MDM Server URL, FQDN, and certificate configuration for internal vs. external access
Article ID: 368259
Updated On:
Products
Issue/Introduction
Customers setting up Modern Device Management (MDM) commonly ask how to reference the MDM server using internal and external Fully Qualified Domain Names (FQDNs). Which FQDN or URL goes in which field when the MDM server sits behind a firewall or is reached through an Internet Gateway? Which certificate gets issued to which name?
This article answers the FAQs support most often receives about internal/external FQDN usage for an MDM server, and about the fields in the Configure MDM Server dialog.
Main online documentation about MDM topic can be found here:
Modern Device Management (broadcom.com)
Environment
IT Management Suite (ITMS) 8.7.x, 8.8.x
Resolution
How it works
MDM policies and actions started in the Symantec Management Console go to the MDM Server first. The MDM Server passes policy information and commands to managed devices, collects information back from those devices, aggregates it, and sends it to the SMP Server (Symantec Management Platform or Notification Server (NS)).
The MDM Server can sit in your organization’s DMZ with a direct public FQDN, or behind your firewall. A DMZ-based MDM Server needs port 443 open to communicate with devices and the NS directly. A firewall-based MDM Server instead reaches devices outside the firewall through an Internet Gateway configured for Cloud-Enabled Management (CEM).
This split is what drives every FQDN question in this article:
- URL field: the address devices and the NS use to reach the MDM Server. When the MDM Server communicates through an Internet Gateway, this must be the Internet Gateway’s FQDN, not the MDM Server’s own FQDN. All enrollment traffic goes through the Gateway; a device cannot enroll directly with the MDM Server while this is configured.
- Server certificate: always issued to the MDM Server’s own FQDN (its internal FQDN, in a Gateway configuration), even though the URL field points at the Gateway.
- APNS certificate: lets the MDM Server talk to Apple’s APNS service; obtained through a CSR generated in the console, signed by Broadcom Support, and submitted to Apple.
The most common failure points are pointing the URL at the MDM Server’s own FQDN instead of the Gateway’s FQDN in a Gateway configuration, and issuing the server certificate to the wrong name for the topology in use.
These are some of the questions and responses support most commonly receives (based on an MDM implementation for Windows and macOS computers):
1. What do the fields in the Configure MDM Server dialog mean?
While setting up MDM for macOS and adding a new MDM Server, the Configure MDM Server dialog asks for several fields, including Server, URL, Server Certificate, and APNS Certificate. Here is what each field needs, based on Setting up and Configuring the MDM Server and its two prerequisite pages:
Setting up and Configuring the MDM Server (broadcom.com)
Field | What it is |
|---|---|
Server (Dropdown) | The computer resource hosting your MDM Server role, where you installed the Symantec Management Agent and the MDM plug-in. This is the same resource you selected earlier under Actions > Agents/Plug-ins > Rollout Agents/Plug-ins > Modern Device Management > Server for macOS MDM Install. If your server isn’t showing up in this dropdown, the agent install or plug-in rollout to that computer likely hasn’t completed yet. |
URL (Field Text) | The address managed devices and the SMP Server use to reach the MDM Server. Enter the fully qualified external/public endpoint URL or hostname of the MDM server. If the MDM Server is behind your firewall, enter the FQDN of the Internet Gateway here instead of the MDM Server’s own FQDN, since that is the address actually reachable from outside the network. If the MDM Server is in your DMZ with a direct public FQDN, use that FQDN. Format: |
Server Certificate (Dropdown) | The certificate obtained from a trusted public certificate authority (not self-signed) for the MDM Server’s own FQDN, imported into the console as a certificate with category Server. Generate a CSR on the MDM Server, have it signed by your CA, and import the resulting certificate under MDM – macOS > Certificates. |
APNS Certificate (Dropdown) | The certificate obtained from Apple that lets the MDM Server communicate with Apple’s APNS service. Generate a CSR in the console, have it signed by Broadcom Support, then submit it to Apple at identity.apple.com. Import the resulting certificate under MDM – macOS > Certificates with category APNS. |
Enrollment Profile Signing Certificate (Dropdown) | Optional. Used to digitally sign MDM enrollment profiles delivered to macOS devices during enrollment. Saving the server configuration auto-creates an enrollment profile with the mandatory data, reviewable at Home > Apple Modern Device Management > Profiles > Enrollment Profiles. |
Process server configuration ASAP (Checkbox) | If checked, the console pushes the configuration to the MDM Server immediately on Save. If left unchecked, the settings are saved but not applied until you return to this dialog, check the box, and save again. |
The Server, Server Certificate, and APNS Certificate dropdowns populate only after the Symantec Management Agent installation on that computer has had time to complete and register. If they appear empty immediately after installing the agent, wait for it to check in before troubleshooting further.
2. What domain name should we use for the MDM server?
Knowing that “Internal-Example.com” is the company’s internal domain (the one used internally) and “External-Example.com” is the alias used for connections made from outside the corporate network, such as devices connected to the Internet in CEM mode, which one should we use?
