VMware AirWatch

 

1Introduction

AirWatch is a VMware Enterprise Mobility Management (EMM) software product, which allows an enterprise’s employees and associates use mobile devices. When deployed with KEMP LoadMasters, AirWatch is secure, multi-tenant, highly scalable and can be integrated with existing enterprise systems, be they on-site or in the cloud. AirWatch supports all major mobile players including; Apple iOS, Android, Symbian and Windows Phone.

Users require confidence that the service is available when needed. KEMP LoadMasters help provide reliability. When deployed as a pair, two LoadMasters give the security of High Availability (HA). HA allows two physical or virtual machines to become one logical device. Only one of these units is ever handling traffic at any particular moment. One unit is active and the other is a hot standby (passive). This provides redundancy and resiliency, meaning if one LoadMaster goes down for any reason, the hot standby can become active, therefore avoiding any downtime. For more information on HA please refer to the: High Availability (HA), Feature Description.

1.1Document Purpose

This document provides guidance on deploying AirWatch with a KEMP LoadMaster. The KEMP Support Team is available to provide solutions for scenarios not explicitly defined.

The KEMP support site can be found at: https://support.kemptechnologies.com.

1.2Intended Audience

This document is for anyone deploying AirWatch with a KEMP LoadMaster.

1.3Architecture

Figure 1‑1: Example AirWatch Deployment Architecture

2AirWatch Template

KEMP has developed a template containing our recommended settings for various AirWatch Virtual Services. This template can be installed on the LoadMaster and used when creating Virtual Services. Using a template automatically populates the settings in the Virtual Services. This is quicker and easier than manually configuring each Virtual Service. If needed, changes can be made to any of the Virtual Service settings after using the template.

Download released templates from the Templates section on the KEMP documentation page: http://kemptechnologies.com/documentation/.

For more information and steps on how to import and use templates, refer to the Virtual Services and Templates, Feature Description.

3Configure the LoadMaster

The following sections provide step-by-step instructions on how to configure a LoadMaster to load balance the AirWatch workload.

3.1Enable Subnet Originating Requests Globally

It is best practice to enable the Subnet Originating Requests option globally.

In a one-armed setup (where the Virtual Service and Real Servers are on the same network/subnet) Subnet Originating Requests is usually not needed. However, enabling Subnet Originating Requests should not affect the routing in a one-armed setup.

In a two-armed setup where the Virtual Service is on network/subnet A, for example, and the Real Servers are on network B - Subnet Originating Requests should be enabled on LoadMasters with firmware version 7.1-16 and above.

When Subnet Originating Requests is enabled, the LoadMaster will route traffic so that the Real Server will see traffic arriving from the LoadMaster interface that is in that network/subnet.

When Subnet Originating Requests is enabled globally, it is automatically enabled on all Virtual Services. If the Subnet Originating Requests option is disabled globally, you can choose whether or not to enable Subnet Originating Requests on a per-Virtual Service basis.

To enable Subnet Originating Requests globally, follow the steps below:

  1. In the main menu of the LoadMaster WUI, go to System Configuration > Miscellaneous Options > Network Options.

Figure 3‑1: Subnet Originating Requests

  1. Tick the Subnet Originating Requests check box.

3.2Configure AirWatch Mobile Access Gateway (MAG) Virtual Services

When configuring the LoadMaster to load balance AirWatch MAG, three Virtual Services must be set up.

3.2.1Configure AirWatch MAG Virtual Service

The following are the steps involved and the recommended settings to configure an AirWatch MAG Virtual Service:

  1. In the main menu of the LoadMaster Web User Interface (WUI), go to Virtual Services> Add New.

Figure 3‑2: Virtual Service Parameters

  1. Enter a valid IP address in the Virtual Address text box.
  2. Enter 443 in the Port text box.
  3. Enter a recognizable Service Name, for example AirWatch MAG.
  4. Ensure tcp is selected as the Protocol.
  5. Click Add this Virtual Service.
  6. Configure the settings as recommended in the following table:

Section

Option

Value

Comment

Standard Options

Transparency

Disabled

 
 

Persistence Mode

Source IP Address

 
 

Timeout

30 Minutes

 
 

Scheduling Method

round robin

 
 

Idle Connection Timeout

3600

Click Set Idle Timeout.

Real Servers

Real Server Check Parameters

HTTPS Protocol

 
 

HTTP Method

HEAD

Click the Add New button

Table 3-1: AirWatch MAG Recommended Settings

  1. Add the Real Servers.

a)Enter the IP address of the AirWatch server.

b)Enter 443 as the Port.

The Forwarding method and Weight values are set by default. An administrator can change these.

c)Click Add this Real Server. Click OK to the pop-up message.

d)Repeat steps a) to c) above to add more Real Servers as needed, based on the environment.

