LevelBlue Knowledge Base » Knowledgebase » Legacy Products » Mobile Client

Where do I send a feature request for a LevelBlue Marshal product?

Charles Creegan — Sun, 01 Mar 2020 00:00:00 GMT

This article applies to:

MailMarshal (SEG)
MailMarshal ECM/MailMarshal Exchange
MailMarshal SPE
WebMarshal

Question:

Where do I send a feature request for a LevelBlue Marshal product?

Procedure:

If you want to request a new feature or you want to suggest an improvement for any product, you can contact Technical Support. You can also enquire through your account manager or reseller.

MSC is using excessive network-bandwidth

Tunji Akanni — Tue, 09 Apr 2013 09:58:53 GMT

This article applies to:

WF 5.x
WFR 5.x

Question:

After installing the Mobile Security Client in my network, I noticed a spike in the bandwidth usage of the Mobile-Web Filter device. Is there any reason why this is happening?

Information:

The bandwidth usage on your firewall is expected to be high in relation to the MSC just because of how it is designed and configured/installed. That is, the MSC is setup to work as a proxy and unlike the internal filter were request are only been mirrored.

The screen shot below shows how the MSC works when a URL request is made.

The checks and balances performed by the MSC is the major reason why there is a spike in it network bandwidth usage.

Optional.

Collect Log Files for the Mobile Security Client

Saad Shafiq — Tue, 02 Apr 2013 10:52:11 GMT

This article applies to:

Windows
Macintosh

Question:

How to collect log files for the Mobile Security Client?

Information:

During the initial configuration of the Mobile Security Client if the option for ”hide system tray” was not checked then you should be able to see a multicolored Shield icon for the MSC on the task-bar for Windows, and for Macintosh the icon should be located at the top right.

In order to create a zip folder for the logs click on : MSC Icon > About > Collector info

This will create a zip folder that contains all the logs for the MSC.

In case the MSC Icon is not being displayed you can access the Collector info manually from the following path :

Windows

C:/Program Files(x86)/M86 Security/Info Collector

Macintosh

/Applications/M86Security/M86MobileSecurityClient.app/Contents/Resources/M86InfoCollector

Is there a complete list of MSC ports to open for WF in DMZ

Imran Chaudhry — Tue, 26 Mar 2013 05:55:07 GMT

This article applies to:

Web Filter

Question:

Is there a complete list of MSC ports to open for WF in DMZ?
Is there a complete list of WF and SR ports with usage.

Reply:

Notes:

If any of the client machine(s) or server(s) is/are behind the firewall, port(s) may need to be opened on the firewall. MSC HTTP and HTTPS ports are configurable; check your MSC/WF configuration to verify the related ports need to be opened.

Where can I view a list of all categories and their definitions?

Giovanni Romualdi — Mon, 25 Mar 2013 14:44:55 GMT

This article applies to:

WFR, IR
WF, R3000

Question:

Where can I view a list of all categories and their definitions?

Information:

Click on the link below to view the list of all Trustwave (M86 Security) supplied categories and their definitions.

https://www.trustwave.com/web-security/web-filtering/database-categories/

How to convert a Trustwave Mobile Security Client .EXE installer package into an .MSI installer package

Giovanni Romualdi — Fri, 02 Nov 2012 10:58:47 GMT

This article applies to:

Mobile Security Client
Secure Web Gateway
Web Filter
MS Windows

Legal Disclaimer:

Trustwave makes no representations or warranties of any nature regarding the third party tools/products referenced herein. Your use of such third party tools/products is entirely at your own risk, and you agree Trustwave shall have no liability resulting therefrom.

Problem Description:

The Trustwave Mobile Security Client (MSC) for MS Windows PCs is provided as an .exe installer package that is downloaded from the Secure Web Gateway (SWG)/Web Filter (WF) Policy server. In order to provide an .MSI (Microsoft Installer) type installer package, as used by some software distribution systems, a simple conversion procedure must be performed.

