Internet Based Client Management In System Center 2012 Configuration Manager R2 Justin Chalfant blogs.technet.com/jchalfant Jason Sandys @JasonSandys blog.configmgrftw.com

In-scope Out-of-scope Overview IBCM Hierarchy Scenarios Reverse Proxy (TMG) SSL Bridging Out-of-scope HTTPS Client Communication Basics Public Key Infrastructure (PKI) Configuration Implementation Basics or Details

Steps To Implement IBCM Setup PKI Deploy site system and client certificates Setup/configure site systems and client facing roles Configure site Test, Test, Test

Certificate Authority What’s Needed Trusted PKI Certificate Authority Unique client authentication certificates for each client Server authentication certificates for each site system*

Lab Environment – Traffic Flow BOBOI Internet Client Edge Router Reverse Proxy (TMG) Site System (MP, DP, SUP, App Catalog) Site Server BOBOI = Big Old, Bad Old Internet

Certificate Templates DEMO WSUS Configuration Verify IIS Certificate on Internet Facing Site System Exporting the Certificate for Workgroup Client Requesting the Certificate Template for Workgroup Client Issuing the Certificate Templates Creating Certificate Templates

IBCM Site Architecture – No DMZ FSP Reverse Proxy Site Server MP / DP / SUP Passthrough Bridged

IBCM Site Architecture – DMZ FSP Reverse Proxy Site Server Passthrough MP / DP / SUP Site Server initiated communication Bridged SQL Replica

DEMO TMG Review TMG Configurations Review the Web Listener Review Website Publishing Rules MP, Application Catalog Create TMG Web Publishing Rules Create Website Publishing Rules for DP and SUP

Site Systems and AD Forests/Domains 3 Internal Forest 1 Site Server 2 Site System DMZ Forest Site DB Site Server’s AD Computer Account or Specified Installation Account MP Connection Account Site System’s AD Computer Account or Specified Installation Account

IBCM Three Client Modes BOBOI Intranet only Intranet or Internet AD GC Internet only ccmsetup.exe CCMALWAYSINF=1 CCMHOSTNAME=SERVER3.CONTOSO.COM SMSSITECODE=ABC CCMHOSTNAME set via policy starting in R2

Intranet only - HTTPS Intranet or Internet Internet only IBCM Three Role Modes BOBOI Intranet only - HTTPS Intranet or Internet Internet only

DEMO Clients Domain Joined Client Review Client Switching from Intranet to Internet Review Software Update Installation on Internet Client Review Application Catalog from Intranet Client Workgroup Client Review Importing the Client Authentication Certificate Review Installation of the Client

Certificate Revocation Lists (CRL) are hard-coded The Missing Link LDAP, HTTP, SMB, FTP Certificate Revocation Lists (CRL) are hard-coded in each certificate at certificate creation time CRLs are available on CRL Distribution Points (CDP) CRL checking is optional

IBCM Communication and Content Sources Cloud DP DP Other Content** All Other Content Software Updates* Update Catalog WSUS Policy Internet Client MP * Content only ** Does not include any updates

IBCM vs. VPN vs. Direct Access Highlights ConfigMgr only PKI Required VPN User Initiated The networking team Direct Access Always on IPv6 May require PKI

Hints, Allegations & Things Left Unsaid Most of this has nothing to with ConfigMgr PKI is not easy Manually bind certificates in IIS* Certificate deployment can be challenging Client auth certs define ConfigMgr client identity ccmhttpstate is undocumented for a reason

Links http://technet.microsoft.com/en-us/library/gg699362.aspx http://blogs.msdn.com/b/ameltzer/archive/2008/04/14/common- native-mode-client-mp-error-messages-and-what-to-do-about- them.aspx http://technet.microsoft.com/en-us/library/gg682023 http://technet.microsoft.com/en-us/library/bb633246.aspx http://blogs.technet.com/b/wemd_ua_- _sms_writing_team/archive/2008/01/17/tips-tricks-hints-for-native- mode-and-internet-based-client-management-part-3-of-3.aspx