The following content is a brief and unofficial prerequisites guide to setup, configure and test XenMobile Device Manager 9.0 prior to deploying in a PoC, Pilot or Production environment by the author of this entry. The views, opinions and concepts expressed are those by the author of this entry only and do not necessary conform to industry descriptions or best practises.
Shortened Names
XENMOBILE APPCONTROLLER – xac
APPLE PUSH NOTIFICATION SERVICE – apns
ROLE BASED ACCESS CONTROL – rbac
LIGHT WEIGHT DIRECTORY PROTOCOL – ldap
ACTIVE DIRECTORY – ad
CERTIFICATE SIGNING REQUEST – csr
FULLY QUALIFIED DOMAIN NAME – fqdn
RECEIVER FOR WEB – rfw
CERTIFICATE AUTHORITY – ca
STOREFRONT SERVICES – sfs
PUBLIC KEY INFRASTRUCTURE – pki
NETSCALER GATEWAY – nsg
XENMOBILE DEVICE MANAGER – xdm
XENMOBILE NETSCALER CONNECTOR – xnc
SECURE TICKET AUTHORITY – sta
DOMAIN NAME SERVER – dns
Self-paced Online (SPO) XenMobile Device Manager Training
1: Course # CXM-200 entitled “Deploying Citrix XenMobile Device Manager Server” at – http://training.citrix.com/mod/ctxcatalog/course.php?id=834. Note at the time of writing this blog entry Thursday 17/07/2014 this SPO was freely available with a valid Citrix.com account.
2: Course # CXM-201
Administering and Managing Devices with Citrix XenMobile 9.0 – http://training.citrix.com/mod/ctxcatalog/course.php?id=923. Login to view the price at http://training.citrix.com.
Handset Security
1: How do you know a handset is secure outside of MDM or EMM providers? Well I typically search for a security Whitepaper or security micro sites that covers off the h/w and or software security hardening of these mobile handsets and I have listed a few below enjoy. Note the resources are not listed in any particular order.
The following content is a brief and unofficial prerequisites guide to setup, configure and test XenMobile Enterprise 9.0 prior to deploying in a PoC, Pilot or Production environment by the author of this entry. The views, opinions and concepts expressed are those by the author of this entry only and do not necessary conform to industry descriptions or best practises.
Shortened Names
XENMOBILE ENTERPRISE – xme
XENMOBILE CLOUD – xc
CERTIFICATE SIGNING REQUEST – csr
FULLY QUALIFIED DOMAIN NAME – fqdn
RECEIVER FOR WEB – rfw
CERTIFICATE AUTHORITY – ca
STOREFRONT SERVICES – sfs
PUBLIC KEY INFRASTRUCTURE – pki
NETSCALER GATEWAY – nsg
XENMOBILE DEVICE MANAGER – xdm
XENMOBILE APPCONTROLLER – xac
XENMOBILE NETSCALER CONNECTOR – xnc
SECURE TICKET AUTHORITY – sta
DOMAIN NAME SERVER – dns
PUBLIC KEY INFRASTRUCTURE – pki
XenMobile Security
1: Citrix have published a Whitepaper in PDF format covering the security within XenMobile which can be downloaded directly at – http://www.citrix.com/content/dam/citrix/en_us/documents/products-solutions/xenmobile-security.pdf there is also a new security web page within the XenMobile microsite on Citrix.com at – http://www.citrix.com/products/xenmobile/tech-info/mobile-security.html.
2: Security harden your XDM implementation leveraging Microsoft’s leading best practises I have listed below are a few (starter) useful resources. I always believe that you should challenge the way you are manage your infrastructure periodically from the services, ports, packages running on servers to the ACL at the edge of your network to ensure that you are using the latest leading best practises for monitoring, managing and supporting your environment(s) end-2-end and often this will require input from a Server, DBA SysAdmin & network engineer.
What’s New & Fixed
1: Support for Windows Phone 8.1 MDM API’s which include but not limited to software inventory, disabling of the camera, encryption e.t.c and for a complete list checkout – http://support.citrix.com/proddocs/topic/xenmobile-90/xmob-dm-manage-config-win-81.html.
2: New MDX policies for Windows Phone 8.1 e.g Document exchange (Open In), App restrictions, iOS e.g AirDrop, Social media integration and others.
XenMobile Public Key Infrastructure (PKI) Integration
Prior to implementing with XME I would suggest that you review and read through the PKI section in eDocs for XenMobile Enterprise 9.0 at – http://support.citrix.com/proddocs/topic/xenmobile-90/xmob-dm-manage-security-pki-overview-con.html so that you are aware and familiar with the supported PKI capabilities supported by XenMobile 9.0. The below embedded videos are from Citrix TV and covering the Symantec PKI integration for XenMobile 9.0.
The following content is a brief and unofficial prerequisites guide to setup, configure and test XenMobile Device Manager 8.7 prior to deploying in a PoC, Pilot or Production environment by the author of this entry. The views, opinions and concepts expressed are those by the author of this entry only and do not necessary conform to industry descriptions or best practises.
