AirWatch MAG Install Guide For Windows v8 - 2

AirWatch Mobile Access Gateway Installation
Guide for Windows for On-Premise Customers

Installing the MAG for your on-premise AirWatch environment
AirWatch v8.2
Have documentation feedback?Email docfeedback@air-watch.com. Note that if you require assistance from AirWatch
Support you should contact support@air-watch.com.
2015 VMware, Inc. All rights reserved.
This document, as well as the software described in it, is furnished under license. The information in this manual may only be used in accordance with the terms of the license. This
document should not be reproduced, stored or transmitted in any form, except as permitted by the license or by the express permission of AirWatch, LLC.
All other marks and names mentioned herein may be trademarks or trade names of their respective companies.
AirWatch Mobile Access Gateway Installation Guide for Windows for On-Premise Customers | v.2015.11 | November 2015
Copyright 2015 VMware, Inc. All rights reserved. Proprietary & Confidential.
1
Revision Table
The following table displays revisions to this guide since the release of AirWatch v8.2.
Date Reason
November 2015 Initial upload.
2
Table of Contents
Chapter 1: Overview 5
Introduction to Mobile Access Gateway Installation for Windows 6
In This Guide 6
Terminology 6
Getting Started 7
Prerequisites for MAGProxy/Content Connectivity for On-Premise Environments 8
Chapter 2: Installation Preparation 13

Overview 14
Performing Preliminary Installation Steps 14
Chapter 3: Configure MAGProxy/Content 16

Overview 17
Configuring MAGSettings 17
Configuring Advanced Settings 20
Chapter 4: MAG Proxy/Content Installation for a Relay-Endpoint Configuration

on Windows 22
Overview 23
Before You Install 23
Installing the MAG 23
Chapter 5: MAGProxy/Content Installation for a Basic (Endpoint only)

Configuration on Windows 32
Overview 33
Installing MAG for Basic (Endpoint only)Configurations 33
Chapter 6: Managing MAG 39

Overview 40
Upgrading the Component 40
Access Logs and Syslog Integration 40
3
SSLOffloading 41
Kerberos KDC Proxy Support 42
Outbound Proxies using PACFiles 45
Finding Additional Documentation 46
4
Chapter 1:
Overview
Introduction to Mobile Access Gateway Installation for
Windows 6
In This Guide 6
Terminology 6
Getting Started 7
Prerequisites for MAGProxy/Content Connectivity for On-
Premise Environments 8
5
Chapter 1: Overview
Introduction to Mobile Access Gateway Installation for Windows

This document describes the Windows installation process for the AirWatch Mobile Access Gateway (MAG), which is an
enterprise integration component that provides a secure and effective method for individual applications to access
corporate resources. For more information about how you can leverage MAG, architecture and security information, and
AirWatch AdminConsole settings to manage the MAG's functionality, please refer to the AirWatch Mobile Access
Gateway Admin Guide, available via AirWatch Resources.
A separate version of this guide exists with instructions on the AirWatch Tunnel for Linux installation process. Please
search AirWatch Resources for the AirWatch Tunnel Installation Guide for Linux to view it.
In This Guide
l MAGInstallation Preparation Perform some preliminary steps to ensure a smooth installation of the MAG.
l MAG Proxy/Content Installation for a Relay-Endpoint Configuration on Windows Run the MAG installer for a relay-
endpoint configuration.
l MAG Proxy/Content Installation for a Basic Configuration on Windows Run the MAGinstaller for a basic (endpoint
only)configuration.
l Appendix SSLOffloading Read more about how to enable SSLOffloading for the MAG.
l Appendix Upgrading the MAG Read more about how to upgrade the MAGfrom one version to the next.
l Appendix Kerberos KDCProxy Support Read more about enabling Kerberos authentication functionality.
l Appendix Outbound Proxies using PACFiles Read more about steps you should follow if you are accessing
outbound proxies through the MAG that use a PACfile and also require authentication.
Terminology
Reading over the following terminology as it relates to the various components of the MAG will help aid your
understanding of the technology.
l MAG Mobile Access Gateway. The generic term for the two components that comprise it:Proxy and Content.
l Proxy The MAGcomponent that handles securing traffic between an end-user device and a website via the
AirWatch Browser mobile app.
l Content The MAGcomponent that handles securing end-user access to corporate resources such as a file server via
the AirWatch Content Locker mobile app.
6
Chapter 1: Overview
Getting Started
l Note the following distinction between on-premise and SaaS deployments:
o On-premise refers to AirWatch deployments where your organization hosts all AirWatch components and
servers on its internal networks.
o SaaS refers to AirWatch deployments where certain AirWatch components, such as the Console and APIservers,
are hosted in the cloud by AirWatch.
Ensure you are using the correct version of this guide. There are two:one for on-premise, and one for SaaS.
l Before continuing with MAG installation, ensure AWCM is configured and operational. If you are an on-premise
customer, refer to the AWCM Guide, available via AirWatch Resources, for instructions on how to configure AWCM
before installing the MAG.
l Ensure you have performed all the necessary preliminary steps in MAG Installation Preparation.
7
Chapter 1: Overview
Prerequisites for MAGProxy/Content Connectivity for On-Premise

Environments
Hardware Requirements
Status
Requirement Notes
Checklist
VMor Physical Server 1 CPUCore (2.0+GHz)*
(64-bit) *An Intel processor is required.
2 GBRAMor higher
5 GBDisk Space
Note:The requirements listed here support basic data query. You may
require additional server space if your use case involves the
transmission of large encrypted files from a content repository.
Sizing for up to 100,000 Devices