Prerequisits:

Download and install an exe to MSI conversion tool. For example - .EXE to .MSI conversion tool from http://download.cnet.com/Exe-to-Msi-Converter-Free/3000-2216_4-10969236.html
Mobile Security Client version 2.0.0.14 and later
Secure Web Gateway 10.2 and above or Web Filter 5.0.10 and later

Procedure:

For SWG only, configure cloud settings in the console and commit changes.
Download from the SWG/WF console the MSC installer for the Windows platform and save it.
Execute the exe to MSI conversion tool. The following steps assume that the “Exe to MSI Converter” tool specified above is used:
- Select the downloaded MSC installer as the ‘Setup Executable’
- If silent installation is required, enter “/S” in the arguments field
- Click ‘Build MSI’ button
- An MSI file with the same name as the MSC installer given as input is created in the same directory

Now use the .MSI installer package in place of the .exe for MSC Windows client installation via your chosen software distribution system.

How to unblock applications in mobile client

Alfred Alva — Wed, 10 Oct 2012 08:11:59 GMT

This article applies to:

Legacy Mobile client 3.0.7

Question:

How to unblock applications in mobile client

Procedure:

Open mobile client deployment kit after you down load it, File> create a new or modify the current one.

To find what application is receiving blocks, Turn on application debugging logs by putting this in "application options" field (see below):

Mode 0
logall -c * -xt *,0 -xl *,0

Step 1: First line entry
By default, the Application Options Settings in the mobile client deployment kit field is empty. If
you wish to add any options, you must first type in Mode 0
on the first line. For example:
Mode 0
{option #1}
{option #2}
…
Step 2: Identify the name and path of the application
Determine the name and path of the executable program for
which network access should be blocked or granted unrestricted
network access. For example:
Program Files\Mozilla Firefox\Firefox.exe

Step 3: Add an option line for the application
Enter an option line for each application to be blocked or bypassed.
========================================================
To block an application, for example:
block_firefox -c “c:\Program Files\Mozilla Firefox\Firefox.exe” -k

To bypass an application, for example:
bypass_myapp -c “c:\Program Files\MyCorporation\MyCustomApp\MyApp.exe” -b

other apps to exclude
Mode 0
java -c java.exe -b
javaw -c javaw.exe -b
sym1 -c "\Program Files\Java\jre6\bin\jqs.exe" -b
java1 -c "\Program Files\Java\jre6\lib\deploy\jqs\jqs.conf" -b
sym2 -c "\Program Files\Symantec" -b
sym3 -vN "symantec" -b
sym4 -vP "symantec" -b
sym5 -vP "endpoint" -b

This is will create several files in /windows/temp that start with M86, look in those files for application errors to see what application needs to be bypassed

To bypass or block put the following in the 'application option settings' field:(see screen shot below)
_________________________________________________________________________________

There is a full list of the commands mobile manual in the wfr/mobile client section below.

https://support.levelblue.com/mobile-client/documentation.asp

NOTE: If you already mass deployed, then you will need to uninstall and redeploy again.

java seems to cause themost problems, here are some .exe we found to exclude.

________________________________________________________________________________________________________

Notes:

Optional.

Uninstalling mobile client from several mac computers at the same time

Patricia Otteson — Wed, 16 May 2012 14:15:04 GMT

This article applies to:

Mobile Client

Question:

Is there a mass uninstall mobile client for Mac computer?

Information:

Please contact the support team to get mobile client purge file mac version. If you want to uninstall mobile client from one mac, follow the instructions below:

1. Sign-in as "root".

2. Open Finder and click on the Hard Drive icon.

3. Go to Library\Application Support\Bsecure

4. There will be an uninstall file.

Click on it and enter the uninstall key number provided by the Administrator.

Note:

Administrator needs mobile client deployment kit in order to obtain an uninstall key.

Uninstalling a mobile client on a MAC

Imran Chaudhry — Thu, 10 May 2012 07:03:42 GMT

This article applies to:

Mobile Client

Question:

Uninstalling a mobile client on a MAC

Reply:

Please sign-in as "root" and follow the instructions listed below:

1. Open Finder and click on the Hard Drive icon.

2. Go to Library\Application Support\Bsecure

3. There will be an uninstall file.

Click on it and enter the uninstall key number provided by the Administrator.

Note:

Administrator needs mobile client deployment kit in order to obtain an unintall key.

