MobileIron Sentry overview
MobileIron Sentry is a part of a MobileIron deployment that serves as an intelligent gatekeeper to your company’s ActiveSync server, such as a Microsoft Exchange Server, or with a backend resource such as a Sharepoint server, or it can be configured as a Kerberos Key Distribution Center Proxy (KKDCP) server. Sentry gets configuration and device information from a MobileIron unified endpoint management (UEM) platform - MobileIron Core or MobileIron Cloud.
| NOTE: | Access to enterprise content in business cloud services such as SalesForce, Box, G Suite, Dropbox, and Office 365 can be secured using MobileIron Access. MobileIron Access is a cloud service. A MobileIron Access deployment requires a MobileIron unified endpoint management (UEM) platform, MobileIron Standalone Sentry, and MobileIron Tunnel. For information about MobileIron Access and how to set up the service, see the MobileIron Access Guide. |
The following provide additional information about MobileIron Sentry:
| • | MobileIron Sentry flavors |
| • | Sentry and MobileIron UEM platform support |
| • | Integrated Sentry |
| • | ActiveSync with Standalone Sentry |
| • | AppTunnel with Standalone Sentry |
| • | Network traffic support with AppTunnel |
| • |
|
MobileIron Sentry flavors
Sentry is available in two flavors: Standalone Sentry or Integrated Sentry.
Standalone Sentry is a separate appliance that acts as a gateway between devices and your ActiveSync-enabled email servers or backend resource. Standalone Sentry can be configured for ActiveSync or AppTunnel, or as Kerberos Key Distribution Center Proxy (KKDCP) server. Standalone Sentry can be installed on premise on a MobileIron Appliance or a virtual appliance. Or, Standalone Sentry can be installed in the cloud on Microsoft Azure or on Amazon Web Service (AWS).
Integrated Sentry is a Windows service that interacts with the Microsoft Exchange Server.
Sentry gets input from the MobileIron unified endpoint management (UEM) platform, MobileIron Core or MobileIron Cloud, to do the following:
| • | Integrated Sentry or the Standalone Sentry configured for ActiveSync protects the ActiveSync server from wrongful access from devices. |
| • | Standalone Sentry configured for AppTunnel provides authenticated apps secure access to the backend resource. |
Sentry and MobileIron UEM platform support
MobileIron UEM support varies depending on the type of MobileIron Sentry. The following tables provides the MobileIron UEM supported by Sentry.
|
Sentry |
UEM platform |
|
Integrated Sentry |
MobileIron Core |
|
Standalone Sentry (on-premise, Microsoft Azure, AWS) |
MobileIron Core, MobileIron Cloud |
MobileIron Cloud license requirement
Some Standalone Sentry features are available based on the license level for MobileIron Cloud. The following table describes the license required for these features:
|
License requirement |
Feature |
|---|---|
|
Gold
|
Advanced traffic control |
|
Outgoing ciphers |
|
|
CIFS service for Docs@Work |
|
|
Sharepoint service for Docs@Work |
|
|
Help@Work service |
|
|
Web@Work service |
|
|
Custom HTTP service |
|
|
Custom TCP service |
|
|
Platinum
|
MobileIron Tunnel service |
|
MobileIron AppTunnel |
Integrated Sentry
MobileIron Integrated Sentry is a policy agent for Microsoft Exchange Server email clusters, and for Microsoft Office 365. It is packaged as a software module on the Exchange Server or on a separate server with Exchange Server access.
Integrated Sentry passes information between MobileIron Core and Microsoft Exchange Server. For example:
| • | Core periodically syncs with Integrated Sentry to get the list of ActiveSync devices. Integrated Sentry gets the list from the Exchange Server. |
| • | Core informs Integrated Sentry when an ActiveSync device is in violation of its security policy. Integrated Sentry tells the Exchange Server to block the device. |
| • | Core informs Integrated Sentry when too many ActiveSync devices have the same mailbox. Integrated Sentry tells the Exchange Server to block the device. |
| • | Core informs Integrated Sentry when the Core administrator blocks, allows, or wipes an ActiveSync device in the Core Admin Portal. Integrated Sentry tells the Exchange server to take the appropriate action. |
| • | Core passes an ActiveSync policy to Integrated Sentry. You configure the policy using the Admin Portal. Integrated Sentry passes the policy to the Exchange Server, which updates its own policy, and passes the policy to the device. |
| NOTE: | MobileIron strongly recommends deploying Standalone Sentry if you are supporting more than 5000 devices with Office 365. |
ActiveSync with Standalone Sentry
Standalone Sentry enabled for ActiveSync serves as an intelligent gatekeeper to the ActiveSync server. It uses the ActiveSync protocol to communicate with the ActiveSync server and with ActiveSync devices. For information about these interactions, see MobileIron Cloud, Standalone Sentry, and device interactionMobileIron Core, Standalone Sentry, and device interaction.
Exchange ActiveSync, also known as ActiveSync, is the protocol that the ActiveSync server uses to communicate over HTTP or HTTPS with devices. The ActiveSync server uses the ActiveSync protocol to do the following:
| • | synchronize email, contacts, calendar, tasks and notes with a mobile device |
| • | provide for server-device interactions relating to mobile device management and policy controls |
In a MobileIron deployment, these devices are called ActiveSync devices. Standalone Sentry and the MobileIron UEM platform work together to protect the ActiveSync server from wrongful access by these devices.
Communication between Standalone Sentry and ActiveSync servers is encrypted using HTTPS. Administrators can enable server TLS and configure outbound SSL. For Office 365 and GMail, MobileIron reccommends that the communication should be configured to use HTTPS, so that confidential information such as user name, password, and email content are never communicated in clear text.
AppTunnel with Standalone Sentry
Standalone Sentry enabled for AppTunnel provides per-app secure tunneling and access control to protect app data as it moves between the device and corporate backend resources (data-in-motion). App-by-app session security protects the connection between each app container and the corporate network. AppTunnel is particularly useful when an organization does not want to open up VPN access to all apps on the device.AppTunnel is part of an AppConnect app or a MobileIron Tunnel deployment. However, AppTunnel is not a requirement for an AppConnect app deployment.
Standalone Sentry and the MobileIron UEM platform work together to provide secure access to the backend resource. For example:
| • | MobileIron UEM provides Standalone Sentry with the backend resource configuration for the app. |
| • | When an app attempts to connect to a backend resource, Standalone Sentry creates an app tunnel which is a unique combination of user, device, and app. Standalone Sentry provides information about the app tunnel to the UEM. |
| • | MobileIron UEM informs Standalone Sentry when an app should not be allowed to access the backend resource. For example, Standalone Sentry blocks access to the backend resource if there are security policy violations or the AppTunnel is manually blocked. |
Network traffic support with AppTunnel
|
Protocol |
Support |
|||||||||
|
HTTP, HTTPS tunneling |
|
|||||||||
|
TCP tunneling |
TCP tunnels support HTTP and HTTPS traffic also. |
|||||||||
|
IP tunneling |
IP tunnels also support HTTP, HTTPS, TCP, and UDP traffic. |
Standalone Sentry as a KKDCP server (Core only)
Standalone Sentry can be configured as a Kerberos Key Distribution Center Proxy (KKDCP) server. A separate Standalone Sentry is required for Kerberos proxy. Standalone Sentry as a KKDCP server is only supported with MobileIron Core.