Sophos Mobile Control
server deployment guide
Product version: 6.1
Document date: September 2016
Contents
1 About this guide........................................................................................................................3
2 Sizing considerations................................................................................................................4
3 Architecture examples..............................................................................................................8
4 Ports and protocols.................................................................................................................11
5 Usage scenarios for the standalone EAS proxy.....................................................................14
6 Technical support....................................................................................................................18
7 Legal notices..........................................................................................................................19
2
server deployment guide
1 About this guide
This guide contains deployment considerations for a Sophos Mobile Control system.
It provides guidance on the proper dimensioning of a Sophos Mobile Control server installation
in terms of hardware (for example CPU and memory) and software (for example database and
virtualization) requirements, and it explains, on the basis of schematic diagrams, different usage
scenarios for the integration of Sophos Mobile Control and the standalone EAS proxy into a
company's infrastructure.
3
Sophos Mobile Control
2 Sizing considerations
Important: This section provides guidance on how to size the Sophos Mobile Control (SMC)
server based on some key criteria. The recommendations are based on default settings of the
relevant configuration parameters and on a reasonable distribution of device types, tenants
(customers) and administrators. If the setup for a customer differs significantly, the suggested
values must to be modified.
Activities that generate load
The following activities generate load on the SMC server:
■
■
■
■
■
Administrator interaction: Any administrator interactively working in a customer account
generates load. The load depends on the amount of interactive actions and the number of
devices for that customer.
Self Service Portal interaction: Any user interactively working on the Self Service Portal
generates load. The number of concurrent sessions is relevant for the sizing of a server.
Device Sync: The devices synchronize with the server in predefined intervals. Each sync
operation generates load. The number of devices and the interval are relevant for the sizing
of a server.
Policy/app distribution: Any device interaction, like lock or wipe, policy updates or app
distribution generates server load.The server is able to distribute the load over time (batching),
but the server must be sized to handle that additional load.
Email traffic: The EAS proxy acts as a gateway for email communication. The server load
depends on the number of devices syncing email and the sync period. If the EAS proxy is
installed on a different server, this load can be neglected. More than one active EAS proxy
can add to the server load, as the device status must be fetched regularly. Please note that,
because all email traffic passes the EAS proxy, sufficient network bandwidth is required.
System components
An SMC system can be divided into 3 main components:
■
■
■
4
SMC server: The server manages all administrator and user interactions, the device sync and
the policy and app distribution.
Database server: The database server (DB server) handles all read and write activities and
queries. Most of the SMC server activities result in a DB server action. The DB server can be
installed either on the same or different hardware server as the SMC server.
EAS proxy: All email traffic passes the EAS proxy. It is installed either as a component of the
SMC server (internal EAS proxy) or as a separate component on one or more external servers
(standalone EAS proxy).
server deployment guide
SMC server sizing
Definitions:
■
1 CPU equals to an Intel XEON core with 2.5 GHz.
■
Memory values are in GB.
■
System environment: Windows 2012R2 Server, Microsoft SQL 2012 Standard.
■
The SMC database is the only database on that SQL server.
■
SMC 6.1 latest patch level.
■
Device default sync cycle of 24 hours.
SMC server
# of devices
DB server
CPU
Memory
CPU
Memory
Up to 200
1
4
-
-
MS-SQL Express is sufficient
Up to 500
2
4
-
-
MS-SQL Express is sufficient
Up to 1.000
2
4
-
-
MS-SQL Express is sufficient
2
4
2
2
4
8
-
-
2
4
2
4
Up to 5.000
4
8
4
4
Up to 10.000
8
8
4
8
Up to 20.000
8
16
8
16
Up to 2.000
Comments
SMC fully supports VMWare virtual environments. The sizing recommendations are expected to
suit virtual environments as well. Because there might be some other influences on the virtualized
servers, Sophos cannot confirm 100% matching performance in virtual environments.
SMC has no hard limit at 20.000 devices. But any sizing beyond this requires detailed input on
the parameter, like sync cycle, number of tenants, device mix and number of interactive users.
Also, any sizing beyond 20.000 devices requires a cluster setup.
If you need to manage more than 20.000 devices, please contact product management.