Can I use the older Mobile Client with the WF 5.0 Release?

Charles Creegan — Wed, 14 Mar 2012 14:43:57 GMT

This article applies to:

Question:

Can I use my existing older Mobile Client with the WF 5.0 Release?

Reply:

Due to changes in mobile filtering introduced by the latest Trustwave Mobile Security Client (MSC), the Web Filter 5.0.00 software is incompatible with the former M86 Mobile Client v3.0.x. Thus, by applying this upgrade, the legacy M86 Mobile Client will no longer be operable in your environment.

Mobile Client blocks Java applications

Giovanni Romualdi — Fri, 06 Jan 2012 14:03:31 GMT

This article applies to:

Mobile Client 3.x

Question:

Why is my mobile client blocking all Java applications?

Information:

The mobile client currently has a feature that will block all Java applications if the user's profile is set to block the Instant Messaging category or the Peer-to-peer category. This was implemented in order to help block various Java-based utilities that facilitate IM and P2P-type traffic. If this is undesired, one can either Pass/Allow these categories, or set up a bypass for the Java executable in the Application Options portion of the mobile client configuration. Further information on creating application bypasses can be found in article 14127.

Features not available in Mobile Client

Imran Chaudhry — Thu, 29 Dec 2011 12:00:16 GMT

This article applies to:

All version of Mobile Client

Question:

What features are not part of the mobile client?

Information:

The following features are not available when using the mobile mode:

Minimum Filtering Level,

Time Profile,

Override Account,

Exception URL,

LDAP Authentication,

and the Warn filter setting.

Note:

An end user with categories blocked in his/her profile will be blocked from categories with a Warn or Quota setting instead of receiving a warning or quota page. If his/her profile does not contain blocked categories but instead contains categories with Warn or Quota settings, the Global Group Profile will be assigned instead.

Where is the Mobile client debug log file stored?

Alfred Alva — Tue, 15 Nov 2011 08:47:08 GMT

This article applies to:

Mobile Client

Question:

Where is the Mobile client debug log file stored?

Reply

For version 3.x mobile client log file name is “M86Security-mobile.log”.
Waco can guide the customer to locate the log file at following location.

Windows XP: C:/Documents and Setting/USERNAME/ M86Security-mobile.log
Windows Vista/7: C:/Users/USERNAME/ M86Security-mobile.log
• USERNAME: use the name of the user in question.

Mac: /private/var/log/M86Security-mobile.log

Just keep in mind, for mobile client version 2.x, the log file name is still 8e6-mobile.log

This article was previously published as:: 8e6 KB 291178

Which NIC's MAC address is sent to the Mobile Filter for identification?

Charles Creegan — Thu, 23 Sep 2010 18:05:22 GMT

This article applies to:

Mobile Client (legacy product)

Question:

Which NIC's MAC address is sent to the Mobile Filter for identification?

Reply:

When the Mobile Client is installed on a laptop computer with more than one NIC, the mobile client detects the NICS using the order they were enumerated in the operating system. This generally results in the wired or internal NIC first, but not always.

You can view the Realtime Traffic Log on the web filter to see what MAC address the mobile client is sending to the mobile server for identification. The MAC address will always remain the same, unless the mobile client is re-installed.

e.g.

192.168.1.4, John.Doe 00:1f:3c:93:23:6f, 2010/09/23,18:54:17, SE,0,4,, http://*.GOOGLE.COM/, http://clients1.google.com/

In the example above, the MAC address is "00:1f:3c:93:23:6f".

If you have a lot of activity in the traffic logs, and it's too difficult to locate a specific user, you might try doing a Real-Time Probe on a specific URL, and then go to that URL on the laptop. The more obscure the URL, the better your chances of finding the specific user you're looking for.

This article was previously published as:

8e6 KB 276836

Mobile Client 3.0.5 and Novell ZenWorks

Charles Creegan — Thu, 26 Aug 2010 18:36:54 GMT

This article applies to:

Mobile Client 3.0.5 and above

Symptoms:

With Novell ZenWorks and the Trustwave mobile client installed, it can take up to 15-minutes to reach the Desktop.

