................... 27 Exchange 2010/2013 Integration in the Cloud Extender Configuration Tool .................................. 28 Office 365 Integration in the Cloud Extender Configuration Tool ............................................... 30 BPOS-D Integration in the Cloud Extender Configuration Tool ................................................... 31 Certificate Integration in the Cloud Extender Configuration Tool .............................................. 33

Appendix B: Troubleshooting .............................................................................................. 35 Microsoft Exchange Activesync ........................................................................................ 35 IBM Lotus Traveler ...................................................................................................... 35 BlackBerry Enterprise Server .......................................................................................... 36

4

MaaS360.com

Introduction The MaaS360 Cloud Extender can be downloaded from MaaS360 portal. The Cloud Extender is an executable, and once installed will automatically launch the MaaS360 Cloud Extender Configuration Tool. This tool can also be executed manually by an administrator after installation by using the shortcut All Programs/MaaS360/MaaS360 ActiveSync Configuration Utility.

General Requirements

Before beginning the installation, make sure the following requirements are met:

Item Meets Requirement

Physical or Virtual Machine with Windows Server 2008 RC2, 2008, or 2003 as an installation target for the Cloud Extender software (see the Release Notes). You can also use Windows XP or Windows 7, but they are not recommended for use in a Production environment.

Note: The Cloud Extender can be installed directly on the Exchange Server or Active Directory Server, but this is not recommended.

Access to the services virtual machine URL from the Cloud Extender machine. This is the URL that is configured during setup on the MaaS360 instance.

You should receive either the message “1234567890” or a blank page when the URL is referenced from a browser.)

5

MaaS360.com

System Requirements for the Cloud Extender for Microsoft Exchange ActiveSync Module The MaaS360 Cloud Extender is a small program that runs as a service on a Microsoft Windows machine in your network. The Cloud Extender creates an outbound connection over HTTPS to the MaaS360 portal that is used as a bi-directional communication facility and allows the MaaS360 portal to integrate with your Exchange Server. It performs the following functions:

• Uses Microsoft PowerShell commands to query the Exchange Server for vital information related to the ActiveSync enabled devices on the Exchange Server.

• Processes device and policy information and transmits it to the MaaS360 portal for reporting and management functions.

• Receives information from the MaaS360 portal including:

• ActiveSync policies • Device visibility • Device actions • Policy assignments

• Uses Microsoft PowerShell commands to execute policy assignments and actions.

• Uses Microsoft PowerShell commands to query the Exchange Server for vital information related to the ActiveSync enabled devices on the Exchange Server.



• ActiveSync policies

• Device visibility

• Device actions

• Policy assignments

• Uses Microsoft PowerShell commands to execute policy assignments and actions.

The MaaS360 Cloud Extender requires that it be configured with an account with sufficient rights to run as a service and to access Exchange Servers.


Exchange Server 2007, 2010, or 2013; Office 365; BPOS-D

Domain User and Exchange Organization Administrator (2007), Organization Management (2010/2013), Global Administrator (O365) Access Rights

Local Admin access is required on the machine the Cloud Extender is installed on.

Exchange 2007 only: Exchange Management Tools (The tools version must match the service pack version of the Exchange server itself).

Windows PowerShell Version 2 or higher

6

MaaS360.com

System Requirements for the Cloud Extender for User Authentication and User Visibility Modules MaaS360 Active Directory integration provides customers with the ability to leverage their existing corporate directory information as they manage devices. Administrators can choose to use Active Directory to authenticate enrollment requests and to place users into logical groupings to streamline the application of policies, actions and rules.

The MaaS360 Active Directory integration capability is an optional component that can be configured to provide the following:

• Device Authentication

• Access Group information

The MaaS360 Cloud Extender for Active Directory integrates with your Active Directory Server to provide the necessary interaction.



Domain User Access Rights

Local Admin access is required on the machine the Cloud Extender is installed on.