Number of Devices Up to 50,000 50,000 to 100,000 100,000+
4 or 2 load-balanced w/ 2 4 or 2 load-balanced w/ 2 2 load-balanced with 4 CPU
CPUCores
CPUCores CPUCores Cores
RAM(GB) 4 8 16
General Requirements
Status
Requirement Notes
Checklist
Ensure that you have Recommended to setup Remote Desktop Connection Manager for multiple
remote access to the server management; you can download the installer from:
servers that AirWatch is http://www.microsoft.com/en-us/download/confirmation.aspx?id=21101
installed on
Installation of Notepad++ You can download the installer from:
(Recommended) http://download.tuxfamily.org/notepadplus/6.5.1/npp.6.5.1.Installer.exe
Software Requirements
Status
Requirement Notes
Checklist
Windows Server 2008 R2 or
Windows Server 2012 or
Windows Server 2012 R2
8
Chapter 1: Overview
Software Requirements
Status
Requirement Notes
Checklist
Install Role from Server Manager IIS 7.0 (Server 2008 R2)
IIS 8.0 (Server 2012 or Server 2012 R2)
IIS8.5 (Server 2012 R2 only)
Install .NETFramework 4.5.2 The installer will install this version of .NETprovided the
server has Internet access. Otherwise, download and
manually install it.
Install 64-bit Java Runtime Environment version Download from https://java.com/en/download/index.jsp
7 or greater Note:Ensure 32-bit Java is not installed.
Internally registered DNS Register the MAG relay (If Relay-Endpoint) or register the
MAG Endpoint (If Endpoint only)
Externally registered DNS Register the MAG relay (If Relay-Endpoint) or register the
MAG Endpoint (If Endpoint only)
SSL Certificate from trusted third party with Ensure SSL certificate is trusted by all device types being
Subject or Subject Alternative name of DNS used. (i.e. not all Comodo certificates are natively trusted
by Android)
IIS 443 Binding with the same SSLcertificate Validate that you can connect to the server over HTTPS
(https://yourAirWatchDomain.com). At this point, you
should see the IIS splash page.
Ensure the AWCM SSL certificates Intermediate Use the Command Line Utility on the MAGserver to enter
and Root CA certificate are in the Java CA the following:
Keystore on the MAGserver keytool -list -v -keystore $JAVA_HOME\jre
\lib\security\cacerts
OR
Use the GUI tool (free) here:
http://portecle.sourceforge.net/
Note:For configuring the ports listed below, all traffic is uni-directional (outbound)from the source component to
the destination component.
9
Chapter 1: Overview
Network Requirements
Source Component Destination Component Protocol Port Verification Note

Devices (from AirWatch MAG HTTPS 2020* by Once MAG starts correctly, it
Internet and Wi-Fi) default should be listening on the
(for HTTPSport by default. To make
Browser) sure, you can open browser and
check the following:
https://<MAG_Host>:2020 You 1
should see an untrusted
certificate screen unless there is a
trusted SSL certificate and in that
case you should see 407 MAG
Authentication Failed!
Devices (from AirWatch MAG HTTPS 443 (for Telnet from Internet to MAG
1
Internet and Wi-Fi) Content) server on port
AirWatch Device AirWatch Tunnel HTTP or 80 or 443
8
Services HTTPS
AirWatch Console AirWatch Tunnel HTTPor 80 or 443
9
HTTPS
MAG Basic-Endpoint Configuration
AirWatch AirWatch Cloud HTTPor 2001 or a Verify by entering
MAGEndpoint Messaging Server HTTPS port you https://<AWCM URL>:
configure <port>/awcm/status in browser 2
and ensure there is no certificate
trust error
AirWatch Web-based content HTTPor 80 or 443
TunnelEndpoint repositories (SharePoint HTTPS 3
/ WebDAV / CMIS / etc.)
AirWatch Tunnel Internal websites / web HTTPor 80 or 443
4
Endpoint apps HTTPS
AirWatch Internal System Any Any
6
MAGEndpoint
AirWatch MAG AirWatch REST API HTTPor 80 or 443 Verify by entering
Endpoint (DS or CN server) HTTPS https://APIServerUrl/API/help
in browser and ensure there is
no certificate trust error (cannot 7
be a self-signed certificate). If you
are prompted for credentials,
enter Airwatch admin credentials
10
Chapter 1: Overview
Network Requirements
Source Component Destination Component Protocol Port Verification Note

