Port requirements 编辑

To enable devices and apps to communicate with XenMobile, you open specific ports in your firewalls. The following tables list the ports that must be open.

Open ports for Citrix Gateway and XenMobile to manage apps

Open the following ports to allow user connections from Citrix Secure Hub, Citrix Receiver, and the Citrix Gateway plug-in through Citrix Gateway to the following components:

• XenMobile
• StoreFront
• Citrix Virtual Apps and Desktops
• Citrix Gateway connector for Exchange ActiveSync
• Other internal network resources, such as intranet websites

To enable traffic to Launch Darkly from Citrix ADC, you can use the IP addresses noted in this Support Knowledge Center article.

For more information about Citrix Gateway, see the Citrix Gateway documentation. That documentation includes information about Citrix ADC IP (NSIP) virtual server IP (VIP) and subnet IP (SNIP) addresses.

Open XenMobile ports to manage devices

Open the following ports to allow XenMobile to communicate in your network.

Port requirement for AutoDiscovery service connectivity

This port configuration ensures that Android devices connecting from Secure Hub for Android can access the Citrix AutoDiscovery Service (ADS) from within the internal network. You need access to ADS to download security updates made available through the ADS.

Note:

ADS connections might not support your proxy server. In this scenario, allow the ADS connection to bypass the proxy server.

If you want to enable certificate pinning, do the following prerequisites:

• Collect XenMobile Server and Citrix ADC certificates. The certificates must be in PEM format and must be a public certificate and not the private key.
• Contact Citrix Support and place a request to enable certificate pinning. During this process, you are asked for your certificates.

Certificate pinning requires that devices connect to ADS before the device enrolls. This requirement ensures that the latest security information is available to Secure Hub. For Secure Hub to enroll a device, the device must reach the ADS. Therefore, opening up ADS access within the internal network is critical to enabling devices to enroll.

To allow access to the ADS for Secure Hub for Android or iOS, open port 443 for the following FQDN:

For information on supported IP addresses, see Cloud-based storage centers from AWS.

Android Enterprise network requirements

For information about the outbound connections to consider when setting up network environments for Android Enterprise, see the Google support article, Android Enterprise Network Requirements.

Port requirements for XenMobile

The following destination hosts must be reachable from the network to create a Managed Google Play Enterprise and to access the ​Managed Google Play iFrame​. Google made the Managed Play iFrame available to EMM developers to simplify search and approval of apps. In order to use the Managed Play iFrame, the browser from which you access the XenMobile console must have access to Google Play.