Sophos Mobile server deployment guide
Product Version: 8.5
Contents
About this guide....................................................................................................................................... 1
Sizing considerations............................................................................................................................... 2
Architecture examples.............................................................................................................................. 6
Ports and protocols.................................................................................................................................. 9
Usage scenarios for the standalone EAS proxy....................................................................................13
Technical support................................................................................................................................... 17
Legal notices.......................................................................................................................................... 18
(2018/07/09)
Sophos Mobile on Premise
1 About this guide
This guide contains deployment considerations for a Sophos Mobile system.
It provides guidance on the proper dimensioning of a Sophos Mobile server installation in terms of hardware (for example CPU and memory) and software (for example database and virtualization) requirements, and it explains, on the basis of schematic diagrams, different usage scenarios for the integration of Sophos Mobile and the standalone EAS proxy into a company's infrastructure.
Copyright © 2018 Sophos Limited 1
Sophos Mobile on Premise
2 Sizing considerations
Important
This section provides guidance on how to size the Sophos Mobile server based on some key criteria. The recommendations are based on default settings of the relevant configuration parameters and on a reasonable distribution of device types, tenants (customers) and administrators. If the setup for a customer differs significantly, the suggested values must to be modified.
Activities that generate load
The following activities generate load on the Sophos Mobile server:
• Administrator interaction: Any administrator interactively working in a customer account generates load. The load depends on the amount of interactive actions and the number of devices for that customer.
• Self Service Portal interaction: Any user interactively working on the Self Service Portal generates load. The number of concurrent sessions is relevant for the sizing of a server.
• Device Sync: The devices synchronize with the server in predefined intervals. Each sync operation generates load. The number of devices and the interval are relevant for the sizing of a server.
• Policy/app distribution: Any device interaction, like lock or wipe, policy updates or app distribution generates server load. The server is able to distribute the load over time (batching), but the server must be sized to handle that additional load.
• Email traffic: The EAS proxy acts as a gateway for email communication. The server load depends on the number of devices syncing email and the sync period. If the EAS proxy is installed on a different server, this load can be neglected. More than one active EAS proxy can add to the server load, as the device status must be fetched regularly. Please note that, because all email traffic passes the EAS proxy, sufficient network bandwidth is required.
2
System components
A Sophos Mobile system can be divided into 3 main components:
• Sophos Mobile server: The server manages all administrator and user interactions, the device sync and the policy and app distribution.
• Database server: The database server (DB server) handles all read and write activities and queries. Most of the SMC server activities result in a DB server action. The DB server can be installed either on the same or different hardware server as the Sophos Mobile server.
• EAS proxy: All email traffic passes the EAS proxy. It is installed either as a component of the
Sophos Mobile server (internal EAS proxy) or as a separate component on one or more external servers (standalone EAS proxy).
Sophos Mobile server sizing
Definitions:
• 1 CPU equals to an Intel XEON core with 2.5 GHz.
Copyright © 2018 Sophos Limited
Sophos Mobile on Premise
• Memory values are in GB.
• System environment: Windows Server 2012 R2, Microsoft SQL 2012 Standard.
• The SMC database is the only database on that SQL server.
• Sophos Mobile 8.1 latest patch level.
• Device default sync cycle of 24 hours.
DB server
# of devices
Up to 200
Up to 500
Up to 1.000
Up to 2.000
Up to 5.000
Up to 10.000
Up to 20.000
2
4
8
8
2
2
2
4
Sophos
Mobile server
CPU
1
Memory
4
4
4
4
8
4
8
8
16
CPU
-
-
-
2
-
2
4
4
8
Memory Comments
-
-
-
2
-
4
4
8
16
MS-SQL Express is sufficient
MS-SQL Express is sufficient
MS-SQL Express is sufficient
Sophos Mobile fully supports VMWare virtual environments. The sizing recommendations are expected to suit virtual environments as well. Because there might be some other influences on the virtualized servers, Sophos cannot confirm 100% matching performance in virtual environments.
Sophos Mobile has no hard limit at 20.000 devices. But any sizing beyond this requires detailed input on the parameter, like sync cycle, number of tenants, device mix and number of interactive users. Also, any sizing beyond 20.000 devices requires a cluster setup.