Causes:

This is a known issue.

Resolution:

Load your mobile client into the Mobile Client Package Editor. Add the following lines inside the "Application Options Settings" field:

Mode 0
zen1 -c "\Program Files\Novell\ZENworks\bin\ZenworksWindowsService.exe" -b
zen2 -c "\Windows\Novell\ZENworks\bin\zenpreagent.exe" -b
zen3 -c "\Program Files\Novell\ZENworks\bin
zrwinvnc.exe" -b
casa1 -c "\Program Files\Novell\Casa\bin\micasad.exe" -b

Save the new mobile client and install it on the affected laptops.

Notes:

Keep in mind that the executable programs on YOUR laptops might reside in different paths/directories than shown in this article. Be sure to verify where the executables are, and adjust the entries accordingly.

What is the Mobile Client Distributor?

Charles Creegan — Fri, 11 Jun 2010 18:58:00 GMT

This article applies to:

Mobile Client (legacy product, version 2.1.0.1 and below)

Question:

What is the "Mobile Client Distributor?"

Reply:

After installing a mobile client via the .msi installer created with the 8e6 Mobile Client Deployment Kit, you may notice that in your Add/Remove Program interface, there is a program called "8e6 Mobile Client Distributor" along with the "8e6 Mobile Client." The distributor is a .msi “shell” which launches the actual installer. The actual installer is a custom EXE which was developed without reference to the Microsoft Installer technology. In order to do Group Policy (bulk) deployment, a package compatible with the Microsoft Installer was needed, so the Distributor was created. If needed, the distributor can be uninstalled by the user, and it will cause no problems. Since it is simply a wrapper for the actual installer, it serves no purpose once the install is complete.

NOTE: In Mobile Client version 3.0.5.0, released in May 2010, the Windows installer was completely revised and now works more efficiently with Windows Group Policy. As a part of these enhancements, the old "Mobile Client Distributor" is no longer used in this product.

This article was previously published as:: 8e6 KB 276842

What happened to the "CfgClient.exe" configuration tool?

Art Espinoza — Fri, 11 Jun 2010 18:50:00 GMT

This article applies to:

Mobile Client version 3.0

Question:

What happened to the configuration tool (CfgClient.exe) used for configuring the Mobile Client?

Information:

Starting with Mobile Client version 3.0.5.0, the Mobile Client is now configured using the new Mobile Client Deployment Tool (Mc_tool.exe) in conjuction with the new Package Configuration window.

Notes:

What issues are resolved in Mobile Client 3.0.5.0?

Charles Creegan — Fri, 11 Jun 2010 18:28:00 GMT

This article applies to:

Mobile Client version 3.0.5.0

Question:

What issues are resolved in Mobile Client 3.0.5.0?

Information:

The Mobile Filter is no longer bypassed if the mobile workstation accesses a free public WiFi spot.
The blockcat.txt file found in an end user's home directory on a Mobile Client workstation does not affect an end-user's filtering profile, but has now been encrypted to prevent any misconceptions about the function of this file.
The Mobile Client cannot be deactivated if using OpenDNS.
Proxy server settings now function for both the Mobile Client Windows and Macintosh OS X versions.
Modifications were made so that InetCntrl no longer uses all the CPU functionality is using a Novatel modem.

How Can I Use Multiple Mobile Filters?

Giovanni Romualdi — Tue, 08 Jun 2010 17:45:00 GMT

This article applies to:

Mobile Filter (any)
Mobile Client (up to 2.1.15.1)

Question:

How can I set things up to use multiple mobile filters (for reasons such as setting one up as a fail-over backup)?

Procedure:

When using the mobile client configuration editor, you are able to add multiple IPs to the "mobile filter host(s)" section, one IP at a time. When starting up, the client will simply try to use the first IP in the list, and move on to try the additional IPs if connectivity to the first IP fails.

