English dropdown-ico

Cisco Systems MaaS360 manual

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42

Go to page of

Similar user manuals

A good user manual

The rules should oblige the seller to give the purchaser an operating instrucion of Cisco Systems MaaS360, along with an item. The lack of an instruction or false information given to customer shall constitute grounds to apply for a complaint because of nonconformity of goods with the contract. In accordance with the law, a customer can receive an instruction in non-paper form; lately graphic and electronic forms of the manuals, as well as instructional videos have been majorly used. A necessary precondition for this is the unmistakable, legible character of an instruction.

What is an instruction?

The term originates from the Latin word „instructio”, which means organizing. Therefore, in an instruction of Cisco Systems MaaS360 one could find a process description. An instruction's purpose is to teach, to ease the start-up and an item's use or performance of certain activities. An instruction is a compilation of information about an item/a service, it is a clue.

Unfortunately, only a few customers devote their time to read an instruction of Cisco Systems MaaS360. A good user manual introduces us to a number of additional functionalities of the purchased item, and also helps us to avoid the formation of most of the defects.

What should a perfect user manual contain?

First and foremost, an user manual of Cisco Systems MaaS360 should contain:
- informations concerning technical data of Cisco Systems MaaS360
- name of the manufacturer and a year of construction of the Cisco Systems MaaS360 item
- rules of operation, control and maintenance of the Cisco Systems MaaS360 item
- safety signs and mark certificates which confirm compatibility with appropriate standards

Why don't we read the manuals?

Usually it results from the lack of time and certainty about functionalities of purchased items. Unfortunately, networking and start-up of Cisco Systems MaaS360 alone are not enough. An instruction contains a number of clues concerning respective functionalities, safety rules, maintenance methods (what means should be used), eventual defects of Cisco Systems MaaS360, and methods of problem resolution. Eventually, when one still can't find the answer to his problems, he will be directed to the Cisco Systems service. Lately animated manuals and instructional videos are quite popular among customers. These kinds of user manuals are effective; they assure that a customer will familiarize himself with the whole material, and won't skip complicated, technical information of Cisco Systems MaaS360.

Why one should read the manuals?

It is mostly in the manuals where we will find the details concerning construction and possibility of the Cisco Systems MaaS360 item, and its use of respective accessory, as well as information concerning all the functions and facilities.

After a successful purchase of an item one should find a moment and get to know with every part of an instruction. Currently the manuals are carefully prearranged and translated, so they could be fully understood by its users. The manuals will serve as an informational aid.

Table of contents for the manual

  • Page 1

    Int egrating Fiberlink MaaS 360 with Cisc o Identit y Ser vice s Engine Revised: August 6, 2013[...]

  • Page 2

    2[...]

  • Page 3

    3 Int e gr ating Fiberlink MaaS 360 with Cisc o Identity Ser vic es Engine ALL DESIGNS, SPECIFICA TIONS, ST A TEMENTS, INFORMA TION, AND RECOMMEND A TIONS (COLLECTIVEL Y , "DESIGNS") IN THIS MANU AL ARE PRESENTED "AS IS," WITH ALL F A UL TS. CISCO AND ITS SUPPLIERS DISCLAIM ALL W ARRANTIES, INCLUDING , WITHOUT LIMIT A TION, THE [...]

  • Page 4

    Corporate Headquarters: Copyright © 20 13 Cisco Systems, Inc. All rights reserved. Cisco Systems, Inc., 170 West Tasman Drive, San Jose, CA 95134-1706 USA Integrating Fiberlink MaaS360 with Cisco Identity Services Engine This document supplement s the Cisco Bring Y our Own Device (BY OD) CVD ( http://www .cisco.com/en/US/docs/solutions/Ent e rpris[...]

  • Page 5

    5 Int e gr ating Fiberlink MaaS 360 with Cisc o Identity Ser vic es Engine Ta b l e 1 Fiber link MaaS360—K ey Capabilities Capability Features Architecture and Adminintrat ion • SaaS delivery model • Multi-tenant, scalab le, and redundant cloud architecture • Independent SOC2 T ype II cloud compliance audit co nducted annually • Safe Harb[...]

  • Page 6

    Int e gr ating Fiberlink MaaS36 0 with Cisco Identit y Ser vice s E ngine 6 Enterprise A pplication Catalo g • Manage and distrib ute third-party and in-house mob ile apps from the Fiberlink MaaS360 Admin Portal • De velop a catalo g of recommended mobile apps on iOS and Android devices • Users can view apps, install, and be alerte d to updat[...]

