No VPN Gateway for Wi-Fi

  • Article

10/3/2008

For this topology, the managed Windows Mobile device connects directly to the Mobile Device Manager (MDM) Device Management Server without the use of the MDM Gateway Server. You choose this scenario if you plan to have managed devices used only in your corporate network.

Important

The no VPN gateway scenario will only provide MDM access for devices that are connected to corporate wireless access points. If your managed device is outside the range of your corporate Wi-Fi infrastructure, you must disable Wi-Fi on the device to resume normal device cellular communication without MDM.

Topology benefits include the following:

  • A more simple topology, less implementation required.
  • Less management needed for mobile infrastructure.

The following illustration shows a managed device communicating with the MDM Device Management Server without the use of the MDM Gateway Server.

Cc664626.77839d0e-e2c8-4e68-b7a1-73afec048f87(en-us,TechNet.10).gif

The numbers in the above illustration highlight the following:

  1. On the MDM Device Management Server, or any other server with MDM Administrator Tools installed, you run the following MDM Shell cmdlet to disable the Mobile VPN client on all devices:

    Set-EnrollmentConfig -ActivateVPN:$false

    Note

    To read more on MDM Shell cmdlets including usage, see Operations for Mobile Device Manager.

  2. An internal DNS Server resolves the name of MDM Enrollment Server and MDM Device Management Server for the mobile device.

  3. You enroll an internal Windows Mobile 6.1 device by using an internal wireless access point and the Domain Enroll utility on the device. When you enroll by using the Domain Enroll utility, you must supply the fully qualified domain name (FQDN) of the MDM Enrollment Server (internal name). To enable Wi-Fi on the mobile device, see Windows Mobile Powered Device Wi-Fi Configuration.

Once enrolled, the managed device will communicate directly with the MDM Device Management Server.

Important

The Alerter service on MDM Gateway Server receives alerts from MDM Device Management Server for urgent commands, such as a managed device wipe. The Alerter service verifies that the managed device is connected to the network. Without an MDM Gateway Server you cannot use the Alerter service and will lose the ability to perform a Wipe Now request on a managed device. You will still be able to initiate a wipe immediately upon the next connection.