Configure Mobile Security Enforcement

The FireClient app is no longer available for download from the Apple App Store or Google Play Store.

You can enforce Mobile Security on one or more interfaces on your Firebox. The interfaces can be physical interfaces, or logical interfaces, such as VLAN or link aggregation interfaces. When you enable Mobile Security on an interface, the Firebox denies traffic from Android or iOS devices that do not comply with the configured device compliance settings. For an Android or iOS device to be compliant, FireClient must be installed and open on the mobile device, and FireClient must report that the device is compliant with the Mobile Security device compliance settings.

You can also configure whether to enforce Mobile Security for VPN connections, and you can configure Mobile Security exceptions.

Before you begin, you must Enable Mobile Security.

Configure Interfaces for Enforcement

By default, Mobile Security enforcement is enabled on all trusted and optional interfaces. When you configure the Mobile Security Enforcement settings, you can specify on which interfaces the Mobile Security compliance settings that you specified are enforced. This enables you to include only the interfaces for networks where you want to enforce Mobile Security, and remove all other interfaces. For example, you might want to enforce Mobile Security only for the employee wireless network, but not for the guest wireless network, so you remove the interfaces for the guest wireless network from the Interfaces list.

  1. On the Mobile Security page, select the Enforcement tab.
    The Interfaces list shows the current list of interfaces for enforcement.

Screen shot of the Mobile Security Enforcement tab

  1. To remove an interface, from the Interface list, select the interface alias and click Remove.
  2. To add an interface, click Add.
    The Add Interface dialog box appears.
  3. From the Interface drop-down list, select an interface alias.
  4. Click OK.
    The interface is added to the Interfaces list.
  5. Click Save.
  1. In the Mobile Security dialog box, select the Enforcement tab.
    The Interface list shows the current list of interfaces for enforcement.

Screenshot of the Interface list that shows the current list of interfaces for enforcement.

  1. To remove an interface, from the Interface list, select the interface alias and click Remove.
  2. To add an interface, click Add.
    The Add Interface dialog box appears.
  3. From the Interface drop-down list, select an interface alias.
  4. Click OK.
    The interface is added to the Interfaces list.
  5. Click Save.

Enable Enforcement for VPN Connections

You can use Mobile Security to enforce compliance of mobile devices that use Mobile VPN with SSL or Mobile VPN with IPSec to connect to the Firebox. To do this, you must enable Mobile Security on the Firebox that the VPN clients connect to.

  1. On the Mobile Security page, select the Enforcement tab.
  2. Select the Drop VPN traffic from mobile devices that are not compliant check box.
  3. Click Save.
  1. In the Mobile Security dialog box, select the Enforcement tab.
  2. Select the Drop VPN traffic from mobile devices that are not compliant check box.
  3. Click OK.

If you enable Mobile Security enforcement for VPN connections, a user must run FireClient after they establish the SSL or IPSec VPN connection from the mobile device. Because the user has already authenticated and established a connection through a VPN, FireClient does not prompt the user to authenticate again.

Configure Exceptions

Mobile Security does not drop traffic to sites on the Mobile Security Exceptions list. By default, the Mobile Security configuration includes two exceptions that enable the FireClient app to download the application signature database, so that it can scan installed apps for compliance. You cannot remove the two default exceptions. You can add other exceptions if you want to allow traffic to specific destinations from mobile devices that are not compliant.

  1. On the Mobile Security page, select the Enforcement tab.

Screenshot of the Mobile Security page and the Enforcement tab.

  1. Below the Exception list, click Add.
    The Add Exception dialog box appears.

Screen shot of the Add Exception dialog box

  1. From the Choose Type drop-down list, select a method to identify the blocked site exception:
    • Host IPv4
    • Network IPv4
    • Host Range IPv4
    • FQDN (Fully Qualified Domain Name)
  2. In the Value text box, type the IP address, network IP address, or FQDN.
    If the exception is for a host range, type the start and end IP addresses for the range of IP addresses in the exception.
    For FQDN, you can type a specific domain name or include a wildcard to indicate the domain and all subdomains. For example, example.com or *.example.com.
  3. Click OK.
    The exception is added to the Exception list.
  4. To remove an exception, from the Exception list, select the exception, and click Remove.
  5. Click Save.
  1. In the Mobile Security dialog box, select the Enforcement tab.

Screen shot of the Mobile Security Enforcement tab with the default exceptions.

  1. Below the Exception list, click Add.
    The Add Sites dialog box appears.

Screenshot of the Add Sites dialog box.

  1. From the Choose Type drop-down list, select a method to identify the blocked site exception.
    • Host IPv4
    • Network IPv4
    • Host Range IPv4
    • FQDN (Fully Qualified Domain Name)
  2. In the Value text box, type the IP address, network IP address, IPv4 host range, or FQDN.
    If the exception is for a host range, type the start and end IP addresses for the range of IP addresses in the exception.
    For FQDN, you can type a specific domain name or include a wildcard to indicate the domain and all subdomains. For example, example.com or *.example.com.
  3. Click OK.
    The exception is added to the Exception list.
  4. To remove an exception, select the exception and click Remove.
  5. Click Save.

Related Topics

Configure Mobile Security Device Compliance