AirWatch Network Share-based CIFSor 137-139 Telnet from AirWatch Tunnel
TunnelEndpoint repositories (Windows SMB and 445 endpoint to CIFS/SMBendpoint. 10
file shares)
MAG Relay-Endpoint Configuration
AirWatch AirWatch Cloud HTTPor 2001 or a Verify by entering
MAGRelay Messaging Server HTTPS port you https://<AWCM
configure URL>:<port>/awcm/status in 2
browser and ensure there is no
certificate trust error
AirWatch Web-based content HTTPor 80 or 443
TunnelEndpoint repositories (SharePoint HTTPS 3
/ WebDAV / CMIS / etc.)
AirWatch Tunnel Internal websites / web HTTPor 80 or 443
4
Endpoint apps HTTPS
AirWatch Internal System Any Any
5
MAGEndpoint
AirWatch AirWatch MAGEndpoint HTTPS 2010* Telnet from MAG Relay to MAG
MAGRelay (for Endpoint server on port 6
Browser)
AirWatch AirWatch MAGEndpoint HTTPS 443 (for Telnet from MAG Relay to MAG
6
MAGRelay Content) Endpoint server on port
AirWatch AirWatch REST API HTTPor 80 or 443 Verify by entering
MAGRelay (DS or CN server) HTTPS https://APIServerUrl/API/help
in browser and ensure there is
no certificate trust error (cannot 7
be a self-signed certificate). If you
are prompted for credentials,
enter Airwatch admin credentials
AirWatch Network Share-based CIFSor 137-139 Telnet from AirWatch Tunnel
TunnelEndpoint repositories (Windows SMB and 445 endpoint to CIFS/SMBendpoint. 10
file shares)
*This port can be changed if needed based on your environment's restrictions.
Note:If you plan on using the MAG/AirWatch Tunnel Content component to connect to network file shares, then it is
required that either the Endpoint be on the same domain as the NFS or, if the MAG/AirWatch Tunnel is on a different
domain, it must have domain trust with the domain of the NFS.
11
Chapter 1: Overview
1. For devices attempting to access internal resources.
2. For the MAG to query the AirWatch Admin Console for compliance and tracking purposes.
3. For devices with the AirWatch ContentLocker to access internal content from websites, such as SharePoint.
4. For devices with the AirWatch Browser to access internal websites/web applications.
5. For devices with app tunnel; enables applications to communicate with internal systems.
Note:If a firewall resides between the MAGEndpoint and an internal system you are trying to reach, then you
will have to open the corresponding port depending on the traffic. For example, Windows Network Files Shares
require ports 135 through 139 and 445 to be open in order to access content on Windows file shares.
6. For MAG Relay topologies to forward device requests to the internal MAG endpoint only.
7. The MAG needs to communicate with the API for initialization. The API server is generally hosted on the AirWatch
Admin Console Server or can be a separate server. Ensure there is connectivity between this server and the MAG
server.
8. For the Device Services server to enumerate the repositories via the content relay and convert them into a format
devices can use.
9. For the Console server to enumerate the repositories via the content relay for viewing in the AirWatch Admin
Console.
10. For devices with the AirWatch Content Locker to access internal content from Network Shares.
12
Chapter 2:
Installation Preparation
Overview 14
Performing Preliminary Installation Steps 14
13
Chapter 2: Installation Preparation
Overview
Before installing the server within your network, you must ensure your environment meets all the requirements, and
then prepare for installation by downloading the installation files.
Performing Preliminary Installation Steps

Prepare for the installation by performing the following steps.
Notes:
l Before you begin installing AirWatch Tunnel, ensure that AWCM is installed correctly, running, and
communicating with AirWatch without any errors. For more information about configuring AWCMrefer to
the AirWatch AWCMGuide.
l AirWatch recommends you do not configure AirWatch Tunnel at the Global organization group level.
1. Navigate to Groups &Settings > All Settings > System > Advanced > Site URLs in the AirWatch Admin Console.
2. Ensure the URLs highlighted above are correct:

RESTAPIURL Should be in the format "https://<url>/api".
AWCM Server External URL Should be in the format "server.acme.com" and not include a protocol such as https.
AWCM Service Internal URL Should be in the format "https://server.acme.com".
3. Select Save.
14
Chapter 2: Installation Preparation
4. Navigate to Groups &Settings > All Settings > System > Advanced > Device Root Certificate and verify the device
root certificate exists. If it does not exist, click the Override radio button and generate the root device certificate.
5. Navigate to Groups &Settings > All Settings > System > Advanced > API > REST API and click the Override radio
button.
6. Ensure the Enable APIAccess check box is selected and an APIKey is displayed in the field highlighted above.
7. Click Save.
15
Chapter 3:
Configure MAGProxy/Content
Overview 17
Configuring MAGSettings 17
Configuring Advanced Settings 20
16
Chapter 3: Configure MAGProxy/Content
Overview
Perform the following configuration procedure to access the MAGWindows installer, which will let you download and
install the MAG Content and Proxy components.
Configuring MAGSettings
1. Navigate to Groups &Settings > All Settings > System > Enterprise Integration > AirWatch Tunnel.
If this is your first time configuring MAG, then select Configure and follow the configuration wizard screens.
Otherwise, select the Override radio button, ensure the Enable Mobile Access Gateway check box is selected, and
then select Configure to configure the following settings.
2. On the ConfigurationType screen, select Proxy and Content, since Per-App Tunnel is not available for a MAG for
Windows deployment. In the drop-down that displays, select whether you are configuring a Relay-Endpoint or Basic
MAG deployment. Selecting the information icon will show you an example for the selected type.
3. Select Next.
4. On the Details screen, configure the following settings.

