Sophos Mobile
18
6 Load balancing and high availability
Sophos Mobile makes it possible to set up a high-availability environment. This ensures that the
SMC service remains externally accessible and tasks can be further processed even after failure of a Sophos Mobile server node. To achieve this, load balancing, that distributes client and browser sessions by using DNS Round Robin to the available nodes, is required.
The following describes setting up clustering for Sophos Mobile and configuring load balancing with
Sophos UTM.
6.1 Requirements
• One separate Windows server for each Sophos Mobile server node.
• All nodes must be on the same network.
• One Microsoft SQL or MySQL database server or cluster.
• Sophos UTM or Apache Reverse Proxy (mod_proxy) for load balancing. Load balancer must support permanent session cookies and official SSL/TLS web server certificates.
Note
For detailed information about the installation requirements see the Sophos Mobile 8 release notes and the Sophos Mobile installation prerequisites form .
Architecture
For an example of a three-node Sophos Mobile cluster see the Sophos Mobile server deployment guide .
For multicast communication between the individual Sophos Mobile server nodes, optionally a separate network can be used. The network interface to be used can be selected during cluster configuration, as described in
Set up the first node
(page 19). It may also be a VLAN.
Note
If you want to operate a second Sophos Mobile cluster for test purposes, a separate network is needed.
Ports and protocols
The following table shows the required ports and protocols for communication between the individual nodes of a Sophos Mobile server cluster.
Protocol
TCP
Ports
7600, 8181, 57600
Destination
<Incoming>
Copyright © 2018 Sophos Limited
Sophos Mobile
Protocol
TCP
UDP
Ports
7600, 8181, 57600
45700
Destination
<Outgoing>
<Incoming>
Server certificates
When you set up Sophos Mobile, you configure an SSL/TLS web server certificate that allows the Sophos Mobile Control app to establish a secure connection to the Sophos Mobile server. We recommend that you use a certificate that is issued by a globally trusted certificate authority (CA). In a clustered environment with several Sophos Mobile server nodes behind a load balancer, this might not be practical. You might want to use a self-signed certificate instead. Sophos Mobile supports self-signed certificates, but the following restrictions apply:
• If you use a self-signed certificate or a certificate that is issued by your own certificate authority
(CA), you must manually install that self-signed certificate or your CA certificate on your devices before you enroll them with Sophos Mobile. If you do not do this, the Sophos Mobile Control app will not trust your server and will refuse to connect. Certificates issued by a globally trusted CA do not require this manual installation.
• You cannot install Android apps from APK files that are hosted on the Sophos Mobile server if you use a self-signed certificate or a certificate that is issued by your own CA.
6.2 Set up cluster nodes
To set up a clustered environment you install the first node as described in
Install and set up the
Sophos Mobile server
(page 6). Clustering itself is then activated using the Configuration Wizard .
For all other nodes, the database created during installation of the first node has to be selected and clustering has to be activated.
Note
It is also possible to configure an existing SMC server for clustering and to extend the environment by adding additional nodes.
6.2.1 Set up the first node
1. Install Sophos Mobile as described in
Install and set up the Sophos Mobile server
(page 6) and write down the name of the database you created. Specify this database when installing further nodes.
2. At the end of the installation deselect the Start Sophos Mobile server now option in the Sophos
Mobile - Installation finished dialog.
Copyright © 2018 Sophos Limited 19
Sophos Mobile
Note
If the Sophos Mobile service has already been started it will automatically be stopped and restarted during the configuration described later in this section. Alternatively, you can manually stop the service from the menu of the Sophos Mobile system tray icon.
3. On the server, click Start , go to Sophos Mobile and click SMC Configuration Wizard .
4. The Welcome page of the Sophos Mobile Configuration Wizard is displayed. Click Next .
5. On the Database Selection page, select Skip database configuration and click Next .
6. On the Choose configuration steps page, select Configure cluster support and click Next .
7. On the Cluster Configuration page, use the drop-down list of available network interfaces to select the interface that will be used for multicast communication between the server node that you are about to set up and the other nodes.
8. Click through the remaining pages of the configuration wizard. Make sure that you click Yes when asked to start the SMC service.
The configuration of the first SMC server node is now complete. Click Finish in the Sophos
Mobile - Configuration Wizard finished dialog.
6.2.2 Set up further nodes
1. Start the installation of Sophos Mobile as described in Install and set up the Sophos Mobile server
(page 6).
2. On the Database selection page, select the database you created when you installed the first node and click Next .
The Database configuration dialog box is displayed. It shows the progress of the configuration process.
