# How to secure communication of mobile/roaming users using Secure Gateway Server?

## Description

This document will explain to you the steps involved in securing the communication of roaming users using Secure Gateway Server. The Secure Gateway Server can be used when roaming agents access the server through internet. It prevents the exposure of the Central Server directly to the internet by serving as an intermediate server between the Central server and roaming agents. This ensures that the Central Server is secure from risks and threats of vulnerable attacks.

For a step by step demonstration video on how to configure secure gateway server, click [here](https://www.manageengine.com/products/desktop-central/secure-communication-of-mobile-users-using-forwarding-server.html#video).

## How Secure Gateway works?

The Secure Gateway Server is a component that will be exposed to the internet. This Secure Gateway Server acts as an intermediate server between the managed roaming agents and the Central server. All communications from the roaming agents will be navigated through the Secure Gateway. When the agent tries to contact the Central server, Secure Gateway server receives all the communications and redirects to the Central Server.

[![Endpoint Central Secure Gateway Server Architecture](https://www.manageengine.com/device-control/images/secure-gateway-server.jpg)](https://www.manageengine.com/products/desktop-central/images/secure-gateway-server.jpg)

**Note:** Map your Secure Gateway's public IP adress and the Central server's private IP address to a common FQDN in your respective DNS. For example, if your FQDN is "product.server.com", map this to both your Secure Gateway and the Central server IP address. By this mapping, the WAN agents of roaming users will access the Central server via Secure Gateway (using internet) and the agents within the LAN network will directly reach the Central server, hence leading to quicker resolution.

## Software requirements for Secure Gateway Server

You can install Secure Gateway Server on any of these Windows operating system versions:

- Windows 7
- Windows 8
- Windows 8.1
- Windows 10
- Windows Server 2008
- Windows Server 2008 R2
- Windows Server 2012 R2
- Windows Server 2016
- Windows Server 2019

## Hardware requirements for Secure Gateway Server

The hardware requirements for Secure Gateway Server include the following:

### 1 to 250 computers

| Server | Parameter | Requirement |
|---|---|---|
| Secure Gateway Server | Processor information | Intel Core i3 (2 core/4 thread) 2.0 Ghz 3 MB cache |
| Secure Gateway Server | RAM size | 4 GB |
| Secure Gateway Server | Hard disk space | 50 GB* |
| Network requirement | Network card speed | Minimum 1 GBPS Network Interface Card (NIC) |
| Network requirement | Bandwidth | Minimum 1 MBPS (T1 connection) |

\* May increase dynamically according to the frequency of scanning

### 251 to 500 computers

| Server | Parameter | Requirement |
|---|---|---|
| Secure Gateway Server | Processor information | Intel Core i3 (2 core/4 thread) 2.4 Ghz 3 MB cache |
| Secure Gateway Server | RAM size | 4 GB |
| Secure Gateway Server | Hard disk space | 50 GB* |
| Network requirement | Network card speed | Minimum 1 GBPS Network Interface Card (NIC) |
| Network requirement | Bandwidth | Minimum 1 MBPS (T1 connection) |

\* May increase dynamically according to the frequency of scanning

### 501 to 1000 computers

| Server | Parameter | Requirement |
|---|---|---|
| Secure Gateway Server | Processor information | Intel Core i3 (2 core/4 thread) 2.9 Ghz 3 MB cache |
| Secure Gateway Server | RAM size | 4 GB |
| Secure Gateway Server | Hard disk space | 50 GB* |
| Network requirement | Network card speed | Minimum 1 GBPS Network Interface Card (NIC) |
| Network requirement | Bandwidth | Minimum 1 MBPS (T1 connection) |

\* May increase dynamically according to the frequency of scanning

### 1001 to 3000 computers

| Server | Parameter | Requirement |
|---|---|---|
| Secure Gateway Server | Processor information | Intel Core i5 (4 core/8 thread) 2.3 GHz |
| Secure Gateway Server | RAM size | 8 GB |
| Secure Gateway Server | Hard disk space | 50 GB* |
| Network requirement | Network card speed | Minimum 1 GBPS Network Interface Card (NIC) |
| Network requirement | Bandwidth | Minimum 1 MBPS (T1 connection) |

\* May increase dynamically according to the frequency of scanning

### 3001 to 5000 computers

| Server | Parameter | Requirement |
|---|---|---|
| Secure Gateway Server | Processor information | Intel Core i7 (6 core/12 thread) 3.2 GHz |
| Secure Gateway Server | RAM size | 8 GB |
| Secure Gateway Server | Hard disk space | 50 GB* |
| Network requirement | Network card speed | Minimum 1 GBPS Network Interface Card (NIC) |
| Network requirement | Bandwidth | Minimum 1 MBPS (T1 connection) |

\* May increase dynamically according to the frequency of scanning

### 5001 to 10000 computers

| Server | Parameter | Requirement |
|---|---|---|
| Secure Gateway Server | Processor information | Intel Xeon E5 (8 core/16 thread) 2.6 GHz |
| Secure Gateway Server | RAM size | 16 GB |
| Secure Gateway Server | Hard disk space | 50 GB* |
| Network requirement | Network card speed | Minimum 1 GBPS Network Interface Card (NIC) |
| Network requirement | Bandwidth | Minimum 1 MBPS (T1 connection) |