5
Sophos Mobile Control
EAS proxy sizing
SMC offers two EAS proxy components. The internal EAS proxy is part of the SMC server and
can be used for a simple setup in smaller installations. The internal EAS proxy is recommended
for installations with no more than 500 devices syncing emails and if no failover or clustering is
required.
The standalone or external EAS proxy is recommended for larger installations, if device
management and email proxy have to separate or clustering is required. The standalone EAS
proxy does not require a lot of CPU and memory, the key limitation is bandwidth. Because the
EAS proxy is critical for the delivery of email, the recommended setup for larger installations is
to have multiple instances of EAS proxies with a load balancer before them.
Sizing recommendation for EAS proxy: 1 CPU and 2 GB of memory.
Database sizing
The size of the database depends on the following factors:
■
The mobile platforms that need to be managed (iOS, Android or Windows).
■
The used database (MS-SQL or MySQL).
■
The data on the mobile devices (e.g. the number of installed apps).
■
Apps to be published on the SMC server.
■
Documents to be published on the SMC server.
Some real world examples show 0.2 MB per device, thus a 500 device server uses 25 MB.
On most customer installation, the required database size is strongly influenced by the number
of apps and documents published through SMC.
For installation beyond 500 devices, you should consider using an MS-SQL Standard server
instead of an MS SQL Express edition.
Network sizing
To properly size the network connection to SMC, please use the following data as a guideline.
An SMC managed device normally synchronizes once a day with the server. In this synchronization
cycle, information like device properties, security information, app list and certificates are
exchanged. On an average device, please calculate the following data usage per device:
6
Device type
Data volume
Apple iOS
100 KB
Google Android
50 KB
server deployment guide
Device type
Data volume
Windows Mobile/Phone
100 KB
Windows Desktop
100 KB
The majority of network traffic will be generated by the distribution of apps, documents and policies
to the devices. The network sizing should take this into account. The server handles any of these
device interactions in batches of 200 devices to avoid overloading of the server and the network.
Apps and documents can be calculated with an overhead of 10% of the app or document size.
A policy push is about the same size as a device sync.
7
Sophos Mobile Control
3 Architecture examples
The following graphics show how the Sophos Mobile Control server (SMC server) can be integrated
into a company’s infrastructure.
Figure 1: Communication overview
8
server deployment guide
Figure 2: Sophos Mobile Control in demilitarized zone (DMZ)
Figure 3: Sophos Mobile Control in DMZ with incoming and outgoing traffic protection
9
Sophos Mobile Control
Figure 4: Sophos Mobile Control in backend with incoming and outgoing traffic protection
Figure 5: Sophos Mobile Control cluster setup with Sophos UTM Web Application Firewall
10
server deployment guide
4 Ports and protocols
This section lists the communication details for required and optional network connections.
From the internet to the SMC server
Port forwarding, NAT, WAF, Reverse Proxy are supported
Protocol
TCP Port
Destination
Comment
Optional?
HTTP
80
<SMC server>
Forwards to HTTPS port
Yes
HTTPS
443
<SMC server>
Access to admin console, self
service portal and device sync,
UTM, NAC
From the internal network to the SMC server
Protocol
TCP Port
Destination
Comment
Optional?
HTTP
80
<SMC server>
Forwards to HTTPS port
Yes
HTTPS
443
<SMC server>
Access to admin console, self
service portal and device sync,
UTM, NAC
From the SMC server to the Internet
Note: A proxy can be used for this traffic. Make sure it can access the APNs servers and keeps
the client certificate for services.sophosmc.com intact.
Protocol
TCP Port
HTTPS
443
with client
cert.
Destination
Comment
services.sophosmc.com
(85.22.154.49)
Used for SMC App Push - Apple
(APNs) and Microsoft (MPNS)
Optional?
11
Sophos Mobile Control
Protocol
TCP Port
Destination
Comment
Optional?
HTTPS
443
android.googleapis.com
Google Cloud Messaging for
Android devices
APNS
2195
with client
cert.
gateway.push.apple.com
(17.0.0.0/8)
Apple Push Notification service
HTTPS
443
vpp.itunes.apple.com (17.0.0.0/8) Apple Volume Purchase Program Yes
HTTPS
443
itunes.apple.com (17.0.0.0/8)
HTTPS
443
deviceservices-external.apple.com Apple Activation Lock Bypass for
(17.0.0.0/8)
supervised devices
HTTPS
443
mdmenrollment.apple.com
(17.0.0.0/8)
Apple Device Enrollment Program Yes
HTTPS
443
login.live.com,
db3.notify.windows.com
Windows Push Notification service
Apple App identifier search
Yes
From the SMC server to the following internal hosts
Protocol
TCP Port
MS SQL 1433 or
or MySQL 3306
12
Destination
Comment
<your database host>
If not on same computer as SMC
Optional?
