Overview

A fully operational MDM setup requires a To have a fully functional Mobile Device Management system, it is necessary to have a properly deployed set of CapaInstaller services that are deployed correctly in within the company network infrastructure. Consult the illustration and tables below when setting up your network for CapaInstaller MDM.

The following illustration with referencing tables contains information about network ports used by CapaInstaller Mobile Device Management.

The referenced ports for CapaInstaller services are the default values. If the defaults are changed, refer to the port set in the service configuration.

If you have other isolated LAN zones, for example a separate WIFI zone, port openings for these zones should be the same as the LAN port openings

Image Removed

's network infrastructure.

Services

Devices

Devices

For end-user devices to support mobile device management, the devices must communicate with different network services

https://capawiki.capasystems.com/display/CI64DOC/MDM+Network+Ports

Services and Clients

Description of the components from the illustration and reference tables

Services

SCEP Service

Simple Certificate Enrollment Protocol http://en.wikipedia.org/wiki/Simple_Certificate_Enrollment_Protocol

The administrator must allow access through the firewall from the DMZ to the CapaInstaller Backend Service. The URL can be found from the Backend service configuration (http://ciserver.example.com:xx/cibackend). During enrollment the device will communicate with the SCEP service, so it needs to be accessible at the configured port (eg. port =1640).

MDM Service (Mobile Device Management)

The administrator must allow access through the firewall from the DMZ to the CapaInstaller Backend Service. The URL can be found from the Backend service configuration (http://ciserver.example.com:xx/cibackend).

The MDM service uses the DMZ Front-end Service. The Url can be found from the Frontend service configuration (http://mdm.example.com:xx/cifrontend).

The MDM service depends on two certificates (Apple certificate and SSL certificate) that are stored in the server's local certificate store (not the user store).

The MDM service hosts an enrollment homepage at URL: https://mdm.example.com/cimdm.

The MDM service communicates with the Apple Push Network Service (APNS). http://support.apple.com/kb/TS4264

The MDM service communicates with Google Cloud Messaging. http://en.wikipedia.org/wiki/Google_Cloud_Messaging

DMZ Frontend Service

The administrator must allow access through the firewall from the DMZ to the CapaInstaller internal Front-end Service. The URL can be found from the Frontend service configuration (http://ciserver.example.com:xx/cifrontend).

Back-end service

The Backend service communicates with the Active Directory, so it needs access to this, especially if AD lookup is required. The Backend service communicates with the CapaInstaller database.

Clients

Mobile Devices on public network

The mobile devices communicate with the MDM service through the main URL: https://mdm.example.com/cimdm

The mobile devices communicate with the SCEP service through the main URL: http://mdm.example.com:5024/

The mobile devices communicate with the Apple Push Network Service (APNS). http://support.apple.com/kb/TS4264

The mobile devices communicate with Google Cloud Messaging. http://en.wikipedia.org/wiki/Google_Cloud_Messaging

The mobile devices communicate with the MDM service through the OMA URL: http://mdm.example.com:8443/ [Open Mobile Alliance (OMA) Device Management (DM) server (https://en.wikipedia.org/wiki/OMA_Device_Management)]

Computers on public network

The computers communicate with the DMZ Front-end service http://mdm.example.com:xx/cifrontend

LAN Mobile Devices

The devices will communicate just like the Mobile Devices on Public networks (see above).

LAN Computers

The computers communicate with the Internal Front-end service http://ciserver.example.com:xx/cifrontend

Unless the internal WiFi allows connection to the Internal Front-end service, computers that use WiFi may connect to the DMZ Front-end through the Public network

Third party services

Apple Push Network Service

Google Cloud Messaging.

 http://en.wikipedia.org/wiki/Google_Cloud_Messaging