Windows PowerShell Version 2 or higher

System Requirements for the Cloud Extender for IBM Lotus Traveler Module

The MaaS360 Cloud Extender is a small program that runs as a service on a Microsoft Windows machine in your network. The Cloud Extender creates an outbound connection over HTTPS to the MaaS360 portal that is used as a bi-directional communication facility and allows the MaaS360 portal to integrate with your Lotus Traveler Server. It performs the following functions:



• Device visibility • Device actions

The MaaS360 Cloud Extender requires that it be configured with an account with sufficient rights to run as a service and to access Traveler Servers.



Lotus Domino 8.5.2 or greater

Lotus Traveler 8.5.2 or greater

The Cloud Extender must be installed on a machine that has the

7

MaaS360.com


Notes client installed.

A Domino account and credentials with sufficient rights to perform Domino/Traveler Admin functions. You should have at least access level of Server Remote Admin, Manager w/ delete access to Traveler.nsf.

.NET 3.5 or higher

System Requirements for the Cloud Extender for BlackBerry Enterprise Server Module The MaaS360 Cloud Extender is a small program that runs as a service on a Microsoft Windows machine in your network. The Cloud Extender creates an outbound connection over HTTPS to the MaaS360 portal that is used as a bi-directional communication facility and allows the MaaS360 portal to integrate with your BlackBerry Enterprise Server. It performs the following functions:



• Device visibility • Device actions • Policy assignments • Device Activation

• Uses BlackBerry Administration Service and APIs commands to execute policy assignments and actions

• Performs Device Activation using BES APIs

The MaaS360 Cloud Extender requires that it be configured with a BlackBerry Administrator Account with sufficient rights to run as a service and to access run the Administrator APIs.



BlackBerry Enterprise Server version 5.0 and above

BlackBerry Administrator Account with the following details:

• Supported Authentication Types

• Exchange: Active Directory, BlackBerry Administration Account (Local Account)

• Domino: BlackBerry Administration Account (Local Account)

• Administrator Account should have the following access rights:

• Following pre-defined BES Roles can be used:

� Security Manager

8

MaaS360.com


The service account under which the Cloud Extender will operate should have HTTPS access to the APIs.

BlackBerry Administrator APIs installed on the server that hosts the BlackBerry Administrative Console (BES 5.0 SP1 and above preinstalls these automatically).

.NET 3.5 or higher.

What is the MaaS360 Cloud Extender for Certificate Services? MaaS360 Certificate Services Integration provides customers with the ability to leverage their existing Certificate Authority (CA) and auto-provision User Certificates to enrolled iOS Devices. Administrators can create E-mail, Wi-Fi, and VPN policies & profiles that can use User based Certificates for authentication. The Cloud Extender interacts with Certificate Authority, and pushes the issued certificates down to enrolled iOS devices. It performs the following functions:

• Processes User Certificate requests from MaaS360 when the users enroll their iOS devices against a policy that requires User Certificates.

• Authenticates against the Certificate Authority (CA) / Registration Authority (RA) before requesting for Certificates.

• Requests User Certificates on behalf of enrolled iOS devices.

• Encrypts the issued User Certificates and uploads the same to MaaS360.

• MaaS360 then pushes these certificates to these devices.

• Cloud Extender can integrate with Microsoft CA installed on 2003 or 2008R2 and Symantec Managed PKI.

The MaaS360 Cloud Extender requires that it be configured with a Certificate Template with information regarding the CA server, and administrative credentials to authenticate and request device certificates.

9

MaaS360.com

Certificate Service Integration Requirements Checklist



Microsoft: Administrative Access to Microsoft Certificate Authority (CA) Server

Symantec: Administrative Access to Symantec MPKI environment (Web URL)

Microsoft: Administrative Access to a server on which Network Device Enrollment Service (NDES) can be installed. Could be 2003 or 2008R2 Enterprise or Data Center editions. Can be enabled on either the Cloud Extender server or the CA server itself.

Symantec: Administrative Access to Symantec MPKI environment with admin access to get an RA certificate.

Microsoft: Administrator credentials for the NDES environment

Symantec: Administrative credentials on Symantec MPKI environment.

Please refer to the Detailed Certificate Integration Guides for more details on Certificate Integration.