Setting Description
PROXY (APP WRAPPING / BROWSER / SDK) CONFIGURATION
Relay Host This field only displays if you selected Relay-Endpoint as your configuration type. Enter the relay
Name server host name, for example, mag.acmemdm.com.
Endpoint The name given to the server where the MAG will be installed. If you plan to install the MAG on an
Host Name SSLoffloaded server, enter the name of that server in place of the Host Name.
Note:When entering the Host Name, do not include protocol (http://, https://, etc.).
Relay Port The default, recommended value is 2020. The port number automatically assigned for HTTPS
(HTTPS) communication with the MAG.
Relay- The default, recommended value is 2010. This field only displays if you selected Relay-Endpoint as
Endpoint your configuration type. This is the port used for traffic between the MAG relay and MAG endpoint.
Port Note that you should not use port 80, because IIS, which is required for MAG installation, will already
be bound to port 80.
Use Enabling Kerberos proxy support will allow access to Kerberos authentication, typically only available
Kerberos inside the corporate network, for target backend web services. Note that this does not currently
Proxy support Kerberos Constrained Delegation (KCD). For more information, see Appendix Kerberos
KDC Proxy Support.
Note:The Endpoint server needs to be on the same domain as KDC for the Kerberos Proxy to
successfully communicate with the KDC.
17
Setting Description
Realm Enter the domain of the KDCserver.
CONTENT CONFIGURATION
Relay URL This field only displays if you selected Relay-Endpoint as your configuration type. The URLused to
access the MAGContent Repository Relay from the Internet. Typically the same as the hostname
field but with an HTTP/HTTPSprotocol. For example:HTTPS://magrelay.acme.com.
Relay Port This field only displays if you selected Relay-Endpoint as your configuration type. Enter the port to
be used for traffic to and from the content repository.
Relay- This field only displays if you selected Relay-Endpoint as your configuration type. This is the port
Endpoint used for traffic between the MAG relay and MAG endpoint. Note that you should not use port 80,
Port because IIS, which is required for MAG installation, will already be bound to port 80.
Content Enter the FQDN(absolute domain name) of the MAGendpoint.
Repository
URL /
Endpoint
URL
Content Enter the port to be used for traffic to and from the content repository.
Repository
/ Relay-
Endpoint
Port
5. Select Next.
6. On the SSL screen, configure the following settings.

Setting Description
PROXY (APP WRAPPING / BROWSER / SDK) SSL CERTIFICATE
Use Public Select the Use Public SSLCertificate check box if you are using third party public SSLcertificates
SSLCertificate for encryption between wrapped apps, AirWatch Browser, or SDK-enabled apps and the MAG.
Select Upload to browse for and upload your certificate file (.pfx or .p12). This file must contain
both your public and private key pair.
CONTENT SSL CERTIFICATE
Use Public Select the Use Public SSLCertificate check box if you are using third party public SSLcertificates
SSLCertificate for encrypting traffic between the device and MAG.
Select Upload to browse for and upload your certificate file (.pfx or .p12). This file must contain
both your public and private key pair.
Ignore SSL Select to ignore SSL errors that occur during communication between the AirWatch Admin
Errors Console and the content repository.
7. Select Next.
18
8. On the Authentication screen, configure the following settings.

Setting Description
Proxy Select whether to use an enterprise Certificate Authority (CA) in place of AirWatch issued
Authentication certificates for authentication between wrapped apps, AirWatch Browser, or SDK-enabled apps
and the AirWatch Tunnel.
Select Default to use AirWatch issued certificates.
Select Enterprise CAto display drop-downs for your certificate authority and certificate template
that you have configured in AirWatch. Also upload your root certificate of your CA.
Note:The CA template must contain the following field in the subject name: CN=UDID.
Supported CAs are ADCS, RSA and SCEP. For more information about integrating with your
certificate provider, please see the certificate management documentation for your CA,
available via AirWatch Resources in the Certificate Management section.
9. Select Next.
10. On the Miscellaneous screen, you can configure whether to enable access logs for the Proxy component.
You must enable this log before you install AirWatch Tunnel. For more information on these settings, refer to the
Access Logs and Syslog Integration and Configuring Advanced Settings sections.
11. Review the summary of your MAGconfiguration and select Save. You are navigated back to the MAG Configuration
page.
12. If you plan to install the MAG on an SSL offloaded server, click Export MAG Certificate from the AirWatch Admin
Console once the certificate has been generated. Then, import the certificate on the server performing SSL offload.
(This server can be a load balancer or reverse proxy.)
13. Select the General tab and then select the Download Windows Installer hyperlink. This downloads a single .exe file
used for installation of both a relay server and endpoint.
Note:If you want to enable Access Logs using syslog, then you need to enable this via the Advanced tab before
you download and run the installer. See Access Logs and Syslog Integration for more information.
14. Enter and confirm a certificate password and then click Download.
Note:The MAG password must contain a minimum of six characters and will be used during installation.
15. Click Save.
16. Continue with the steps for MAG Proxy/Content Installation for a Relay-Endpoint Configuration on Windows or
MAGProxy/Content Installation for a Basic (Endpoint only) Configuration on Windows, depending on the
configuration you selected.
19
Configuring Advanced Settings

The Advanced settings tab lets you configure additional settings that are optional for a MAG/AirWatch Tunnel
deployment. These settings are described below. Except where noted, these settings can be configured before or after
installation.
1. Navigate to Groups &Settings > All Settings > System > Enterprise Integration > AirWatch Tunnel and select the
Advanced tab.
2. Configure the following MAG/AirWatchTunnel settings:

