What's New in Mobility XE
Version 6.70
Mobility XE version 6.70 is based on version 6.6x, with the following changes:
Mobility XE version 6.70 connects over only one wireless IP network at a time and will communicate over that network alone. When users of mobile devices with multiple network interfaces roam into coverage of a more favorable network, Mobility disconnects from the first network and transmission through Mobility is briefly interrupted. Mobility then connects to the more favorable network. The Mobility client notifies the Mobility server about the network connection change and then Mobility reinitiates the transmission. Throughout this process, NetMotion Wireless’ patented session persistence feature aids in a smooth transition.
Users of Mobility XE version 6.70 may see the following when they transition to a more favorable network interface or when they add or remove a network interface:
- New event messages in the event logs on the client and server. The messages are of type “Information.”
- Pop-ups on the Mobility client by default when a network connection change occurs.
Users can more easily identify the network interface used by Mobility.
We believe most of our customers will not notice any appreciable difference after upgrading to version 6.70.
Server platforms
Operating systems:
Mobility XE Server 6.70 is supported on Windows Server 2003 (including SP1) and Windows 2000 Server (SP3 or later).
The minimum supported RAM on a Mobility XE server is 512 MB. The recommended amount of RAM is 2GB.
Client platforms
Mobility XE version 6.70 clients are available for the following client operating system platforms:
- Windows XP (SP1 & SP2)
- Windows 2000
- Windows Mobile 5.0 for Pocket PC and Pocket PC Phone Edition
- Windows Pocket PC 2003, Pocket PC 2003 Second Edition and Pocket PC 2003 Phone Edition
- Windows CE 5.0
- Windows CE 4.2
Mobile devices running any of these operating systems can run Mobility XE version 6.70 client software.
Windows 98, Pocket PC 2002/2000, and Windows CE 3.x devices are no longer supported.
Version 6.63
This release of Mobility XE added support for Windows Mobile 5.0 on Pocket PC and Pocket PC Phone Edition devices.
Version 6.61
This release of Mobility XE addresses known issues in the following areas:
NetMotion Wireless recommends that customers upgrade all Mobility XE version 6.60 servers to version 6.61. There are no client side changes in this release: it is not necessary to upgrade version 6.60 Mobility clients to version 6.61. There are no new features in version 6.61.
Version 6.60
Mobility XE version 6.60 was released September 30, 2005, and contains the following enhancements:
- Cryptographic libraries that are Federal Information Process Standards (FIPS) 140-2 validated. (NIST-issued certificate numbers 237, 441, and 493 are applicable.) Note: FIPS 140-2 is a standard that defines U.S. government security requirements for cryptographic modules.
- Support for 192-bit and 256-bit U.S. Government Advanced Encryption Standard (AES) encryption, in addition to 128-bit AES.
- Increased Elliptic Curve Diffie-Hellman (ECDH) key sizes for 192-bit and 256-bit AES encryption as recommended by NIST in FIPS PUB 186-2, "Digital Signature Standard."
- A new condition in the Policy Management module for "WINS server address."
Mobility XE 6.60 is a maintenance release and is automatically available at no additional charge to Mobility XE customers with a current maintenance plan.
Version 6.50
NetMotion Mobility XE version 6.50 contains new or changed functions and features that fall into the following three categories:
- Platform changes—changes to operating system support and hardware requirements.
- Core features—features generally available in the core product.
- Policy features—features available only in the Policy Management module.
Server Platforms
Operating systems:
- Mobility XE Server 6.61 is supported on Windows Server 2003 (including SP1) and Windows 2000 Server (SP3 or later).
- The minimum supported RAM on a Mobility XE server is 512 MB. The recommended amount of RAM is 2GB.