  • Page 7

    7 Int e gr ating Fiberlink MaaS 360 with Cisc o Identity Ser vic es Engine The Fiberlink MaaS360 so lution has three main components: • Portals (Administration and End User) • Fiberlink MaaS 360 Server in the Cloud that manage s policies and complian ce rules • Fiberlink MaaS360 Agent software that runs on mobile de vices Beyond these, there [...]

  • Page 8

    Int e gr ating Fiberlink MaaS36 0 with Cisco Identit y Ser vice s E ngine 8 Getting Fiberlink MaaS360 Ready for ISE The first requirement is to establish basic connecti vity between the Cisco ISE server and the Fiberlink MaaS360 MDM server . A f irew all is typically located between ISE and the Fiberlink MaaS360 cloud. The fire wall should be confi[...]

  • Page 9

    9 Int e gr ating Fiberlink MaaS 360 with Cisc o Identity Ser vic es Engine Figur e 2 Exporting the MDM Site Cer tificate with Int er net Explorer Fiberlink MaaS360 utili zes a wildca rd certif icate that is v alid for all portal websites belonging to the Fiberlink MaaS360 portals d omain. Exporting a certif icate from Firef ox is co v ered in the C[...]

  • Page 10

    Int e gr ating Fiberlink MaaS36 0 with Cisco Identit y Ser vice s E ngine 10 Figur e 4 Impor ting the Cer tificate in ISE Grant ISE Access to the Fiberlink MaaS360 API The Fiberlink MaaS360 API is pro tected by HTTPS and requires an adminis trator account that has been granted permissi on to the API. Ideally a specif ic account woul d be configured[...]

  • Page 11

    11 Int e gr ating Fiberlink MaaS 360 with Cisc o Identity Ser vic es Engine Figur e 5 Manage A dministrat or A ccount Each account type can be assigned roles entitling th at user to specific features of the system. Also the role of service adminis trator can be used to manage the API from ISE.[...]

  • Page 12

    Int e gr ating Fiberlink MaaS36 0 with Cisco Identit y Ser vice s E ngine 12 Figur e 6 A dd Accoun t The MDM role created for IS E requires the REST API features. The list sho wn in Figure 7 identif ies the rights which should be selected.[...]

  • Page 13

    13 Int e gr ating Fiberlink MaaS 360 with Cisc o Identity Ser vic es Engine Figur e 7 Assign Role t o the Account Once the role as been added, an admin account can be created for ISE. Add MDM Server to ISE Once the account has been def ined on the Fiberlink MaaS360 MDM server with the proper rol es, ISE can be confi gured to use this account wh en [...]

  • Page 14

    Int e gr ating Fiberlink MaaS36 0 with Cisco Identit y Ser vice s E ngine 14 Figur e 8 Configur e the MDM API on ISE The polling interv al specif ies ho w often ISE will query th e MDM for changes to de vice posture. Polling can be disabled by setting the v alu e to 0 minutes. Pollin g can be used to periodically check t he MDM compliance posture o[...]

  • Page 15

    15 Int e gr ating Fiberlink MaaS 360 with Cisc o Identity Ser vic es Engine The T est Con nection button will attemp t to log in to the API an d is required prio r to saving the settings with the MDM set to Enable. If the test does not complete successfully , the settings can still be sa ved, b ut the Enab le box will be deselected and th e MDM wil[...]

  • Page 16

    Int e gr ating Fiberlink MaaS36 0 with Cisco Identit y Ser vice s E ngine 16 Review MDM Dictionaries When the Fiberlink MaaS360 MDM becomes acti ve, ISE w ill retrie ve a list of the supported dictionary attrib utes from the MDM. Currently Fiberli nk MaaS360 supports all of the attrib utes that ISE can query . This should remain tru e so long as bo[...]

  • Page 17

    17 Int e gr ating Fiberlink MaaS 360 with Cisc o Identity Ser vic es Engine Enterprise Integration Fiberlink MaaS360 of fers a solution t hat enables integrati on with existing ent erprise infrastructures such as AD, Ex change, and a certificate author ity . This is achiev ed using a component called Fiberli nk MaaS360 Cloud Exte nder . The Fiberli[...]