Setting Description
Enable API and Enable this option if the communication between the MAGrelay and AirWatch APIor AWCMis
AWCMoutbound through an outbound proxy.
calls via proxy
Show detailed Enable this option to ensure client applications (for example, AirWatch Secure Browser) are
errors informed when the MAG fails to authenticate a device.
Log Level Set the appropriate logging level, which will determine how much data is reported to the .log
files.
Enable Access Enable this setting to tell MAG to write access logs to syslog for any of your own purposes.
Logs These logs are not stored locally; they are pushed to the syslog host over the port you define.
There is no correlation between this syslog integration and the integration accessed via Groups
&Settings > All Settings > System > Enterprise Integration > Syslog.
Note: You must enable this before you install any of the components. Any changes you
make to the access logs configuration on the AirWatch Admin Console require re-
installation of the AirWatch Tunnel server.
Syslog Host This setting displays after you select Enable Access Logs. Enter the URLof your syslog host.
Port This setting displays after you select Enable Access Logs. Enter the Port over which you wish to
communicate with the syslog host.
3. If applicable, configure the following Kerberos Proxy settings, which will display if you selected to Use Kerberos Proxy
during MAG / AirWatch Tunnel configuration. If the realm info you entered during configuration does not work
properly, you have the option of entering the KDCIPaddress here, which will override the information you provided
during configuration.
Setting Description
KDCServer This field will only display if you selected to Use Kerberos Proxy during MAG / AirWatch Tunnel
IP configuration. Enter your KDCServer IPaddress.
Kerberos This field will only display if you selected to Use Kerberos Proxy during MAG / AirWatch Tunnel
Proxy Port configuration. Enter the port over which MAG / AirWatch Tunnel will communicate with your
Kerberos Proxy.
4. If applicable, configure the following Per-App Tunneling settings:
20
Setting Description
Log Set the appropriate logging level, which will determine how much data is reported to the .log files.
Level
Enable Enable this setting to tell the AirWatch Tunnel to write access logs to syslog for any of your own purposes.
Access These logs are not stored locally; they are pushed to the syslog host over the port you define. There is no
Logs correlation between this syslog integration and the integration accessed via Groups &Settings > All
Settings > System > Enterprise Integration > Syslog.
Note: You must enable this before you install any of the components. Any changes you make to the
access logs configuration on the AirWatch Admin Console require re-installation of the AirWatch
Tunnel server.
Syslog This setting displays after you select Enable Access Logs. Enter the URLof your syslog host.
Host
Port This setting displays after you select Enable Access Logs. Enter the Port over which you wish to
communicate with the syslog host.
5. If applicable, configure the following Relay - Endpoint Authentication Credentials settings, which are used for
authentication between the two servers. These fields will be pre-populated for you after configuration, but you can
change them, for example, to meet your organization's password strength requirements.
Setting Description
Username Enter the username used to authenticate the relay and endpoint servers.
Password Enter the password used to authenticate the relay and endpoint servers.
6. Select Save.
Note:After modifying any of these settings, you must restart the MAGservice for the changes to take effect.
21
Chapter 4:
MAG Proxy/Content Installation for a
Relay-Endpoint Configuration on
Windows
Overview 23
Installing the MAG 23
22
Chapter 4: MAG Proxy/Content Installation for a Relay-Endpoint Configuration on Windows
Overview
Perform the following steps to install the MAG for a Relay-Endpoint configuration, which you can view below. Verify the
presence of IIS and install Java on the MAG server as needed, as noted in the Requirements section.
Before You Install
Note:Before you begin, ensure the server you are installing MAGon can reach AWCM by browsing to "https://
{url}:<port>/awcm/status", where <port> is the configurable external port for AWCM. You should see the status of
the AWCMwith no SSLerrors. If there are errors, resolve them before continuing or the MAGwill not properly
function.
Example of a Relay-Endpoint Configuration
For more information about the supported MAGconfigurations and deployment models, refer to the AirWatch Mobile
Access Gateway Admin Guide, available via AirWatch Resources.
Installing the MAG

The process below walks you through installing the MAG on the Relay server first. Immediately afterward, follow the
instructions for installing the MAG on the Endpoint server.
Relay Server
1. Open the installer executable on the Relay MAGserver and then click Next. For Relay-Endpoint configurations, you
must perform MAGinstallation on both the Relay and Endpoint servers. The steps below assume you are first
installing it on the Relay server.
Note:If a previous version of MAG is installed, the installer auto-detects it and offers the option to upgrade to
the latest version.
2. Accept the End User License Agreement and then click Next.
23
3. Specify the destination for the downloaded MAGinstallation files and then click Next.
4. Select the Relay button to first install MAG on the Relay server.
24
5. Select Is this server SSLOffloaded? if you are setting up a reverse proxy configuration with SSLOffloading. For more
information see the Appendix SSLOffloading section.
6. Select Next.
7. Enter the Certificate Password you created in the AirWatch Admin Console and then click Next.
8. Select the Target Site in which the AirWatch application should be installed using the drop-down menu and then click
Next.
25
If Windows Firewall is turned on, you may receive the following dialog indicating that certain profiles are enabled. In
this case, please ensure the necessary MAGports which include both the ones you configured in the AirWatch
Admin Console and the default IISwebsite port you are using to access content are allowed in the Windows Firewall
settings.
9. Click Install to begin MAG installation on the server.
26
10. Click Finish to close the MAGinstaller.