3. On the Database configuration page, wait until the configuration process has finished, then click Next .
4. On the Choose configuration steps page, select Configure cluster support and click Next .
5. On the Configure server certificate page, create a self-signed certificate as described in
Install and set up the Sophos Mobile server
(page 6) and click Next .
6. On the Cluster Configuration page, use the drop-down list of available network interfaces to select the interface of the Sophos Mobile server node that you are about to set up, then click
Next .
7. Click through the remaining pages of the configuration wizard. On the Sophos Mobile -
Installation finished page, select Start Sophos Mobile server now to start the cluster node that you just configured.
The configuration of the SMC node is now complete. If required, repeat this procedure to configure additional nodes.
6.3 Set up load balancing with Sophos UTM
This topic describes how to set up Sophos UTM as a load balancer for a cluster of Sophos
Mobile server nodes. For more information on configuring Sophos UTM, see the Sophos UTM documentation.
20 Copyright © 2018 Sophos Limited
Sophos Mobile
Note
• In order to use Sophos UTM for clustering you need a Sophos UTM license with a Sophos
Webserver Protection subscription.
• As described later in this section, you need to specify a certificate to protect the communication between the managed devices and the virtual web server that you set up in
Sophos UTM. For simplicity, we recommend that you use the same certificate that you used
for the Sophos Mobile server (see Request an SSL/TLS certificate for Sophos Mobile (page
5)). If you used a self-signed certificate, it is mandatory that you use that same certificate.
1. Log into Sophos UTM WebAdmin.
2. From the WebAdmin menu section Webserver Protection , go to the Web Application Firewall >
Real Webservers tab.
3. Click New Real Webserver to create an SMC node.
4. In the Add Real Webserver dialog, enter the following settings: a) Name : Enter a descriptive name for the web server (for example
SMC node
).
b) Host : Select or add a host. Select a host by clicking the folder symbol next to the Host field.
Drag a host from the list of available hosts into the Host field.
For additional information on how to add a definition, see the topic Network Definitions in the
UTM Administration Guide .
c) Type : Select Encrypted (HTTPS) .
Click Save to save the configuration.
Repeat the previous step for each Sophos Mobile server node.
5. From the WebAdmin menu section Webserver Protection , go to the Certificate Management >
Certificates tab.
6. Click New Certificate to upload an SSL/TLS web server certificate.
7. In the Add Certificate dialog, enter the following settings: a) Name : Enter a descriptive name for the certificate.
b) Method : Select Upload .
c) File type : Select PKCS#12(Cert+CA) d) Password : Enter the password for your certificate file.
e) File : Click the folder icon next to the File box, select the certificate you want to upload and click Start Upload .
Click Save to save the configuration. The certificate is added to the Certificates list.
8. From the WebAdmin menu section Webserver Protection , go to the Web Application Firewall >
Virtual Webservers tab.
9. Click New Virtual Webserver to add a virtual web server for the cluster.
10. In the Add Virtual Webserver dialog box, make the following settings: a) Name : Enter a descriptive name for the virtual web server (for example
SMC cluster
).
b) In the Interface list, select the WAN interface over which the cluster should be accessible from outside.
c) Type : Select Encrypted (HTTPS) & redirect .
d) In the Certificate list, select the web server’s certificate you uploaded beforehand.
e) Domains (only with wildcard certificate, that is a public key certificate that can be used with multiple subdomains): Enter the domains the web server is responsible for, for example shop.example.com
, or use the Action icon to import a list of domain names.
Copyright © 2018 Sophos Limited 21
Sophos Mobile
Domains must be entered as fully qualified domain names (FQDN).
You can use an asterisk (*) as a wildcard for the domain prefix, for example,
*.mydomain.com
. Domains with wildcards are considered as fallback settings: The virtual web server with the wildcard domain entry is only used when no other virtual web server with a more specific domain name is configured.
Example: A client request to a.b.c
will match a.b.c
before
*.b.c
before
*.c
.
f) Real Webservers : Select the SMC nodes you created beforehand.
Important
Do not select a firewall profile.
Click Save to save the configuration. The server is added to the Virtual Webservers list.
11. Enable the virtual web server.
The new virtual web server is disabled by default. Click the toggle switch to enable the virtual web server. The toggle switch color should change from gray (disabled) to green (enabled).
12. Go to the Site Path Routing tab.
13. In the Virtual Webservers list, go to the virtual web server you added and click Edit .
14. In the Edit Site Path Route dialog box, click Advanced and select Enable sticky session cookie .
Click Save to save the configuration.
22 Copyright © 2018 Sophos Limited