  • Page 18

    Int e gr ating Fiberlink MaaS36 0 with Cisco Identit y Ser vice s E ngine 18 The installation of the Cloud Extender is straightforward and ful ly documented by Fiberlink MaaS360. All the information requi red to install is a v ailable by logging onto Fi berlink MaaS360 and going to SETUP > Enrollment Settings, as sho wn in Figure 11 . Figur e 1 [...]

  • Page 19

    19 Int e gr ating Fiberlink MaaS 360 with Cisc o Identity Ser vic es Engine Figur e 12 Cloud Ext ender Installation Wizard[...]

  • Page 20

    Int e gr ating Fiberlink MaaS36 0 with Cisco Identit y Ser vice s E ngine 20 Figur e 13 Cloud Ext ender AD Configur ation Active Directory/LDAP Integration Integr ating ISE and the MDM to a common directo ry is important for o verall operat ions. One benefit is the ability to set a requirement that a user periodically change their di rectory passwo[...]

  • Page 21

    21 Int e gr ating Fiberlink MaaS 360 with Cisc o Identity Ser vic es Engine Figur e 14 CVD Use P olicies These groups can be extended to the MDM such th at members are issued prof iles that complement their lev el of network access. As an example, Ta b l e 3 shows some arbitrary policies th at can be established and enforced based on the CVD use ca[...]

  • Page 22

    Int e gr ating Fiberlink MaaS36 0 with Cisco Identit y Ser vice s E ngine 22 MDM Profiles Device prof iles are an important co ncept of mobile device man agement. They are def ined as part of the MDM protocol implemented by the operating sy stem. The concept can be extended to application prof iles, but as discussed here, the y are found under the [...]

  • Page 23

    23 Int e gr ating Fiberlink MaaS 360 with Cisc o Identity Ser vic es Engine Figur e 15 Creat e P olicies T o bind policies to us er groups, Go to Users > Groups and assign appropriate polic y , as shown in Figure 16 .[...]

  • Page 24

    Int e gr ating Fiberlink MaaS36 0 with Cisco Identit y Ser vice s E ngine 24 Figur e 16 Binding P olicies to User Gr oups W ith the e xample configu ration shown abov e, users that belong to BY OD_Employ ee_Access will get Full_Access_polic y pushed to their de vices. User will see tw o prof iles installed by ISE and two or three from the MDM. The [...]

  • Page 25

    25 Int e gr ating Fiberlink MaaS 360 with Cisc o Identity Ser vic es Engine Figur e 17 Enr ollment Netwo rk Fl ows 293804 APNS/GCN MDM Device Authenticate User WebEnroll Policy Assessment Mobileconfig (mdm, cert) MDM Profile Check-in Notification Device Check-in Security Scan Profile Install APNS Registration MDM Check-in Request SCEP Fiberlink Maa[...]

  • Page 26

    Int e gr ating Fiberlink MaaS36 0 with Cisco Identit y Ser vice s E ngine 26 Because ISE depends on these features for policy enforcemen t, corporate de vices and personal de vices with partial or full access should include a prof ile that specif ies the Fiberlink MaaS36 0 Agent as a mandatory appl ication. User is auto matically taken to the A pp [...]

  • Page 27

    27 Int e gr ating Fiberlink MaaS 360 with Cisc o Identity Ser vic es Engine User Experience For the most part, the fact that a de vice is un der management is seamless to the user . If they are running the mobile cli ent appli cation as recommended for ISE comp liance checks, then the use r will ha ve some additio nal information about their de vic[...]

  • Page 28

    Int e gr ating Fiberlink MaaS36 0 with Cisco Identit y Ser vice s E ngine 28 Figur e 18 MDM Enr ollmen t Figur e 19 MDM Enr ollment—Logi n[...]

  • Page 29

    29 Int e gr ating Fiberlink MaaS 360 with Cisc o Identity Ser vic es Engine Figur e 20 MDM Enrollment—T er ms of Acceptance Figur e 21 MDM Enrollment—Maas360 Profile Installation Figur e 22 MDM Enrollment—Maas360 Application Installation After the device has enrolled, the server will re ques t a check-in. Durin g the initial chec k-in, additi[...]

  • Page 30

    Int e gr ating Fiberlink MaaS36 0 with Cisco Identit y Ser vice s E ngine 30 Pass Code Complexity The user may be required to conf iguring a PIN lock on t heir device during the on-boarding process if the device is not already conf igured with one. When this occurs, the user will need to laun ch the client app and send data. This is e xplained in m[...]