Review the activity found in the .log file created by the MAG installer to verify successful MAGinstallation. The file can be
found in the same destination folder where the installer executable was initially downloaded.
Next, you will install the MAGon the Endpoint server.
Endpoint Server
1. Open the installer executable on the Endpoint MAGserver and then click Next.
the latest version.
27
4. Select the Endpoint button to install MAG on the Endpoint server.
5. Select the check box to indicate if MAGwill use an outbound proxy. If so, enter the address of the Proxy Host and
Proxy Port number to be used for communication. If the proxy requires authentication, first select the Does the
proxy require authentication credentials?checkbox, then select whether it uses Basic or NTLMauthentication, then
specify the Username and Password credentials.
6. Specify whether you are using Proxy auto-configuration (PAC)files as part of your MAGinstallation. A PAC file is a
set of rules that a browser checks to determine where traffic gets routed. For MAG, traffic is checked against the PAC
file to determine if it has to go through an outbound proxy. If you have authentication for PAC files, then the MAG
must know username and password of the proxy. You can reference a PAC file on a remote server by providing the
PACURL or Upload a PACfile directly.
28
Note:If you are accessing outbound proxies through the MAG that use a PACfile and also require authentication,
then refer to Appendix:Outbound Proxies using PACFiles.
When you are finished, click Next.
Next.
29
settings.
30
Verify Installation
found in the same destination folder where the installer executable was initially downloaded. Additionally, select Test
Connection on the MAG configuration page (Groups &Settings > All Settings > System > Enterprise Integration >
AirWatch Tunnel) in the AirWatch Admin Console to verify the installation. This page will tell you MAGversion info,
connectivity to the MAGvia HTTP/S, and certificate chain and content endpoint validation.
Note for on-premise customers:If you are an on-premise customer and your AirWatch Console server is installed on
the internal network, then you may see fail connection for the Console To line items. This is the expected behavior
when the Console server does not have access to the MAGRelay server in the DMZ and will not affect
MAGfunctionality.
At this time you can also review the Advanced MAG settings.
31
Chapter 5:
MAGProxy/Content Installation for a
Basic (Endpoint only) Configuration on
Windows
Overview 33
Installing MAG for Basic (Endpoint only)Configurations 33
32
Chapter 5: MAGProxy/Content Installation for a Basic (Endpoint only) Configuration on Windows
Overview
Perform the following steps to install the MAG for a Basic configuration, which you can view below. Verify the presence of
IIS and install Java on the MAG server as needed, as noted in the Requirements section.
Before You Install
Note:Before you begin, ensure the server you are installing MAGon can reach AWCM by browsing to "https://
{url}:<port>/awcm/status", where <port> is the configurable external port for AWCM. You should see the status of
the AWCMwith no SSLerrors. If there are errors, resolve them before continuing or the MAGwill not properly
function.
Example of a Basic Configuration
For more information about the supported MAGconfigurations and deployment models, refer to the AirWatch Mobile
Access Gateway Admin Guide, available via AirWatch Resources.
Installing MAG for Basic (Endpoint only)Configurations

1. Open the installer executable on the Endpoint MAGserver and then click Next.
the latest version.
33
4. Select the check box to indicate if MAGwill use an outbound proxy. If so, enter the address of the Proxy Host and
Proxy Port number to be used for communication. If the proxy requires authentication, first select the Does the
proxy require authentication credentials?checkbox, then select whether it uses Basic or NTLMauthentication, then
specify the Username and Password credentials.
34
5. Specify whether you are using Proxy auto-configuration (PAC)files as part of your MAGinstallation. A PAC file is a
set of rules that a browser checks to determine where traffic gets routed. For MAG, traffic is checked against the PAC
file to determine if it has to go through an outbound proxy. If you have authentication for PAC files, then the MAG
must know username and password of the proxy. You can reference a PAC file on a remote server by providing the
PACURL or Upload a PACfile directly.
Note:If you are accessing outbound proxies through the MAG that use a PACfile and also require authentication,
then refer to Appendix:Outbound Proxies using PACFiles.
When you are finished, click Next.
35
Next.
settings.
36
Verify Installation
found in the same destination folder where the installer executable was initially downloaded. Additionally, select Test
Connection on the MAG configuration page (Groups &Settings > All Settings > System > Enterprise Integration >
AirWatch Tunnel) in the AirWatch Admin Console to verify the installation. This page will tell you MAGversion info,
connectivity to the MAGvia HTTP/S, and certificate chain and content endpoint validation.
37
Note for on-premise customers:If you are an on-premise customer and your AirWatch Console server is installed on
the internal network, then you may see fail connection for the Console To line items. This is the expected behavior
when the Console server does not have access to the MAGendpoint in the DMZ and will not affect MAGfunctionality.
At this time you can also review the Advanced MAG settings.
38
Chapter 6:
Managing MAG
Overview 40
Upgrading the Component 40
Access Logs and Syslog Integration 40
SSLOffloading 41
Kerberos KDC Proxy Support 42
Outbound Proxies using PACFiles 45
39
Chapter 6: Managing MAG
Overview
The following topics cover various management tasks you can perform for the AirWatch Mobile Access Gateway once it is
installed. This includes traffic management, uninstallation, and upgrades.
Upgrading the Component

To upgrade, simply download and run the installer again using the same procedures outlined previously in this
document, depending on your configuration setup. Note that any custom changes you made to configuration files after
the original installation will be lost, so you may want to make backups of these files to reference later.
Upgrading the MAG for Windows Proxy/ContentComponents

1. Log in to the AirWatch Admin Console and navigate to Groups &Settings > All Settings > System > Enterprise
Integration > AirWatch Tunnel.
2. Select the General tab and then select the Download Windows Installer hyperlink.
3. Enter and confirm a certificate password and then click Download.
Note:The MAGpassword must contain a minimum of six characters.
4. Continue with the steps for MAG Installation for a Relay-Endpoint Configuration or MAGInstallation for a Basic
(Endpoint only) Configuration.
Access Logs and Syslog Integration