Response:
From our online documentation:
Setting up MDM for Windows (broadcom.com)
“MDM policies and actions initiated within the Symantec Management Console are first communicated to an MDM Server. The MDM Server then communicates the policy information and commands to devices. Information collected from devices is communicated back to the MDM Server, where it is aggregated, and then transmitted to the SMP Server.”
“You can install the MDM Server on a computer in either your organization’s demilitarized zone (DMZ), or on a computer behind the firewall. You then configure the MDM Server (if it is behind a firewall) to use the Internet Gateway to communicate with devices outside the firewall via Cloud Enabled Management.”
“An MDM Server installed on a computer in your organization’s DMZ must open port 443 to facilitate communication with devices and the SMP Server. For more information on configuring the MDM Server to communicate with devices via the Internet Gateway, see Using MDM Server with Internet Gateway.”
What we can say is that you can choose either, but the external name should be the primary one if you are planning to use MDM in CEM mode as well.
3. Does the server name need to be visible over the Internet, or will it use the CEM Gateway alias?
Does the name we choose for the server have to be visible over the Internet, or will it use the alias that the computers connecting through the Gateway have, for example CEMCloud.External-Example.com?
Response:
From our online documentation:
Using MDM Server with Internet Gateway (broadcom.com)
“If you are using Cloud Enabled Management to manage devices outside your organization’s firewall, install the MDM Server on a computer behind your organization’s firewall, and then configure the Internet Gateway to facilitate communication between devices and the MDM Server. When configuring the MDM Server, you must know the FQDN of the Internet Gateway.”
As you can read further in the link above, you will need to configure your Internet Gateway and add your MDM server to it under the “Servers” tab so the Internet Gateway can redirect traffic accordingly.
4. Does the certificate need to be public, or can it be self-signed by our own CA?
Response:
From our online documentation:
Using MDM Server with Internet Gateway (broadcom.com)
“You must configure the Internet Gateway to use a certificate issued by a trusted certificate authority to enable devices without the Symantec Management Agent to trust the Internet Gateway.”
So it can be either, as long as it is valid and available to the endpoint devices and Internet Gateways.
5. Can we use our existing Internet Gateway, or do we need a dedicated one for MDM?
Response:
You can use the same Internet Gateway. Current best practice is to have at least two Internet Gateways for redundancy and load balancing.
About Preparing the Internet Gateway Computer (broadcom.com)
“Symantec recommends that you configure at least two Internet gateways to provide failover options, load balancing, and to maintain communication continuity. The Cloud-Enabled Agent can switch among multiple available gateways for load balancing and fail-over purposes. Load balancing is performed automatically by the Agent. All gateways are considered to be equal, and the agent determines the best route to the SMP Server. Automatic failover will also switch the endpoint to another Internet Gateway if the agent senses a failure in the connection to the current gateway the agent is connected to. Each Internet gateway can serve multiple SMP Servers.”
6. Does the MDM server’s URL need to be a generic URL, or must it match the server’s own FQDN?
The documentation associates the URL with the FQDN of the equipment. Can it be a generic URL instead, or does it have to be associated with the MDM server name?
Response:
It can be an alias, as long as the MDM server is accessible by it. In that case, the server certificate must also be issued to that alias name.
This is also covered in:
Obtaining and Importing the MDM Server Certificate for Windows (broadcom.com)
“You must obtain a certificate for the MDM Server from a trusted certificate authority (such as DigiCert), and then import it. The name of the certificate must be the same as the Fully Qualified Domain Name (FQDN) of the MDM Server, even if the MDM Server is configured to work via the Symantec Management Platform’s Internet Gateway. If you configured the MDM Server to use a custom external FQDN, issue the server certificate to the custom FQDN.”
7. If the MDM server is on the corporate network, does its URL need a public IP address?
If the MDM server is on the corporate network and is reachable through the Internet Gateway, does that same URL need an associated public IP address?
Response:
No. If the MDM server works through an Internet Gateway, a public address is not needed. Outside endpoints access the Gateway instead of the MDM server directly.
In that case, the server certificate is issued to the MDM server’s internal FQDN (the Internet Gateway reaches it by that internal FQDN), but the URL field must be the public Gateway address so outside endpoints can enroll using it.
This is also covered in:
Using MDM Server with Internet Gateway (broadcom.com)
“When using the MDM Server to communicate with devices via the Internet Gateway, configure the MDM Server to use the FQDN of the Internet Gateway for the URL, but the certificate of MDM Server. If an MDM Server is configured to communicate through the Internet Gateway, all communication will go through the Internet Gateway. That means devices must be enrolled using the Internet Gateway URL. In such a case, it is not possible to enroll a device directly with the MDM Server, bypassing the Internet Gateway.”
Additional Information
Modern Device Management (broadcom.com)
Setting up MDM for macOS (broadcom.com)
Setting up MDM for Windows (broadcom.com)
Setting up and Configuring the MDM Server (broadcom.com)
Obtain a Server Certificate for the MDM Server (broadcom.com)
Obtain an Apple APNS Certificate (broadcom.com)
Using MDM Server with Internet Gateway (broadcom.com)
Obtaining and Importing the MDM Server Certificate for Windows (broadcom.com)
About Preparing the Internet Gateway Computer (broadcom.com)
Feedback