  • Page 31

    31 Int e gr ating Fiberlink MaaS 360 with Cisc o Identity Ser vic es Engine • Manage and distri bute third-party and in-house mobile apps. • Allo w users to view , install, and be aler ted to updated apps on a pri vate catal og. • Manage mobile app lifec ycle workf low to al l dev ices, device group s, and indi vidual devices. • Administer [...]

  • Page 32

    Int e gr ating Fiberlink MaaS36 0 with Cisco Identit y Ser vice s E ngine 32 Figur e 25 Maas360 Applcation Corporate Data Fiberlink MaaS360 and ISE can w ork closely together to create a comprehensi ve approach to managing corporate data. This is generally kno wn as data loss prev ention (DLP). Data comes in two forms, at-rest and in-flight. Data a[...]

  • Page 33

    33 Int e gr ating Fiberlink MaaS 360 with Cisc o Identity Ser vic es Engine • Querying Exchange Serv er using Microsoft Po werShell commands and stand ard APIs for vital information related t o the Activ eSync enable d devices on the Exchange Server . The use of Po werShell and related APIs allo ws for abstract ion from the specif ics of the Exch[...]

  • Page 34

    Int e gr ating Fiberlink MaaS36 0 with Cisco Identit y Ser vice s E ngine 34 End User Portal Fiberlink MaaS360 of fers an End User portal that al lows the user to manage their de vices. Users can perform actions lik e Lock Dev ice, Locate Device, W i pe De vice, Reset Passcode, and Check-in device with Fiberlink MaaS360 servi ce. Figur e 27 Fiber l[...]

  • Page 35

    35 Int e gr ating Fiberlink MaaS 360 with Cisc o Identity Ser vic es Engine The attributes sho wn in Ta b l e 4 should help clarify the diff eren ce between compliance policies. Ta b l e 4 Compliance At tr ibutes ISE Compliance Attributes Fiberlink MaaS360 Compliance Attributes Before using the De viceCompliantStatus attrib ute pro vided by the MDM[...]

  • Page 36

    Int e gr ating Fiberlink MaaS36 0 with Cisco Identit y Ser vice s E ngine 36 Currently the MDM does not pr ovide a method to mar k compliance checks that are not reported to ISE. ISE cannot assert that netw ork security issue caused a de vice to be MDM non-compliant. Device Compliance/Restrictions Restrictions and compliance are dis tinct but relat[...]

  • Page 37

    37 Int e gr ating Fiberlink MaaS 360 with Cisc o Identity Ser vic es Engine PINLockStatus The PINLockStatus is a vail able to the API and can be used by ISE to set a minimum requirement for network access, as sho w n in t he CVD. Fiberli nk MaaS360 allo ws the admini strator to create a PIN lock polic y and set rules to force users to se t PINs wit[...]

  • Page 38

    Int e gr ating Fiberlink MaaS36 0 with Cisco Identit y Ser vice s E ngine 38 Jailbroken or Rooted devices These are de vices where the user ha s gained direct access to the oper ating system, bypassing the control imposed on the de vice by the service pro vider . Devices in this state are generally considered compromised and th ere has been some re[...]

  • Page 39

    39 Int e gr ating Fiberlink MaaS 360 with Cisc o Identity Ser vic es Engine • Reassign the de vice to a secured locatio n group. This group ef fecti vely removes all co rporate applications and data, pro visions lock-do w n prof iles—eff ectiv ely rendering the d evice useless—and lea ves the de vice under management su ch that forensi c data[...]

  • Page 40

    Int e gr ating Fiberlink MaaS36 0 with Cisco Identit y Ser vice s E ngine 40 Cisco Applications (Jabber, etc.) Cisco of fers a wide range of mobile b usiness appl ications for both increased produ ctiv e and security . Ta b l e 6 sho ws some popular applications. Ta b l e 6 P opular Cisco Mo bile Applications AnyConnect—An yConnect is a security [...]

  • Page 41

    41 Int e gr ating Fiberlink MaaS 360 with Cisc o Identity Ser vic es Engine Figur e 29 An yConnect Provisioning Profile Conclusion The inte gration of the netw ork polic y enforced by Cisco I SE and the de vice policy of fered by the Fiberlink MaaS360 MDM eng ine offers a n ew pa radigm for BY OD deplo yments where security and producti vity are no[...]

  • Page 42

    Int e gr ating Fiberlink MaaS36 0 with Cisco Identit y Ser vice s E ngine 42[...]