Fully Supported Client Platforms
Mobility XE version 6.61 clients are available for the following client operating system platforms:
- Windows XP (SP1 & SP2)
- Windows 2000
- Windows Pocket PC 2003
- Windows Pocket PC 2003 Second Edition (SE)
- Windows Pocket PC 2003 Phone Edition
- Windows CE 4.2
Partially Supported Client Platforms
Version 6.61 client software is not available for the following client operating system platforms:
- Windows 98
- Pocket PC 2002
- Pocket PC 2000
- Windows CE 3.x
Mobile devices running any of these operating systems can run Mobility XE version 6.01 client software. This earlier Mobility XE client version can safely connect to version 6.61 servers, although many of the new features available in version 6.61 will not be available.
Windows 98, Pocket PC 2002/2000, and Windows CE 3.x devices will continue to be supported at the Mobility XE 6.01 feature set. However, development of new features for these OS platforms has been discontinued.
Core Features
Web acceleration:
Mobility now accelerates web browsing on slow networks by compressing images. On wireless WAN connections, compression significantly speeds up web browsing performance while also using Mobility XE's mobile VPN security. The level of compression is configurable. In contrast, the web acceleration solutions provided by most wireless carriers cannot be used in conjunction with a VPN, including Mobility's.
Web Acceleration is available in two different places:
- Client Settings: Web acceleration is available in the core product without additional licensing. The level of compression can be configured in the Mobility console, Client Settings (Web Acceleration—Images and Web Acceleration—Ports). When on, all HTTP traffic on the designated ports will have the images compressed at the configured level.
- Policy Management: In the Policy Management module, web acceleration is available as a new action. The advantage to using web acceleration in policies is that you can selectively turn it off and on, change the level of compression, or change the HTTP ports, based on the current network characteristics, for a specific application, or using any of the other conditions available.
Improved compression:
When compression is on, users should experience modest overall performance improvements over WWAN connections. By default, compression is set to Auto, where the speed of a connection is automatically detected: compression is enabled when the connection is slow and disabled when it's fast.
Faster roaming on Pocket PC & Windows Mobile devices:
Pocket PC and Windows Mobile devices now use card-based roaming, which in previous Mobility versions was only available on Windows XP and Windows 2000. For most wireless LAN cards this will provide much faster subnet roaming. When changing between wireless LAN and WAN cards (media roaming), re-connect times are also improved.
Virtual Adapter:
We have changed the Mobility client architecture so that it uses a virtual adapter. The virtual adapter (NMVNIC) looks like a network interface card (NIC) and is assigned a Mobility Virtual IP address when the client connects to the Mobility server. The Mobility client's virtual adapter provides the following benefits:
- Better off-the-shelf compatibility with more applications like connection managers and personal firewalls. In the past, some programs required manually configuring passthroughs for an IP address, port, or process to function properly.
- Microsoft Outlook should be more responsive in most situations. In previous versions, the Outlook Inbox would sometimes not update immediately.
- Mobility makes NetBIOS connections persist more reliably through media roaming and suspend-resume events. In prior versions, NetBIOS connections didn't always persist during these types of events.
- When trying to gain access to domain resources from a computer in a different domain, you no longer have to explicitly specify the domain.
Dynamic DNS:
Dynamic DNS (DDNS) is now supported. The device's name is registered in DNS with the virtual IP address. This allows you to reach the device by name, even though the device may roam frequently and change its POP address, making it easier for other users or systems to connect to the mobile device.
More reliable push-down DNS/WINS:
DNS and WINS addresses are now reliably pushed down to the Mobility client devices, regardless of the network adapter's configuration or whether the services are provided by the network provider. Previously, if the network provider did not provide DNS or WINS, or if a PPP adapter was in use, Mobility could not push down addresses: they had to be hard-coded on the adapter.
Specify Mobility Servers by DNS name:
The Mobility server address can be specified as a DNS-resolvable name (e.g., mobilityserver.domainname.com) in the Mobility client. Previously, the client only supported defining the server using an IP address or by configuring a DHCP option.