AirWatch provides support for access logs and syslog integration for the Proxy component of MAG.To generate access
logs, navigate to Groups &Settings > All Settings > System > Enterprise Integration > AirWatch Tunnel and select the
Advanced tab. Then, select the check box to Enable Access Logs under the appropriate component and enter your syslog
details. Access logs are generated in the standard HTTP Apache logs format and directly transferred to the syslog host
you defined. They are not stored locally on the MAG/AirWatch Tunnel server.
Note: You must enable this before you install any of the components. Any changes you make to the access logs
configuration on the AirWatch Admin Console require re-installation of the AirWatch Tunnel server.
How to enable a Linux server to act as a syslog host:
40
Most Linux servers by default have support for syslog. To enable a Linux server to act as syslog host, navigate to
rsyslog.conf:
vi /etc/rsyslog.conf
Uncomment the features under UDP syslog reception:
# Provides UDP syslog reception

$ModLoad imudp
$UDPServerRun 514
To view the logs, type the following command:
tail f /var/log/messages | grep <rsyslog_dent>
Make sure UDP port 514 is open routing to syslog server:
-A INPUT p udp m udp dport 514 j ACCEPT
SSLOffloading
Note:SSLOffloading is supported for the Proxy component.
Overview
When accessing HTTPendpoints using HTTPTunneling, all HTTPtraffic is encrypted and authenticated using an
SSLcertificate and sent over port 2020 as HTTPS. You can perform SSLOffloading with products such as F5's BIG-IPLocal
Traffic Manager (LTM), or Microsoft's Unified Access Gateway (UAG), Threat Management Gateway (TMG) or Internet
Security and Acceleration Server (ISA) solutions. While these are common solutions, support is not exclusive to these.
MAG/AirWatch Tunnel is compatible with general SSL Offloading solutions provided that the solution supports the HTTP
CONNECT method. The following diagram illustrates how SSLOffloading affects traffic in a Relay-Endpoint configuration.
41
SSLOffloading Traffic Flow

1. A device requests access to content or resources, which can be either an HTTP or HTTPS endpoint.
l Requests to HTTP and HTTPS endpoints are sent over a single port that you configure as the HTTPS port in the
AirWatch Admin Console during MAGConfiguration.
2. The traffic hits an SSL Termination Proxy (customers use their own SSL termination proxy), which must contain the
AirWatch certificate exported from the AirWatch Admin Console or your organization's own public certificate.
l Requests to HTTP endpoints over the port you configure have their SSL certificate offloaded and sent to the
Relay unencrypted over port 2020.
l Requests to HTTPS endpoints over the port you configure are unaffected and continue to the Relay over port
2020.
3. The traffic continues from the Relay to the Endpoint on a port you configure.
4. The Endpoint communicates with your backend systems to access the requested content or resources.
Enabling SSLOffloading
To enable SSLOffloading, ensure the SSLOffloading setting is selected/enabled during installation for the Relay server.
This informs the Relay to expect to receive all traffic on the port you configured.
Kerberos KDC Proxy Support
Note:Kerberos KDCProxy Support is supported for the Proxy component.
MAG/AirWatch Tunnel Proxy supports Kerberos authentication in the requesting application. This new component,
Kerberos KDC proxy (KKDCP), gets installed on the endpoint server. AirWatch KKDCP acts as a proxy to your internal KDC
server. AirWatch-enrolled and compliant devices with a valid AirWatch issued identity certificate can be allowed to access
your internal KDC. For a client application to authenticate to Kerberos- enabled resources, all of the Kerberos requests
need to be passed through KKDCP. The basic requirement for Kerberos authentication is to make sure you install the
Endpoint with Kerberos proxy enabled during configuration in a network where it can access the KDC server.
Note: Currently, this functionality is only supported with the AirWatch Browser v2.5 and higher for Android.
You can enable Kerberos proxy settings in the following manner:
42
1. During the configuration, check the box Use Kerberos proxy and enter the Realm of the KDC server.
2. If the Realm is not reachable then you can configure the KDC server IP on the Advanced settings tab in system
settings.
Note: Only add the IP if the Realm is not reachable, as it will take precedence over the Realm value entered in the
configuration.
Note: By default the Kerberos proxy server uses port 2040, which is internal only, hence no firewall changes are
required to have external access over this port.
3. Save the settings and download the installer to install MAG.
43
On Windows, once the MAG is installed you will see that a new Windows service called AirWatch Kerberos Proxy has
been added.
4. Enable Kerberos from the SDK settings in the AirWatch Admin Console so the requesting application is aware of the
KKDCP. To do this, navigate to Groups & Settings > All Settings > Apps > Settings And Policies and select Security
Policies. Under Integrated Authentication, select Enable Kerberos. Save the settings.
How to Access Logs

The path for KKDCP logs for MAGfor Windows is:\AirWatch\Logs\MobileAccessGateway
To make sure the AirWatch KKDCP server is up and running, access the following URL in your browser from the server
where KKDCP is installed: http://localhost:2040/kerberosproxy/status
If the proxy server is working as expected then the browser should return the following response:
{
"kdcServer":"internal-dc01.internal.local.:88",
"kdcAccessible":true
44
Outbound Proxies using PACFiles
Note:Outbound Proxies using PAC files is supported for the Proxy component.
Using the Proxy Tool

l Use arrows, tab, shift+tab to navigate.
l Use Enter or spacebar to select/deselect a proxy.
l Use Alt+Enter to see details of the highlighted proxy.
l Use Ctrl+V to paste on text controls.
l Use F1 to invoke context sensitive help.
l Use Esc to exit a window.
For Mobile Access Gateway Proxy Component