Configure mobile client 3.0 package

Giovanni Romualdi — Tue, 08 Jun 2010 17:39:00 GMT

This article applies to:

Mobile Client 3.0

Question:

Configure mobile client 3.0 package

Information:

The new Package Configuration window—accessible via the Mobile Client Deployment Tool—includes new features and some existing labels and criteria as in the former Mobile Client Configuration Editor window:

Package Information frame (new in this release) displays the Path information for the package to be configured, formerly displayed in the Package loaded field at the bottom of the Mobile Client Configuration Editor window.
Network Settings frame includes the same criteria as in the former Network Settings frame in the Mobile Client Configuration Editor window.
Automatic Update Settings frame (new in this release) is used in conjunction with the new Mobile Client Updater (MCU), a new, optional component which, if installed on workstations, will automatically update the Mobile Client via deployment by the Web Filter or a Web server you maintain. An entry in the Update URL Base field is only required if using a Web server to deploy updates to clients.
Application Options Settings frame (new in this release) is used for specifying coding that will modify the behavior of the Mobile Client if specific applications on your network need to be accommodated.

The Package Configuration window File menu includes the following options:
Save: Saves your edits and launches the Mobile Client Package Contents page.
Save As...: Opens the Save Package window where you specify the name for the package to be saved, and launches the Mobile Client Package Contents page.
Save and Quit: Saves your edits, closes the Package Configuration window, and launches the Mobile Client Package Contents page.
Apply Defaults: If the new “Save as defaults” option was specified in the Package Information frame, the saved defaults are applied to the current, selected package.

What is Mobile Client Updater?

Giovanni Romualdi — Tue, 08 Jun 2010 17:39:00 GMT

This article applies to:

Mobile Client 3.0

Question:

What is Mobile Client Updater?

Information:

This package installs the optional Windows / Mac OS X Mobile Client Updater component. When installed, the Mobile Client can automatically update itself from the web or R3000 Mobile Server. In order to use the optional Mobile Client Updater (MCU) component to distribute product or configuration updates to end users, you must first install the MCU on end user workstations. Then you must select the host server to deploy updates to end user workstations.

Access the appropriate MCU installer (8e6winmcu.msi for Windows and 8e6osxmcu.pkg.tar for Macintosh OS X) and copy it to respective user workstations. Install the installer as you would any other program. No additional configuration is required for the MCU component.

Notes:

This is a one time operation; after this procedure the MCU will update itself when a new version is deployed.

How often the Mobile Client updater (MCU) checks for Mobile Client updates?

Giovanni Romualdi — Tue, 08 Jun 2010 17:39:00 GMT

This article applies to:

Mobile Client 3.0

Question:

How often the Mobile Client updater (MCU) checks for Mobile Client updates?

Information:

The Mobile Client updater (MCU) checks for Mobile Client updates after each successful synchronization attempt. By default, synchronization attempts occur once per hour (unless you have modified the Mobile Server configuration to specify otherwise).

When a new Mobile Client version is detected, the MCU immediately attempts to download it. Because the clients do not coordinate their synchronization attempts with each other, the timing of download attempts will follow a random statistical distribution. Nevertheless, it is conceivable that if you have 4,000 client workstations, they might all attempt to download the update within the first hour after it is posted, although the starting times of each download will vary.

Notes:

A full Mobile Client update file size is about 1.5 MB for Windows and 1.4 MB for Macintosh OS X (as of software version 3.0.5).

How Mobile Client Updater (MCU) updates clients?

Giovanni Romualdi — Tue, 08 Jun 2010 17:38:00 GMT

This article applies to:

Mobile Client 3.0

Question:

How Mobile Client Updater (MCU) updates clients?

Information:

The server will unpack the files into the default update location so that clients can find the update as expected. The default location is http://{mobile Server host/ip}:81/mobile_client_updates. To verify that your update files have been posted, go to the file latest-manifest.mcxml in this directory. Clients read this file to determine if applicable updates are available.

When the MCU reads available update information, it gives priority to new versions of the software. If a new version of the Mobile Client is available, it is downloaded and installed.
Since the updated package contains an embedded copy of the latest configuration, this is adequate to ensure both the software and the configuration are updated. However, if the MCU finds no new software available, it checks to see if a new configuration is available. If the latter is available, that is downloaded and applied. Such updates are much smaller in size than updating an entire new version of the Mobile Client.

Can I install mobile client using Group Policy?

