SCCM Cloud Management Gateway
Download as PPTX, PDF2 likes3,098 views
The document discusses the Cloud Management Gateway (CMG) by Microsoft for managing internet-roaming clients without exposing infrastructure to the internet. It outlines features like software updates, client notification, and endpoint protection, as well as management certificates and network port requirements. Additionally, it highlights best practices for deployment, performance considerations, and unsupported features.
SCCM Cloud Management Gateway
- 1. CLOUD MANAGEMENT GATEWAY Courtesy: Microsoft Corporation
- 3. INTERNET-BASED CLIENT MANAGEMENT AD CA Windows Update AD CA
- 4. Manage traditional clients that roam on the Internet Without additional infrastructure Without exposing infrastructure to the Internet That is easily configured through the Configuration Manager Console Key features continue to work on the device when not on the corporate network Software updates Hardware and software inventory Endpoint protection Client notification Settings Applications PLAN TO SIMPLIFY
- 5. CLOUD MANAGEMENT GATEWAY AD CA Windows Update
- 6. CERTIFICATES Management certificate “Credentials” between site and Azure Any certificate including self-signed Public cert uploaded to Azure, .pfx with private key imports into site Web Service (server authentication) certificate Use public certificate provider (Symantec, Thawte) Wild card certificate is not supported Root/Subordinate certificate authority Used by CMG for full chain validation on client PKI certificates Client certificate
- 7. NETWORK PORTS NO INBOUND PORTS REQUIRED! Source Port Destination Use Service Connection Point 443 Azure Deploy CMG CMG Connection Point 443 CMG CMG channel for first VM CMG Connection Point 10124-10140 CMG CMG channel for additional VM instances Client 443 CMG Client channel
- 8. SCALING CMG East US East Asia
- 9. PERFORMANCE CONSIDERATIONS Any Internet-roaming client in the site will use the CMG Reduce network latency by locating CMG, CMG Connection Point and Site Server in same geographic region Client to CMG in Azure is not regional aware For high availability, at least two VM instances and two CMG Connection Points per site Scale-out by increasing VM instances, which leverages Azure load balancer in front of CMG CMG does round-robin communication with multiple CMG Connection Points; creating more on-premises roles will distribute load
- 10. BEST PRACTICES AND FAQS Publish Certificate Revocation List (CRL) to Internet HTTPS is optional on-prem Supports Azure US Government (Fairfax) Unsupported features (as of 1710) • Azure Resource Manager • Client deployment using client push • Automatic site assignment • User policies • Application catalog • Full operating system deployment (OSD) • Configuration Manager console • Remote tools • Reporting website • Wake on LAN • Peer cache • On-premises Mobile Device Management • Mac, Linux, and UNIX clients • Task Sequence
- 11. TROUBLESHOOTING Deployment: CloudMgr.log CMGSetup.log Service health CMGService.log SMS_CLOUD_PROXYCONNECTOR.log Client traffic CMGHttpHandler.log -> CMGService.Log -> SMS_CLOUD_PROXYCONNECTOR.log
- 12. REFERENCES CMG Setup video https://youtu.be/-awTBMdMHFE Product documentation https://docs.microsoft.com/en-us/sccm/core/clients/manage/manage-clients-internet Cost estimates https://docs.microsoft.com/en-us/sccm/core/clients/manage/plan-cloud-management- gateway#cost-of-cloud-management-gateway
- 13. QUESTIONS?
Editor's Notes
- #2: Both
- #3: Aaron Traditional management with SCCM (not ready for modern management via Intune) Clients roam onto Internet (home, travel, remote office) Still need to be managed, especially software updates
- #4: Aaron This method relies on Internet-facing site system servers to which clients communicate for management purposes. This method requires clients and site system servers to be configured for Internet-based management. Advantages: No cloud service dependency. No additional cost associated with a cloud subscription. Full control of servers and roles providing the service. Disadvantages: Require additional infrastructure investment. Overhead and operational cost of additional infrastructure. Infrastructure must be exposed to the Internet.
- #5: Aaron
- #6: Aaron Advantages: No additional infrastructure investment required. Does not expose on-premises infrastructure to the Internet. Cloud virtual machines that run the service are fully managed by Azure and require no maintenance. Easily set up and configured in the Configuration Manager console. Disadvantages: Cloud subscription cost. Management data sent through cloud service.
- #7: Dune
- #8: Aaron
- #9: Aaron
- #10: Dune
- #11: Dune
- #12: Dune
- #13: Aaron