If you need to manage more than 20.000 devices, please contact product management.
EAS proxy sizing
Sophos Mobile offers two EAS proxy components. The internal EAS proxy is part of the Sophos
Mobile server and can be used for a simple setup in smaller installations. The internal EAS proxy is recommended for installations with no more than 500 devices syncing emails and if no failover or clustering is required.
The standalone or external EAS proxy is recommended for larger installations, if device management and email proxy have to separate or clustering is required. The standalone EAS proxy does not require a lot of CPU and memory, the key limitation is bandwidth. Because the EAS proxy is critical for the delivery of email, the recommended setup for larger installations is to have multiple instances of EAS proxies with a load balancer before them.
Sizing recommendation for EAS proxy: 1 CPU and 2 GB of memory.
Copyright © 2018 Sophos Limited 3
Sophos Mobile on Premise
4
Database sizing
The size of the database depends on the following factors:
• The mobile platforms that need to be managed (iOS, Android or Windows).
• The used database (MS-SQL or MySQL).
• The data on the mobile devices (e.g. the number of installed apps).
• Apps to be published on the Sophos Mobile server.
• Documents to be published on the Sophos Mobile server.
Some real world examples show 0.2 MB per device, thus a 500 device server uses 25 MB.
On most customer installation, the required database size is strongly influenced by the number of apps and documents published through Sophos Mobile.
For installation beyond 500 devices, you should consider using an MS-SQL Standard server instead of an MS SQL Express edition.
Network sizing
To properly size the network connection to Sophos Mobile, please use the following data as a guideline. An Sophos Mobile managed device normally synchronizes once a day with the server.
In this synchronization cycle, information like device properties, security information, app list and certificates are exchanged. On an average device, please calculate the following data usage per device:
Device type
Android iPhone, iPad
Mac
Windows Mobile/Phone
Windows computer
Data volume
50 KB
100 KB
150 KB
100 KB
100 KB
The majority of network traffic is generated by the distribution of apps, documents and policies to the devices. The network sizing should take this into account. The server handles any of these device interactions in batches of 500 devices to avoid overloading of the server and the network. Apps and documents can be calculated with an overhead of 10% of the app or document size. A policy push is about the same size as a device sync.
Sophos Mobile Security data usage
Sophos Mobile Security is a security app for Android devices that protects devices from malicious apps and assists end users in detecting app permissions that could be a security risk. Its web filtering capability allows you to filter websites by category and lets you block inappropriate content.
On devices that have the Sophos Mobile Security app installed, the following network traffic occurs:
Copyright © 2018 Sophos Limited
Sophos Mobile on Premise
• On each malware scan, 256 bytes per app are used for online look-ups against the latest threat data in the SophosLabs database.
• For downloading data updates for the antivirus engine, 10-20 KB per day are used on average.
Copyright © 2018 Sophos Limited 5
Sophos Mobile on Premise
3 Architecture examples
The following graphics show how the Sophos Mobile server (SMC server in the diagrams) can be integrated into a company’s infrastructure.
Figure 1: Communication overview
6
Figure 2: Sophos Mobile in demilitarized zone (DMZ)
Copyright © 2018 Sophos Limited
Sophos Mobile on Premise
Figure 3: Sophos Mobile in DMZ with incoming and outgoing traffic protection
Figure 4: Sophos Mobile in backend with incoming and outgoing traffic protection
Copyright © 2018 Sophos Limited 7
Sophos Mobile on Premise
Figure 5: Sophos Mobile cluster setup with Sophos UTM Web Application Firewall
8 Copyright © 2018 Sophos Limited
Sophos Mobile on Premise
4 Ports and protocols
This section lists the communication details for required and optional network connections.
From the internet to the Sophos Mobile server
Port forwarding, NAT, WAF, Reverse Proxy are supported
Protocol Port
HTTP 80
HTTPS 443
Destination
<Sophos Mobile server>
<Sophos Mobile server>
Comment
Forwards to HTTPS port
Access to admin console, self service portal and device sync,
UTM, NAC
Optional?