Better filtering and security of network traffic:
The Mobility client is more secure because it actively evaluates all inbound and outbound connections, and every send and receive datagram (previous versions evaluated only outbound TCP connections). Although the filtering is automatically on and active for all clients, it also applies to Policy Management rules: a typical distributed firewall only provides a "block/allow" action, whereas Mobility provides block, allow (through the VPN), allow (bypassed), and allow (through the VPN and bypassed).
Because most distributed firewalls handle protocols in addition to IP (IPX, NetBEUI, etc.) and also do configuration checking and fingerprinting, Mobility's improved filtering does not replace firewall products. However, this version of the Mobility client does provide an additional layer of active security and control on IP traffic to and from the Mobility client, which supplements distributed firewall solutions.
New client properties interface:
The screen layout for Mobility Client Properities is simplified and more consistent with Windows networking. Messages and status indications are simpler, clearer, and provide more information. Better diagnostics are available for troubleshooting.
Tighter administrative control over client properties:
Settings available on the Mobility console allow administrators to prevent/allow users to take different actions in the Mobility Client Properties. The settings are now enforced regardless of whether the Properties application is launched from the system tray, program group, or control panel. In previous versions, it was possible for users to circumvent these server settings. The following user-accessible settings are affected:
- Start-up options (Connected or Default to bypass)
- Setting the Mobility server's address
- Display of warning dialogs
- Display of the tray icon
- Bypass availability
Improved support for re-imaging devices:
In most cases, when a device is re-imaged, it will get the same unique identifier (PID), allowing it to keep any associated settings and conserve device licenses. In previous versions, deploying Mobility devices based on an "image" without first deleting the PID would cause errors. And re-imaging (or "wiping" or "paving") devices would also leave stale device registration and configuration settings on a server.
Single sign-on in mixed domains:
In deployments where the user's domain is different from the Mobility server's domain, but the login name and password are the same, Mobility version 6.61 provides a single sign-on experience (previously, the user would see an error message and have to re-enter credentials).
New logon wait time setting:
A new Logon—Wait Time setting is available in the Mobility console on the Client Settings page. This setting controls the time (in seconds) that the Mobility client will wait for the domain controller to become available.
Improved session details:
Processes shown in the process list now accumulate data for the life of the session, and the data is aggregated for all of the processes with the same name. In the previous version of Mobility, process data was lost if the process was closed, and duplicate processes were displayed in the list. This change provides a much more accurate view into which applications are consuming data for the current session.
The Session Details page now shows the device's current WLAN access point SSID and MAC addresses (BSSID).
Improved NT event viewer support:
When logging events to the NT event log, Mobility now includes a single top-level event source (NetMotion) and multiple categories that match the Mobility event log. These changes allow for filtering based on event source and category, making it possible to monitor the Mobility server with SNMP using the EventWin SNMP utility available from Microsoft.
Improved activity log data file:
The activity log disk file contains proper headings for all fields. Fields for SSID and BSSID, the state of encryption, and the state of compression have been added and are logged with each Roam or Statistics event.
Option to install server "off-line":
When new Mobility servers are installed, they can be configured to start off-line after their initial reboot, allowing the administrator to configure servers before allowing them to accept connections.
Changed default size of event log on client and server:
The default size of the event log was increased from 4MB to 8MB on both the client and server (but not on Pocket PC/Windows Mobile devices). Because changing the event log size requires rebooting in order to take effect, the larger default size should allow most customers to capture troubleshooting information without changing the event log size.
Mobility console improvements:
- The Page Size setting on list screens is now remembered between sessions.
- The primary warehouse and the list of backup warehouses—if there are any—are listed on the About page.
- Client and server settings that have been changed from the default now show a "setting override" arrow.
- The Devices screen (Client Settings —> Devices) can display which devices have a statically-assigned virtual IP addresses.