SMTP
(Plain,
SSL or
TLS)
25, 465 or <your SMTP host>
587
Mails for enrollment and
maintenance
LDAP or
LDAPS
389 or
636
<your LDAP host>
To your directory server. Plain or
SSL
Yes
HTTPS
443
<your Exchange server>
For ActiveSync traffic
Yes
HTTPS
443
<your SGN server>
For SGN integration
Yes
server deployment guide
From the devices to the Internet
For the managed devices, while connected to the WLAN, the following ports to the Internet should
be open.
Service
TCP Port
Destination
Comment
APNs
5223
17.0.0.0/8
Apple Push Notification service for
iOS devices
GCM
5228,
5229,
5230
Internet
Google Cloud Messaging (GCM)
for Android devices.
Optional?
Typically, GCM only uses port
5228, but ports 5229 and 5230 are
used occasionally as well.
IP addresses for GCM are
changed frequently.
13
Sophos Mobile Control
5 Usage scenarios for the standalone EAS
proxy
A standalone EAS proxy server should be used for the following scenarios.
You use IBM Notes Traveler (formerly IBM Lotus Notes Traveler) for
non-iOS devices
The internal EAS proxy is not suitable for this scenario because it only supports the ActiveSync
protocol, which is used by Microsoft Exchange and by IBM Notes Traveler for iOS devices. IBM
Notes Traveler for non-iOS devices (for example, Android) uses a different protocol that is
supported by the standalone EAS proxy.
For non-iOS devices, dedicated Traveler client software is required. This software is available
through <traveler-server>/servlet/traveler or the Traveler file system. The Install App
and Uninstall App features of Sophos Mobile Control can be used to install and uninstall the
Traveler client software. Configuration has to be performed manually.
Figure 6: EAS proxy for IBM Notes Traveler
You want to support multiple backend servers
With the standalone EAS proxy you can set up multiple instances of backend mail systems. Each
instance needs an incoming TCP port. Each port can connect to a different backend. You need
one URL per EAS proxy instance.
14
server deployment guide
Figure 7: SMC and multiple EAS proxy instances on the same computer
Figure 8: SMC and multiple EAS proxy instances on different computers
You want to set up load balancing for EAS
You can set up standalone EAS proxy instances on several computers and then use a load
balancer to distribute the client requests among them.
For this scenario an existing load balancer for HTTP is required.
15
Sophos Mobile Control
Figure 9: Load-balanced EAS proxies (can also be used behind reverse proxy)
You want to use client certificate based authentication
For this scenario an existing PKI is required and the public part of the CA certificate has to be set
in the EAS proxy.
Figure 10: EAS proxy with client certificate authentication
16
server deployment guide
You need to manage more than 500 devices
For performance reasons, we recommend you use the standalone EAS proxy server instead of
the internal version when email traffic for more than 500 client devices must be managed.
17
Sophos Mobile Control
6 Technical support
You can find technical support for Sophos products in any of these ways:
18
■
Visit the Sophos Community at community.sophos.com/ and search for other users who are
experiencing the same problem.
■
Visit the Sophos support knowledgebase at www.sophos.com/en-us/support.aspx.
■
Download the product documentation at www.sophos.com/en-us/support/documentation.aspx.
■
Open a ticket with our support team at
https://secure2.sophos.com/support/contact-support/support-query.aspx.
server deployment guide
7 Legal notices
Copyright © 2016 Sophos Limited. All rights reserved.
No part of this publication may be reproduced, stored in a retrieval system, or transmitted, in any
form or by any means, electronic, mechanical, photocopying, recording or otherwise unless you
are either a valid licensee where the documentation can be reproduced in accordance with the
license terms or you otherwise have the prior permission in writing of the copyright owner.
Sophos is a registered trademark of Sophos Limited and Sophos Group. All other product and
company names mentioned are trademarks or registered trademarks of their respective owners.
19
">