Shortened Names
XENMOBILE DEVICE MANAGER – xdm
CERTIFICATE SIGNING REQUEST – csr
APPLE PUSH NOTIFICATION SERVICE – apns
FULLY QUALIFIED DOMAIN NAME – fqdn
GoToMeeting – gtm
GoToAssist – gta
VOLUME PURCHASE PROGRAM – vpp
Creating a XDM Cluster & Load Balancing
1: I would suggest reading through How-to setup and configure a XDM cluster – http://support.citrix.com/proddocs/topic/xenmobile-87/xmob-dm-manage-ha-wrapper-con.html thereafter prior to you setting up and configuring a XDM cluster prepare by creating a script that can handle and manage the process of preparing e,g backing up the original files and then committing the required files to the secondary, third XDM servers. I created a prepare and a commit script to easily achieve creating my own XDM cluster when setting a PoC or a training lab for a XenMobile PoC workshop. The first time you use or test your scripts you will need to manually create your modified files to enable XDM clustering. I would also suggest checking eDocs between different XenMobile versions if anything has changed in the cfg files for the XDM re Clustering.
2: You should have two script files the 1st script is used to copy the files from the primary XDM server to a dest folder. The 2nd script is used to commit the files from the primary XDM server to the secondary XDM at the point prior to configuring the database connection (You must complete the database connection exactly the same as the primary XDM server) during the XDM installation on the secondary XDM server you will only need to enter in a password during the CA stage and many steps thereafter will be different as well as you have already copied over cfgs files.
3: Please differ to the eDoc’s link above for full details and instructions.
4: Learn how-to load balancing your XDM cluster check – http://support.citrix.com/proddocs/topic/xenmobile-87/xmob-dm-manage-ha-wrapper-con.html or watch this video re how-to configure load-balancing from http://www.citrix.com/tv:
Configuring an External Certificate Authority by Using an SSL *.p12. *.pfx Certificate
1: Modify the follow server.xml, pki.xml files accordingly as mentioned in eDocs – http://support.citrix.com/proddocs/topic/xenmobile-87/xmob-dm-manage-securityid-configcert-ssl-tsk.html. Alternatively you can also follow this CTX article entitled “How to Configure an External SSL Certificate for Device Manager” at – http://support.citrix.com/article/CTX136952.
2: I would suggest review the above documentation and create a script that can create a folder for your external SSL cert, backup and then replace the server.xml and pki.xml files and finally restart the XDM services in order for the External SSL cert to be bound to the https FQDN of the XDM.
The following content is a brief and unofficial prerequisites guide to setup, configure and test XenMobile Enterprise 8.7 prior to deploying in a PoC, Pilot or Production environment by the author of this entry. The views, opinions and concepts expressed are those by the author of this entry only and do not necessary conform to industry descriptions or best practises.
Shortened Names
XENMOBILE DEVICE MANAGER – xdm
CERTIFICATE SIGNING REQUEST – csr
APPLE PUSH NOTIFICATION SERVICE – apns
FULLY QUALIFIED DOMAIN NAME – fqdn
SECURE LIGHTWEIGHT DIRECTORY ACCESS PROTOCOL – (s)ldap
SHAREFILE STORAGEZONE CONNECTOR – szc
XENMOBILE APPCONTROLLER – xac
RECEIVER FOR WEB – RfW
OUT OF OFFICE – ooo
GoToMeeting – gtm
GoToAssist – gta
VOLUME PURCHASE PROGRAM – vpp
Performing In-place Upgrades from XenMobile 8.6 to 8.7
I performed in-place upgrade within my XenMobile Enterprise demo environment running Hyper-v on Microsoft Windows Server 2012 from 8.6 to 8.7 without any issues or errors.
2: Note: As I focus on PoC’s and Training the upgrade methods used below will be different for production environments and you should follow – http://support.citrix.com/article/CTX140444 for steps and guidance.
3: My current setup consisted of a XDM cluster on 8.6 l/b by NetScaler using a MS SQL database. I first performed a snapshot of both XDM servers and the SQL database then proceeded to shutdown the second XDM server and executed the XDM 8.7 software package on the primary XDM server which detected a XDM installation and performed a in-place upgrade following the onscreen steps. Once the software update completed I rebooted the VM and then proceeded to connect to XDM mgmt. Web UI locally via https://localhost/zdm on the primary XDM server desktop (Note: SSL error is normal as the FQDN your connected to is not for localhost but your organisations FQDN) and then logged in as a XDM admin then as domain user to verify that the SHP works as expected. Next shutdown the primary XDM server and boot the secondary XDM server and repeat the process above and once verified shutdown the secondary XDM server and boot the primary XDM server wait a few minute then boot the secondary XDM server and what a few minutes and then login to https://XDM-FQDN/Instance/helper.jsp e.g https://mdm.citrix.lab/zdm/helper.jsp and verify that the XDM cluster is active and working, next login to https://XDM-FQDN/Instance/ as a domain user and then a XDM admin to verify that everything works as expected e.g send a notification to an iOS device or enrol a new device using a custom deployment policies to verify your XDM is functioning as expected.