Yes
From the internal network to the Sophos Mobile server
Protocol Port
HTTP 80
HTTPS 443
Destination
<Sophos Mobile server>
<Sophos Mobile server>
Comment
Forwards to HTTPS port
Access to admin console, self service portal and device sync,
UTM, NAC
Optional?
Yes
From the Sophos Mobile server to the Internet
Note
A proxy can be used for this traffic. Make sure it can access the APNs servers and keeps the client certificate for services.sophosmc.com
intact.
Table 1: From the Sophos Mobile server to the internet
Protocol Port
443 HTTPS with client cert.
HTTPS 443
HTTPS 443
Destination services.sophosmc.com
(85.22.154.49) android.googleapis.com
gcm-http.googleapis.com
www.google.com/recaptcha
Comment
Used for SMC App Push
- Apple (APNs), Microsoft
(MPNS, WNS), Android (Baidu
Push)
Google Cloud Messaging for
Android devices
Google reCAPTCHA service
Optional?
Copyright © 2018 Sophos Limited 9
Sophos Mobile on Premise
Protocol Port
HTTPS 443
Destination www.googleapis.com
APNS with client cert.
2195
HTTPS 443 gateway.push.apple.com
(17.0.0.0/8)
HTTPS
HTTPS
HTTPS
HTTPS
HTTPS
443
443
443
443
443
Comment
Google APIs for Android enterprise
Apple Push Notification service
Optional?
Yes vpp.itunes.apple.com
(17.0.0.0/8) itunes.apple.com (17.0.0.0/8)
Apple Volume Purchase
Program
Apple App identifier search
Yes deviceservicesexternal.apple.com (17.0.0.0/8)
Apple Activation Lock Bypass for supervised devices mdmenrollment.apple.com
(17.0.0.0/8)
Apple Device Enrollment
Program login.live.com
*.notify.windows.com
login.microsoftonline.com
graph.microsoft.com
Windows Push Notification service
Microsoft Intune app protection
Yes
Yes
Yes
From the Sophos Mobile server to the following internal hosts
Destination Protocol
MS SQL
MySQL
SMTP
SMTP
SSL
SMTP
TLS
LDAP
LDAPS
HTTPS
HTTPS
Port
1433
3306
25
465
587
389
636
443
443
<your database host>
<your SMTP host>
<your LDAP host>
Comment
If not on same computer as
Sophos Mobile
Mails for enrollment and maintenance
To your directory server
<your Exchange server> For ActiveSync traffic
<your SGN server> For SGN integration
Optional?
Yes
Yes
Yes
10 Copyright © 2018 Sophos Limited
Sophos Mobile on Premise
From Android devices to the internet
Service Port
GCM
Destination
5228-5230 internet
(all IP blocks listed in Google’s
ASN of 15169)
HTTPS
HTTP
HTTPS
443
80
443 www.googleapis.com
*.samsungknox.com
*.secb2b.com
*.samsung.com
Comment
Google Cloud Messaging
(GCM) for Android devices.
GCM typically only uses port
5228, but it sometimes uses
5229 and 5230.
Zero-touch enrollment
Samsung Knox Mobile
Enrollment
Optional?
Yes
Yes
From iOS and macOS devices to the internet
Service Port
APNs 5223
HTTPS 443
Destination
17.0.0.0/8 mesu.apple.com
Comment
Apple Push Notification service for iOS and macOS devices.
Apple service for available iOS and macOS updates.
Optional?
Yes
1
From Windows and Windows Mobile devices to the internet
Service Port
HTTPS 443
HTTPS 443
Destination
*.notify.windows.com
*.wns.windows.com
*.notify.live.net
push-services.sophosmc.com
Comment
Windows Notification Service
(WNS) and Microsoft Push
Notification Service (MPNS) for
Windows devices.
Optional?
Sophos notification service for the Sophos Secure Email iOS app.
Yes
2
1
2
If not available, Sophos Mobile has no information about iOS and macOS updates. For example, compliance rules regarding mandatory updates have no effect.
Required to use Exchange Web Services (EWS) notifications. See Sophos knowledge base article
127137 .
