Secure gateway server

How to secure communication of roaming users using Secure Gateway Server?

Description

This document will explain the steps involved in securing the communication of roaming users using Secure Gateway Server. Secure Gateway Server can be used when roaming agents access the server through internet. It prevents the exposure of UEMS Central Server directly to the internet by serving as an intermediate server between the UEMS Central server and roaming agents. This ensures that the UEMS Central Server is secure from risks and threats of vulnerable attacks.

How Secure Gateway works?

The Secure Gateway Server is a component that will be exposed to the internet. This Secure Gateway Server acts as an intermediate server between the managed roaming agents and the UEMS Central server.All communications from the roaming agents will be navigated through the Secure Gateway. When the agent tries to contact the UEMS Central server, Secure Gateway server receives all the communications and redirects to the UEMS Central Server. 

Note: Map your Secure Gateway's public IP address and UEMS Central server's private IP address to a common FQDN in your respective DNS. For example, if your FQDN is "product.server.com", map this to both your Secure Gateway and UEMS Central server IP address. By this mapping, the agents of roaming users will access UEMS Central server via Secure Gateway (using internet) and the agents within the LAN network will directly reach UEMS Central server, hence leading to quicker resolution.

Software requirements for Secure Gateway Server

You can install Secure Gateway Server on any of these Windows operating system versions:

• Windows 7
• Windows 8
• Windows 8.1
• Windows 10
• Windows Server 2008
• Windows Server 2008 R2
• Windows Server 2012 R2
• Windows Server 2016
• Windows Server 2019

Hardware requirements for Secure Gateway Server

The hardware requirements for Secure Gateway Server include the following :

Steps 

To introduce Secure Gateway based communication, follow the steps given below:

• Modify Device Control Plus Settings
• Install and configure Secure Gateway
• Infrastructure recommendations

Modify Device Control Plus Settings

1. Enter Secure Gateway IP address instead of UEMS Central server IP address under server details while adding remote office.
2. Enable secured communication (HTTPS) under DS/WAN agent to UEMS Central server communication.
3. Configure NAT settings using the Secure Gateway's public FQDN/IP address.  

• On the UEMS Central Server Console, click on Admin tab -> Server Settings -> NAT Settings.       
• Add the FQDN of the Secure Gateway server against the Public FQDN under NAT device as shown below.

Install and configure Secure Gateway

1. Download and install Secure Gateway on a machine in Demilitarized zone.
2. Enter the following details under Setting up the Secure Gateway window, which will open after the installation process.
   • Server Name: Specify the FQDN/DNS/IP address of the UEMS Central server.
   • Https Port: Specify the port number that the mobile devices use to contact the UEMS Central server. (eg: 8383 - it is recommended to use the same port 8383 (HTTPS) for UEMS Central Server in secured mode)
   • Notification Server port: 8027 (to perform on-demand operations), this will be pre-filled automatically.
   • Web Socket Port : 8443 (HTTPS), this will be pre-filled automatically.
   • File Transfer Port: 8031 (HTTPS), this will be pre-filled automatically, but it can be modified as required.
   • Username & Password: Enter Device Control Plus user's credentials with administrative privilege.

Infrastructure recommendations

Ensure that you follow the steps given below

1. Secure Gateway's Public IP address with the port 8383 (https) should be provided to UEMS Central server for accessibility verification.
2. Configure Secure Gateway in such a way, that it should be reachable via public IP/FQDN address configured in NAT settings. You can also configure the Edge Device/Router in such a way that all the request that are sent to the Public IP/FQDN address gets redirected to the Secure Gateway.
3. It is mandatory to use HTTPS communication.
4. You will have to ensure that the following port is open on the firewall for the the roaming user's agents to communicate via the Secure Gateway.

You have now secured communication between UEMS Central server and roaming users.