10

MaaS360.com

Installing and Configuring the Cloud Extender Launch the MaaS360 Cloud Extender installation package. This package can be downloaded using the Product Download link on the MaaS360 Portal. You will also need the License Key for installation. Click the Send License Key to have it sent to your email address.

As noted in the Introduction of this document, what is being installed is a version of the MaaS360 Visibility Service, which provides the underlying functionality for the Cloud Extender. Once the Visibility Service is installed, the MaaS360 Cloud Extender Configuration Tool will be launched and will take you through the steps required to configure the Cloud Extender for your environment.

*The Configuration Tool can also be run later by the administrator manually using the shortcut to All Programs/MaaS360/MaaS360 ActiveSync Configuration Utility.

Visibility Service

The following screens are representative of what you will see as you step through the Visibility Service installation.

1. Double click the MaaS360 Cloud Extender executable.

2. Click Next to connect Cloud Extender to MaaS360 On-Premises Instance. Enter the enrollment url in the “Instance Central Server Name” field on the screen.

3. Click Next to advance to the License Key screen.

11

MaaS360.com

4. Enter the License Key provided to you in the Welcome Email.

5. Click Next to advance to the Ready to Install the Program screen.

12

MaaS360.com

6. Click Install to continue the installation.

7. Click Next to continue the installation.

13

MaaS360.com

8. When prompted, click Finish. The MaaS360 Cloud Extender Configuration Tool will now launch.

MaaS360 Cloud Extender Configuration Tool

Once the Configuration Tool launches, during installation you will be taken through the following screens:

1. You will be prompted to select the mode of Internet Access. MaaS360 will try to auto-populate the detail found within the IE settings.

a. If you are manually configuring your proxy settings, you also have the ability to set credentials if you are using an authenticated proxy.

b. If no proxy is required to reach the Internet, use the Do not use any proxy option.

14

MaaS360.com

15

MaaS360.com

c. When Internet access is configured successfully a Green checkmark will appear on the Check for Internet connectivity screen as seen below.

16

MaaS360.com

2. Click Next to continue to select your services.

3. The following services are available:

a. Exchange ActiveSync Manager b. Lotus Traveler Manager c. BlackBerry Enterprise Server Integration d. User Authentication e. User Visibility f. Certificates Integration (call Fiberlink for additional configuration options)

17

MaaS360.com

If you select Exchange ActiveSync Manager, additional options are displayed.

18

MaaS360.com

4. Select your services. A common configuration is: Exchange ActiveSync Manager – On premises (Exchange 2007) User Authentication – Active Directory User Visibility – Active Directory

19

MaaS360.com

5. Click Next to verify the prerequisites were met.

Note: This screen could vary based on your selections.

20

MaaS360.com

6. Click Next to configure the service account used to run the MaaS360 Visibility Service.

21

MaaS360.com

7. You will be notified if the authentication was successful.

22

MaaS360.com

8. Click Test Reachability to run the optional Reachability Test. If you do not want to run this test, click Next to move past it. The test will verify access to the services selected. Here is an example of what the results may look like.

23

MaaS360.com

9. The Cloud Extender Status screen appears. Each item will receive a checkmark as it becomes integrated with MaS360. Click Next to proceed.

24

MaaS360.com

10. Click Next to configure Automatic Updates and finish the configuration.

Note: It is recommended that Automatic Update remain enabled so the latest modules are downloaded for the installation. After you have all the proper modules, Automatic Updates can be disabled. If the Automatic Updates checkbox is greyed out, that means the modules are still being downloaded.

11. Click Finish.

25

MaaS360.com

After a few minutes data will be collected and passed to MaaS360. You can check this process by logging into MaaS360 via MaaS360 portal on your instance and going to the Manage -> Manage MaaS360 Cloud Extenders workflow.