Charles Creegan — Tue, 08 Jun 2010 17:37:00 GMT

This article applies to:

Mobile Client (legacy version)

Question:

Can I install mobile client using Group Policy?
How can I install mobile client using Group Policy?

Information:

The Windows Mobile Client can be installed directly, by launching it from the client workstation or by assigning it to the client with Windows Group Policy. This is the "normal" installer for Windows. For Max OS X use Apple Remote Desktop to distribute in bulk.

The modified 8e6client.msi file is distributed to multiple Windows workstations by creating a Group Policy Object (GPO) which assigns this software to the required computers on the network.
NOTE: The procedure suggested below presumes that you are using the free add-on Group Policy Management Console (GPMC) provided by Microsoft.

1. Make the distribution .msi file available to the target workstations on a network share (e.g. \\{servername}\8e6MobileClient\8e6client.msi) .

2. Create a new Group Policy Object (GPO):
a. in the GPMC, select Group Policy Management > Forest > Domains > {domain name} > Group Policy Objects.
b. Right-click and choose "New", then create a name for the policy (suggested name: "Mobile Client Deployment"). Click OK.
c. In the Group Policy Object Editor, open the {policy name} > Computer Configuration > Software Settings > Software installation node.
d. Click the right panel and choose New > Package. Navigate to the distribution .msi file you shared in step
1, and then click “Open”. When prompted, select "Assigned" for the deployment method. Click OK.
e. Right-click the new package and choose Properties > Deployment, and then check the "Uninstall this application when it falls out of the scope of management" box. Click OK.
f. Close the Group Policy Object Editor.

3. Link the new policy:
a. In the GPMC, select the domain or organizational unit for which the policy should be applied.
b. Right-click, choose "Link an existing GPO", and then select the new policy you created in step 2. Click OK.
c. Right-click the new policy in the tree, and then deselect the "Link Enabled" menu checkmark. (The link will be re-enabled later in this procedure.)

4. Create a filter for the policy:
A GPO filter limits the scope of the policy so that the Mobile Client is only installed on the appropriate computers. For example, you may want to install it on all workstations but not servers. There are two types of filters: Security filters and WMI filters.
To create a Security filter:
a. Select the new policy link. Note the "Security Filtering" section in the Scope panel to the right.
b. Click "Authenticated Users" and then "Remove".
c. Click "Add...", and then click "Object Types". Check the "Computers" type and uncheck the "Users" type. Click OK.
d. Enter the names of all the computers to receive the Mobile Client installation, separated by semicolons.
(Alternatively, you can select a User or Computer group created previously—details of group creation are beyond the scope of this procedure. Click OK.

To create a WMI filter:
WMI filters are capable of applying very sophisticated selection criteria to set the scope of a policy. See Microsoft Knowledgebase article #555253 for details on creating WMI filters: http://support.microsoft.com/kb/555253

5. Enable the policy link: Return to the new policy link in the GPMC for the target domain or Organizational Unit, right-click, and then choose "Link Enabled".

6. Test the deployment:
a. Select one of the workstations within the scope of the policy and refresh its policies by running gpupdate. exe.
NOTE: By default, Windows periodically refreshes the group policy automatically. Using gpupdate allows you to force an immediate refresh for test purposes—this is not something all users on the network should be required to do.
b. Reboot the workstation and log in.
NOTE: In some cases involving Windows XP workstations, it may be necessary to reboot twice for Group Policy processing to occur.
c. Verify the Mobile Client is blocking access to unauthorized sites.

What URL should I specify for Mobile Client 3.0 Auto Update?

Giovanni Romualdi — Tue, 08 Jun 2010 17:37:00 GMT

This article applies to:

Mobile Client 3.0

Question:

What URL should I specify for Mobile Client 3.0 Auto Update?

Information:

A URL directory entry is required in the Automatic Update Settings frame only if the Mobile Client Updater will be installed on end user workstations and a Web server will be used for deploying updated Mobile Client package configuration updates to these workstations.
You do not need to specify a URL directory entry if you wish to use the Web Filter (running software version 4.0 or higher) to deploy updates to end user workstations.

Notes:

Using the Web Filter to deploy updates could impact the performance of the server.