Policy Features
New conditions:
Access point SSID & MAC address:
Define conditions based on the connected access point's SSID (Service Set Identifier) or MAC address (BSSID/Basic Service Set Identifier). Policies cannot prevent a device from connecting to an access point, but rules can allow or prevent data to be transmitted over access points.
Time—calendar/clock:
Conditions can be defined based on a time, day of week, or calendar date, based on the mobile device's system clock and configured time zone. And the rules can recur daily, weekly, monthly, or yearly.
Time—connectivity:
Define conditions based on how long the Mobility server has been "reachable" or "unreachable". These conditions allow policy actions to be taken a specified period of time after the client connects to or goes out of range of the Mobility server.
Client version condition:
Define conditions based on the Mobility client software version running on the mobile device, including major and minor build numbers.
Operating system version condition:
Define conditions based on the device's operating system version, including major and minor build numbers, and processor architecture and type.
Local address condition:
Define conditions based the mobile device's local network, including subnet.
Combine conditions:
Combine multiple conditions in a single rule to further refine policies to fit specific situations.
New Actions:
Combining targets (applications & addresses):
For the block, allow, pass-through, and disconnect actions, applications can be combined with addresses to further refine the action. For example, a rule can be created to give IEXPLORE.EXE access to a specific IP address but be blocked from access to all others. (Previously, rules could only be defined that would either block IEXPLORE.EXE to any address or block any application from going to a specific address.) These rules can also be more complex; for example, you can set up a rule to block IEXPLORE.EXE and MOZILLA.EXE from going to a list of IP addresses.
Launch processes:
Define policies that launch processes and applications. Standard command line syntax is supported:
- Entering
iexplore.exe http://www.nmwco.com opens Internet Explorer to the designated webpage.
- Entering just
http://www.nmwco.com opens the default browser to the designated web page.
- Simple substitution is also supported to allow for folder variances between machines:
%PROGRAM_FILE% |
maps to |
c:\program files |
%WINDOWS%
|
maps to
|
c:\windows
|
%SYSTEM%
|
maps to
|
c:\windows\system32
|
Local networking:
The "Set local networking on/off" action gives mobile users access to local network resources like file shares and printers that are on the same subnet as the mobile device. Local network traffic bypasses the Mobility VPN tunnel and is not sent to the Mobility server. By default, turning local networking on makes it active for every POP interface on the mobile device. Using policy conditions, you can refine this behavior so that local networking is on for only defined networks or subnets.
Show balloon:
So that you can notify mobile workers when a policy may change their expected behavior, the block, allow, pass-through, and disconnect actions support balloon pop-up events. Balloons can be triggered when the rule is first run or each time it is enforced. If a specific address is included in the rule, then the balloon will continue to pop up each time the address is requested.
Friendly application names:
Policies based on application now support "friendly names" so that you can specify, for example, "Internet Explorer" instead of "IEXPLORE.EXE". The rule definition screen presents the friendly name when creating a rule.
Disable roaming:
Rules can temporarily disable roaming. This action is typically used in hotspot rules.
Hotspot sample policies:
The hotspot policies allow a hotspot vendor's login screen to appear so that the user can log in when the client connects to a known hotspot, while still maintaining persistence and without requiring that the user bypass Mobility. The sample policies use many of the new conditions and actions as building blocks. For example, "When connected to T-Mobile hotspot (SSID is T-Mobile) and unreachable for 10 seconds, run http://login.t-mobile.com and bypass all connections to UDP port 53."
Miscellaneous policy changes:
- Changes to rules and rule sets are immediately sent to Mobility client devices and enforced, without requiring the device to reconnect. (In previous versions, policies were only refreshed when a device (re)connected.)
- Errors in rules are displayed more clearly.
- Rules and rule set pages now include filters.
- Rules can now be ordered to enforce the order of evaluation.
- Creating rules is simpler, requiring fewer clicks and dialogs.
- Rules and rule sets now track the date of the latest modification.