3.2.2Configure AirWatch MAG Port 2010 Virtual Services

The following are the steps involved and the recommended settings to configure an AirWatch MAG port 2010 Virtual Service:

  1. In the main menu of the LoadMaster WUI, go to Virtual Services> Add New.

Figure 3‑3: Virtual Service Parameters

  1. Enter a valid IP address in the Virtual Address text box.
  2. Enter 2010 in the Port text box.
  3. Enter a recognizable Service Name, for example AirWatch MAG port 2010.
  4. Ensure tcp is selected as the Protocol.
  5. Click Add this Virtual Service.
  6. Configure the settings as recommended in the following table:

Section

Option

Value

Comment

Standard Options

Transparency

Disabled

 
 

Server Initiating Protocols

Normal Protocols

 
 

Persistence Options

Source IP Address

 
 

Timeout

30 Minutes

 
 

Scheduling Method

round robin

 
 

Idle Connection Timeout

3600

Click Set Idle Timeout.

Real Servers

Real Server Check Parameters

TCP Connection Only

 
 

Checked Port

2010

Click Set Checked Port.

Table 3-2: AirWatch MAG Port 2010 Recommended Settings

  1. Add the Real Servers.

a)Enter the IP address of the AirWatch server.

b)Enter 2010 as the Port.

The Forwarding method and Weight values are set by default. An administrator can change these.

c)Click Add this Real Server. Click OK to the pop-up message.

d)Repeat steps a) to c) above to add more Real Servers as needed, based on the environment.

3.2.3Configure AirWatch MAG Port 2020 Virtual Service

The following are the steps involved and the recommended settings to configure an AirWatch MAG port 2020 Virtual Service:

  1. In the main menu of the LoadMaster WUI, go to Virtual Services> Add New.

Figure 3‑4: Create a new Virtual Service Initial Screen

  1. Enter a valid IP address in the Virtual Address text box.
  2. Enter 2020 in the Port text box.
  3. Enter a recognizable Service Name, for example AirWatch MAG Port 2020.
  4. Ensure tcp is selected as the Protocol.
  5. Click Add this Virtual Service.
  6. Configure the settings as recommended in the following table:

Section

Option

Value

Comment

Standard Options

Transparency

Disabled

 
 

Server Initiating Protocols

Normal Protocols

 
 

Persistence Options

Source IP Address

 
 

Timeout

30 Minutes

 
 

Scheduling Method

round robin

 
 

Idle Connection Timeout

3600

Click Set Idle Timeout.

Real Servers

Real Server Check Parameters

TCP Connection Only

 
 

Checked Port

2020

Click Set Checked Port thenclick the Add New button.

Table 3-3: AirWatch MAG Port 2020 Recommended Settings

  1. Add Real Servers.

a)Enter the IP address of the AirWatch server.

b)Enter 2020 as the Port.

The Forwarding method and Weight values are set by default. An administrator can change these.

c)Click Add this Real Server. Click OK to the pop-up message.

d)Repeat steps a)a) to c) above to add more Real Servers as needed, based on the environment.

3.3Configure an AirWatch Secure Email Gateway (SEG) Virtual Service

The following are the steps involved and the recommended settings to configure an AirWatch SEG Virtual Service:

  1. In the main menu of the LoadMaster Web User Interface (WUI), go to Virtual Services> Add New.

Figure 3‑5: Create a new Virtual Service Initial Screen

  1. Enter a valid IP address in the Virtual Address text box.
  2. Enter 443 in the Port text box.
  3. Enter a recognizable Service Name, for example AirWatch SEG.
  4. Ensure tcp is selected as the Protocol.
  5. Click Add this Virtual Service.
  6. Configure the settings as recommended in the following table:

Section

Option

Value

Comment

Standard Options

Force L4

Clear

 
 

Transparency

Clear

 
 

Persistence Options

Source IP Address

 
 

Timeout

30 Minutes

 
 

Scheduling Method

round robin

 

Real Servers

Real Server Check Parameters

HTTPS Protocol

 
 

HTTP Method

Head

Click the Add New button.

Table 3-4: AirWatch Secure Email Gateway (SEG) Recommended Settings

  1. Add the Real Servers:

a)Enter the IP address of the AirWatch server.

b)Enter 443 as the Port.

The Forwarding method and Weight values are set by default. An administrator can change these.

c)Click Add this Real Server. Click OK to the pop-up message.

d)Repeat steps a) to c) above to add more Real Servers as needed, based on the environment.

References

Unless otherwise specified, the following documents can be found at: http://kemptechnologies.com/documentation.

Virtual Services and Templates, Feature Description. High Availability (HA), Feature Description

Document History

Date

Change

Reason for Change

Version

Resp.

Apr 2016

Initial Draft

First draft of document

1.0

KG

Oct 2016

Release updates

Updates for 7.2.36

2.0

POC

Jan 2017

Minor change

Updated

3.0

LB

July 2017

Minor changes

Updated to new template

4.0

POC

Was this article helpful?

0 out of 0 found this helpful

Comments