Copyright © 2018 Sophos Limited 11
Sophos Mobile on Premise
Between Sophos Mobile server nodes
Protocol Port
TCP 7600, 8181, 57600
TCP
UDP
7600, 8181, 57600
45700
Destination
<incoming>
<outgoing>
<incoming>
Comment Optional?
12 Copyright © 2018 Sophos Limited
Sophos Mobile on Premise
5 Usage scenarios for the standalone EAS proxy
A standalone EAS proxy server should be used for the following scenarios.
Note
The standalone EAS proxy is available for all installation types of the Sophos Mobile server, i.e.
Sophos Mobile on Premise, Sophos Mobile as a Service, and Sophos Mobile in Central. The internal EAS proxy is only available for Sophos Mobile on Premise.
You use IBM Notes Traveler (formerly IBM Lotus Notes Traveler) for noniOS devices
The internal EAS proxy is not suitable for this scenario because it only supports the ActiveSync protocol, which is used by Microsoft Exchange and by IBM Notes Traveler for iOS devices. IBM
Notes Traveler for non-iOS devices (for example, Android) uses a different protocol that is supported by the standalone EAS proxy.
For non-iOS devices, dedicated Traveler client software is required. This software is available through <traveler-server>/servlet/traveler or the Traveler file system. The Install App and Uninstall App features of Sophos Mobile can be used to install and uninstall the Traveler client software. Configuration has to be performed manually.
Figure 6: EAS proxy for IBM Notes Traveler
You want to support multiple backend servers
With the standalone EAS proxy you can set up multiple instances of backend mail systems. Each instance needs an incoming TCP port. Each port can connect to a different backend. You need one
URL per EAS proxy instance.
Copyright © 2018 Sophos Limited 13
Sophos Mobile on Premise
Figure 7: SMC and multiple EAS proxy instances on the same computer
14
Figure 8: Sophos Mobile and multiple EAS proxy instances on different computers
You want to set up load balancing for EAS
You can set up standalone EAS proxy instances on several computers and then use a load balancer to distribute the client requests among them.
For this scenario an existing load balancer for HTTP is required.
Copyright © 2018 Sophos Limited
Sophos Mobile on Premise
Figure 9: Load-balanced EAS proxies (can also be used behind reverse proxy)
You want to use client certificate based authentication
For this scenario an existing PKI is required and the public part of the CA certificate has to be set in the EAS proxy.
Figure 10: EAS proxy with client certificate authentication
You want to control email access directly on your Exchange server or on
Office 365
In this scenario, the EAS proxy service communicates with the email server through PowerShell to control the email access of your managed devices. Email traffic happens directly from the devices to the email server and is not routed through a proxy.
Copyright © 2018 Sophos Limited 15
Sophos Mobile on Premise
Figure 11: Email access control through PowerShell communication
You need to manage more than 500 devices
For performance reasons, we recommend you use the standalone EAS proxy server instead of the internal version when email traffic for more than 500 client devices must be managed.
16 Copyright © 2018 Sophos Limited
Sophos Mobile on Premise
6 Technical support
You can find technical support for Sophos products in any of these ways:
• Visit the Sophos Community at community.sophos.com/ and search for other users who are experiencing the same problem.
• Visit the Sophos support knowledgebase at www.sophos.com/en-us/support.aspx
.
• Download the product documentation at www.sophos.com/en-us/support/documentation.aspx
.
• Open a ticket with our support team at https://secure2.sophos.com/support/contact-support/ support-query.aspx
.
Copyright © 2018 Sophos Limited 17
Sophos Mobile on Premise
7 Legal notices
Copyright © 2018 Sophos Limited. All rights reserved. No part of this publication may be reproduced, stored in a retrieval system, or transmitted, in any form or by any means, electronic, mechanical, photocopying, recording or otherwise unless you are either a valid licensee where the documentation can be reproduced in accordance with the license terms or you otherwise have the prior permission in writing of the copyright owner.
Sophos, Sophos Anti-Virus and SafeGuard are registered trademarks of Sophos Limited, Sophos
Group and Utimaco Safeware AG, as applicable. All other product and company names mentioned are trademarks or registered trademarks of their respective owners.
18 Copyright © 2018 Sophos Limited