If you are accessing outbound proxies through the MAG that use a PACfile and also require authentication, then you will
need to perform the following steps:
1. In Windows Explorer, navigate to \AirWatch\MobileAccessGateway\tools.
2. Run proxy-tools. The Proxy Tool dialog displays.
3. Select your authentication method, which can be None, Basic, or NTLM for a single service account. Also enter your
credentials, if applicable, and the URIof the proxy for testing.
4. Select Save.
45
Finding Additional Documentation

While reading through this documentation you may encounter topics that reference other documents that are not
included here. You may also be looking for separate documentation that is not a part of this resource. You can access this
additional documentation through the AirWatch Resources page (https://resources.air-watch.com) on myAirWatch.
Note: It is always recommended you pull the document from AirWatch Resources each time you need to reference it.
To search for and access additional documentation via the AirWatch Resources page, perform the following step-by-step
instructions:
1. Navigate to http://my.air-watch.com and log in using your AirWatch ID credentials.
2. Select AirWatch Resources from the navigation bar or home screen. The AirWatchResources page displays with a list
of recent documentation and a list of Resources Categories on the left.
3. Select your AirWatch Version from the drop-down list in the search parameters to filter a displayed list of documents.
Once selected, you will only see documentation that pertains to your particular version of AirWatch.
4. Access documentation using the following methods:

l Select a resource category on the left to view all documents belonging to that category. For example, selecting
Documentation filters your search to include the entire technical documentation set. Selecting Platform filters
your search to only include platform guides.
l Search for a particular resource using the search box in the top-right by entering keywords or document names.
l Add a document to your favorites and it will be added to My Resources. Access documents you have favorited
by selecting myAirWatch from the navigation bar and then selected My Resources from the toolbar.
46
l Download a PDF of a document by selecting the button. Note, however, that documentation is frequently
updated with the latest bug fixes and feature enhancements. Therefore, it is always recommended you pull the
document from AirWatch Resources each time you need to reference it.
Having trouble finding a document?Make sure a specific AirWatch Version is selected. All Versions will typically
return many results. Make sure you select Documentation from the category list, at a minimum. If you know which
category you want to search (e.g., Platform, Install &Architecture, EmailManagement) then selecting that will also
further narrow your search and provide better results. Filtering by PDFas a File Type will also narrow your search
even further to only include technical documentation manuals.
47

AirWatch MAG Install Guide For Windows v8 - 2

Hochgeladen von

Dokumentinformationen

Originaltitel

Copyright

Verfügbare Formate

Dieses Dokument teilen

Dokument teilen oder einbetten

Freigabeoptionen

Stufen Sie dieses Dokument als nützlich ein?

Sind diese Inhalte unangemessen?

Copyright:

Verfügbare Formate

AirWatch MAG Install Guide For Windows v8 - 2

Hochgeladen von

Copyright:

Verfügbare Formate

AirWatch Mobile Access Gateway Installation

Guide for Windows for On-Premise Customers

Chapter 2: Installation Preparation 13

Chapter 3: Configure MAGProxy/Content 16

Chapter 4: MAG Proxy/Content Installation for a Relay-Endpoint Configuration

Chapter 5: MAGProxy/Content Installation for a Basic (Endpoint only)

Chapter 6: Managing MAG 39

Finding Additional Documentation 46

Introduction to Mobile Access Gateway Installation for Windows

Prerequisites for MAGProxy/Content Connectivity for On-Premise

Sizing for up to 100,000 Devices

Source Component Destination Component Protocol Port Verification Note

Source Component Destination Component Protocol Port Verification Note

1. For devices attempting to access internal resources.

Performing Preliminary Installation Steps

2. Ensure the URLs highlighted above are correct:

4. On the Details screen, configure the following settings.

6. On the SSL screen, configure the following settings.

8. On the Authentication screen, configure the following settings.

15. Click Save.

Configuring Advanced Settings

2. Configure the following MAG/AirWatchTunnel settings:

4. If applicable, configure the following Per-App Tunneling settings:

Before You Install

Example of a Relay-Endpoint Configuration

Installing the MAG

9. Click Install to begin MAG installation on the server.

10. Click Finish to close the MAGinstaller.

4. Select the Endpoint button to install MAG on the Endpoint server.

When you are finished, click Next.

9. Click Install to begin MAG installation on the server.

10. Click Finish to close the MAGinstaller.

Before You Install

Example of a Basic Configuration

Installing MAG for Basic (Endpoint only)Configurations

When you are finished, click Next.

8. Click Install to begin MAG installation on the server.

9. Click Finish to close the MAGinstaller.

Upgrading the Component

Upgrading the MAG for Windows Proxy/ContentComponents

3. Enter and confirm a certificate password and then click Download.

Note:The MAGpassword must contain a minimum of six characters.

Access Logs and Syslog Integration

How to enable a Linux server to act as a syslog host:

Uncomment the features under UDP syslog reception:

# Provides UDP syslog reception

To view the logs, type the following command:

tail f /var/log/messages | grep <rsyslog_dent>

Make sure UDP port 514 is open routing to syslog server:

-A INPUT p udp m udp dport 514 j ACCEPT

Note:SSLOffloading is supported for the Proxy component.

SSLOffloading Traffic Flow

Kerberos KDC Proxy Support

Note:Kerberos KDCProxy Support is supported for the Proxy component.

You can enable Kerberos proxy settings in the following manner:

3. Save the settings and download the installer to install MAG.

How to Access Logs

Outbound Proxies using PACFiles

Using the Proxy Tool

l Use Enter or spacebar to select/deselect a proxy.

l Use Alt+Enter to see details of the highlighted proxy.

l Use Ctrl+V to paste on text controls.

l Use F1 to invoke context sensitive help.