Mobile Device Manager Plus (MDM) Architecture

ManageEngine Mobile Device Manager Plus supports managing your mobile devices from a single console. Mobile Device Manager Plus offers Policy Management, Profile Management, Asset Management, App Management and Security Management of different kinds of mobile devices.

The diagram given below represents the workflow of the On-Premises version of Mobile Device Manager Plus:

Note:For the architecture and functioning of Mobile Device Manager Plus Cloud, refer to this page.

Architecture

1. Any communication from Mobile Device Manager Plus to the device is routed through Apple Push Notification service (APNs) via TCP port 443 for both iOS devices and Android Devices
2. As per Apple iOS MDM protocol, all iOS devices maintain a dedicated TCP connection with APNs at TCP port 5223. Mobile Device Manager Plus leverages this to wake up a device using APNs.
3. Device communicates with MDM server for available instructions at port 9383 using a secured connection.
4. Executes the instructions and reports back to MDM server with the status/data at port 9383 securely.

For the above setup to work, the following should be done:

Assuming user's mobility, MDM server should be reachable via public IP address. You should NAT your internal IP of MDM server to a public IP to enable this. If all the devices managed are within the LAN, this requirement is not needed.

Protocols:

TCP and TLS protocols are used for enrolling devices in MDM.

Port Details

TCP Ports that needs to be opened at MDM Server

9383 - Used for secured communication between the agent and the Mobile Device Manager Plus

TCP Ports that needs to be opened for managing iOS devices

443 - Should be open at the firewall/ proxy for MDM server to reach APNs. Host address: api.push.apple.com

5223 - If the mobile device connects to the internet through the Wi-Fi, then this port should be opened. For better security, you can restrict these connections on the IP range 17.0.0.0/8. If all the managed devices have access to cellular data network, this requirement is not needed.

NOTE: If your Wi-Fi is behind a firewall or you make use of a private Access Point Name for cellular data, then ensure access has been provided to the specific ports.

TCP Ports that need to be opened for managing Android devices

443 - Used for secured communication between the MDM server and the FCM server.

Port numbers 5228, 5229, 5230, 5235,5236 should be open on the firewall, If the mobile device connects to the internet through Wi-Fi. This enables communication between the mobile devices and the FCM.

For further details on ports, click here.