\* May increase dynamically according to the frequency of scanning

### 10001 to 15000 computers

| Server | Parameter | Requirement |
|---|---|---|
| Secure Gateway Server | Processor information | Intel Xeon E5 (12 core/24 thread) 2.7 GHz |
| Secure Gateway Server | RAM size | 32 GB |
| Secure Gateway Server | Hard disk space | 50 GB* |
| Network requirement | Network card speed | Minimum 1 GBPS Network Interface Card (NIC) |
| Network requirement | Bandwidth | Minimum 1 MBPS (T1 connection) |

\* May increase dynamically according to the frequency of scanning

### 15001 to 20000 computers

| Server | Parameter | Requirement |
|---|---|---|
| Secure Gateway Server | Processor information | Intel Xeon E5 (14 core/28 thread) 2.7 GHz |
| Secure Gateway Server | RAM size | 32 GB |
| Secure Gateway Server | Hard disk space | 50 GB* |
| Network requirement | Network card speed | Minimum 1 GBPS Network Interface Card (NIC) |
| Network requirement | Bandwidth | Minimum 1 MBPS (T1 connection) |

\* May increase dynamically according to the frequency of scanning

### 20001 to 25000 computers

| Server | Parameter | Requirement |
|---|---|---|
| Secure Gateway Server | Processor information | Intel Xeon E5 (16 core/32 thread) 3.0 GHz |
| Secure Gateway Server | RAM size | 32 GB |
| Secure Gateway Server | Hard disk space | 50 GB* |
| Network requirement | Network card speed | Minimum 1 GBPS Network Interface Card (NIC) |
| Network requirement | Bandwidth | Minimum 1 MBPS (T1 connection) |

\* May increase dynamically according to the frequency of scanning

### 25001 to 30000 computers

| Server | Parameter | Requirement |
|---|---|---|
| Secure Gateway Server | Processor information | Intel Xeon E5 (16 core/32 thread) 3.0 GHz |
| Secure Gateway Server | RAM size | 32 GB |
| Secure Gateway Server | Hard disk space | 50 GB* |
| Network requirement | Network card speed | Minimum 1 GBPS Network Interface Card (NIC) |
| Network requirement | Bandwidth | Minimum 1 MBPS (T1 connection) |

\* May increase dynamically according to the frequency of scanning

### Above 30000 computers

For managing more than 30000 computers, contact Support at [endpointcentral-support@manageengine.com](mailto:endpointcentral-support@manageengine.com). We will customize Secure gateway server setup based on your network.

## Steps

To introduce Secure Gateway based communication, follow the steps given below:

- Modify product settings
- Install and configure Secure Gateway
- Infrastructure recommendations

## Modify Product Settings

1. Enter Secure Gateway IP address instead of the Central server IP address under the Central server details while adding remote office. This is to ensure the WAN agents and DS communication to Secure Gateway.
2. Enable secured communication (HTTPS) under DS/WAN agent to Browser Security Plus server communication.
3. Configure NAT settings using the Secure Gateway's public FQDN/IP address.

- On the Browser Security Plus Server Console, click on **Admin** tab -> **Server Settings** -> **NAT Settings**
- Add the FQDN of the Secure Gateway server against the Public FQDN under NAT device as shown below

[![Endpoint Central Secure Gateway Server NAT Settings](https://cdn.manageengine.com/sites/meweb/images/browser-security/help/security/bsp-sgs.png)](https://www.manageengine.com/products/desktop-central/images/secure-gateway-nat-settings.png)

## Install and configure Secure Gateway

1. [Download](https://www.manageengine.com/products/desktop-central/forwarding-server-download.html) and install Secure Gateway on a machine in Demilitarized zone.
2. Enter the following details under **Setting up the Secure Gateway** window, which will open after the installation process:
   - Server Name: Specify the FQDN/DNS/IP address of the Browser Security Plus server.
   - Https Port: Specify the port number that the mobile devices use to contact the Browser Security Plus server (eg: 8383 - it is recommended to use the same port 8383 (HTTPS) for Browser Security Plus Server in secured mode)
   - Notification Server port: 8027 (to perform on-demand operations), this will be pre-filled automatically
   - Web Socket Port: 8443 (HTTPS), this will be pre-filled automatically.
   - File Transfer Port: 8031 (HTTPS), this will be pre-filled automatically, but it can be modified as required.
   - Username & Password: Enter Browser Security Plus user's credentials with administrative privilege.

## Infrastructure recommendations

Ensure that you follow the steps given below:

1. Secure Gateway's Public IP address with the port 8383 (https) should be provided to Browser Security Plus server for accessibility verification.
2. Configure Secure Gateway in such a way, that it should be reachable via public IP/FQDN address configured in NAT settings. You can also configure the Edge Device/Router in such a way that all the request that are sent to the Public IP/FQDN address gets redirected to the Browser Security Plus Secure Gateway.
3. It is mandatory to use HTTPS communication.
4. You will have to ensure that the following port is open on the firewall for the WAN agents to communicate the Browser Security Plus Secure Gateway.

| Port | Type | Purpose | Connection |
|---|---|---|---|
| 8383 | HTTPS | For communication between the WAN agent/Distribution Server and the Browser Security Plus server using Secure Gateway. | Inbound to Server |
| 8027 | TCP | To perform on-demand operations | Inbound to Server |
| 8443 | HTTPS | Web socket port used for remote control, chat, system manager etc. | Inbound to Server |
| 8031 | HTTPS | For transferring files | Inbound to Server |

You have now secured communication between Browser Security Plus server, WAN agents and roaming users.

## Check this video for a step by step demonstration on how to configure the secure gateway server.

https://www.youtube-nocookie.com/embed/OhVKZlexGZU