26

MaaS360.com

Appendix A: Other Modules

Lotus Traveler Manager in the Cloud Extender Configuration Tool

1. Click the + button to add the names of your Traveler server(s)

2. Browse to the Notes.ini File Path

3. Browse to the Notes ID file

4. Enter the password for the Notes ID file being used for the MaaS360 Visibility Service

27

MaaS360.com

BlackBerry Enterprise Server integration in the Cloud Extender Configuration Tool

1. Enter your BAS Server Name

2. Select your Mailbox Server and click Get Authentication Types

3. Enter the detail for the Service Account being used by the MaaS360 Visibility Service

28

MaaS360.com

Exchange 2010/2013 Integration in the Cloud Extender Configuration Tool

1. The tool will check to see if the necessary applications are installed. If they are, click Next.

29

MaaS360.com

2. Enter your Remote PowerShell URL: http://<CAS_SERVER_FQDN>/PowerShell

3. Enter your MDM Service account credentials.

30

MaaS360.com

Office 365 Integration in the Cloud Extender Configuration Tool

1. Enter the Office 365 Server URL

2. Enter the detail for the Service Account (note: this can be a local account to O365 with ‘Global Admin’ rights, or a member of ‘Organization Management’ in your local AD, if configured to sync with O365)

31

MaaS360.com

BPOS-D Integration in the Cloud Extender Configuration Tool

1. The tool will check to see if the necessary applications are installed. If they are, click Next.

32

MaaS360.com

2. Enter the BOPS Server URL.

3. Enter the username and password for the account.

33

MaaS360.com

Certificate Integration in the Cloud Extender Configuration Tool

1. Add a new Template.

34

MaaS360.com

2. Complete the template information based on your PKI – Microsoft or Symantec

35

MaaS360.com

Appendix B: Troubleshooting

Microsoft Exchange Activesync

During configuration, there are issues accessing the specified CAS server URL on Exchange 2010/2013.

Troubleshooting steps:

1. Please verify that the service account specified has the Organization Management access right, and that you are logged onto the machine with the service account.

2. Ensure that the CAS server you have specified is the FQDN of an actual host, rather than an array or load-balancing URL.

3. Verify that the CAS server can be pinged from the Cloud Extender machine.

The configuration utility detects the Management Tools for Exchange 2007 or 2010, but no devices are showing up in the portal.


1. Verify that the Management Tools match both the year and service pack version of the Exchange server itself.

2. Log into the portal and verify that Manage -> Configure Services shows that ‘ActiveSync Manager’ is enabled.

3. Verify that devices/mailboxes can be viewed directly from the Exchange Management Console.

When performing the reachability tests, some of my mailbox servers are marked as unreachable.


1. If mailbox servers contain redundant databases or exist for DR purposes, they may show as unreachable. This failure is expected, and you can continue through the wizard.

2. If the unreachable servers pertain to a different version of Exchange than what you are trying to configure, this error can be safely ignored.

3. If there are no mailboxes on this serve the error can be safely ignored.

IBM Lotus Traveler

The configuration tool completed successfully, but no devices are showing in the portal.


1. Verify that the Lotus client is not running on the Cloud Extender machine.

2. Log into the portal and verify that Manage -> Configure Services shows that ‘Lotus Traveler Manager’ is enabled.

3. Verify that the Lotus client has been configured on this machine and then exited.

36

MaaS360.com

BlackBerry Enterprise Server

During configuration, there are issues accessing the specified BlackBerry Administration Service URL.


1. To the URL specified in Config utility, concatenate "/webconsole/login/"

2. Enter this URL from a browser on the device where MaaS360 Cloud Extender is installed and ensure this is reachable. If not, there may be firewall rules preventing access to the BES setup which must be fixed

What should I do if no devices are visible in "View All Devices" workflow even after successful Cloud Extender configuration?


1. Ensure that .NET 3.5 or higher is installed

2. Log into the portal and verify that Manage -> Configure Services shows that ‘Blackberry Enterprise Server Manager’ is enabled.

I cannot execute the “Send Message” action. What should I do?


1. Perform the action from the BES console to see if it works correctly. Sometimes BES settings for outgoing emails may not be configured properly, which could result in this issue.

2. Make sure there are no special characters in the message.

MaaS360 On-Premises Cloud Extender...5 MaaS360.com+ System Requirements for the Cloud Extender for...

Documents

Transcript of MaaS360 On-Premises Cloud Extender...5 MaaS360.com+ System Requirements for the Cloud Extender for...