Basic Setup for Deploying Mobile Controller

The Mobile Controller ships with default policies. You can install and deploy the Mobile Controller without modifying the default policies, or you can modify them to suite your environment.

If your network environment requires the deployment of multiple Microsoft Installer (MSI) packages, create the packages you need before you deploy the default package.

To install the Mobile Controller using the default Initial policy provided, deploy the MSI package named Default. The default MSI package installs the default policies.

For the basic steps for how to install and configure the Mobile Controller and how to deploy the default MSI package to the SteelHead Mobile in your network, see the SteelCentral Controller for SteelHead Mobile User’s Guide.

Mobile Controller with VPN Deployments

When you deploy Mobile Controller components in environments with VPNs, make sure that you do not optimize the VPN tunnel. If the VPN tunnel uses TCP for transport, add a pass-through rule to the policy for the VPN port number connected to by the client. Depending on your deployment scenario, this rule might be the first rule in the list.

VPNs that use IPSec as the transport protocol do not need a pass-through rule.

You can configure the Mobile Controller with a VPN as follows:

In-path

Out-of-path

Figure 24‑1 shows a deployment in which both the mobile employee and the branch office use the same in-path SteelHead.

Figure 24‑1. In-Path Mobile Controller Deployment and VPN Tunnel

Figure 24‑2 shows an in-path deployment in which the mobile employee and the branch office use the same SteelHead, but for the branch office SteelHead is in-path; for the mobile employees, it is out-of-path.

Figure 24‑2. Out-Of-Path Deployment Mobile Controller Deployment and VPN Tunnels

For more information about policies and pass-through rules, see the SteelCentral Controller for SteelHead Mobile User’s Guide.

Mobile Controller with Firewall Deployments

External firewalls, such as home firewall router appliances commonly found with broadband Internet connections, do not require special settings for SteelHead Mobile when operating with VPN software on the client computer. The VPN software can have special requirements for external firewalls.

If you are using a firewall that does not allow outgoing connections, you must allow rbtdebug.exe, rbtmon.exe, rbtsport.exe, rbtlogger.exe, and shmobile.exe.

If you must access the Mobile Controller without the use of a VPN, both the client-side and server-side network firewalls must have some or all of ports 22, 80, 443, 7800, 7810, and 7870 open, as follows:

Port 22 allows SSH access to the Mobile Controller from a remote site.

Ports 80 and 443 allow Web access (including HTTP and HTTPS).

Port 7800 is the default port between the SteelHead Mobile and the remote SteelHead for all optimized TCP sessions.

You need to open Port 7810 on the network firewalls if you configure SteelHead Mobile to optimized connections with server-side out-of-path SteelHeads.

SteelHead Mobile uses Port 7870 to send statistics to the Mobile Controller.

If you are using a VPN originating on the client machine, you do not need to open any of these ports mentioned previously.

Branch Office and Remote Access Deployments

In a branch office and remote access user deployment scenario, there are the following types of users:

Local branch office users with systems that are already optimized by the local SteelHead. These users do not need the SteelHead Mobile software.

Local branch office users who also remotely access the network. These users need SteelHead Mobile software, and their systems are optimized by the server-side SteelHead.

Figure 24‑3. Deploying SteelCentral Controller for SteelHead Mobile for Branch Office and Remote Users

If SteelHead Mobiles are connecting to a branch office that already has a SteelHead, you can enable enhanced auto-discovery on all SteelHeads. This allows the SteelHead Mobile to bypass the local SteelHead and optimize with the remote SteelHead at the data center.

If you configure the branch warming feature in SteelCentral Controller for SteelHead Mobile v3.0 or later, the SteelHead Mobile automatically detects the local SteelHead when it is in the branch office (using location awareness). The SteelHead Mobile does not consume a license when it is at the branch office. The SteelHead Mobile continues to optimize with the remote SteelHead, and also warms the SteelHead Mobile RiOS data store, the local SteelHead, and the remote SteelHead.

For information about location awareness and branch warming, see Location Awareness. For information about enhanced auto-discovery, see Peering Rules and the SteelHead Management Console User’s Guide.