Known Issues

Known Issues

The following are known issues for the XenMobile 10 MDM Upgrade Tool:

• The XenMobile lockout limit value is not migrated. After migration, reset the value. [#545770]
• Options in role-based access control (RBAC) roles do not migrate cleanly. After migration, review RBAC roles and make any necessary adjustments. [#543183]
• Log settings do not migrate. After migration, re-configure log settings in the XenMobile console. [#541869] 
• When a configuration with multiple LDAP configurations in which only one LDAP configuration to support nested groups is migrated, after migration, nested groups support is enabled on all LDAPs you configured. In addition, groups synchronization happens on all LDAP servers during server start-up. [#540713]
• When a Web Content Filter device policy contains URLs without HTTP/HTTPS, the URL is deleted when users edit the URL and then cancel the operation. After migration, make sure all URLs contain HTTP or HTTPS to prevent deletion when canceling an edit operation. [#540025]
• When policies, apps, or actions are included in multiple packages with different rules, deployment rules do not migrate. This behavior is as designed. [#539517]
• The XenMobile 9.0 administrator cannot log on to the XenMobile 10 console after successful migration when the administrator user name contains an uppercase character. Before migration, create an administrator user account with all lowercase letters and with all permissions enabled so that after migration you can use that account to log on to the XenMobile 10 console. [#547422]
• If Multi-Tenant Console (MTC) is enabled on XenMobile 9, MTC cannot be migrated to XenMobile 10. [#549969]
• The Super Admin role created in XenMobile 9.0 does not migrate several setting and assignment permissions in XenMobile 10. After migration, in the XenMobile 10 console, go to Configure > Settings > Role Based Access Control and recreate the XenMobile 9.0 Super Admin role with permissions from the XenMobile 10 Admin role. [#553079]
• Deployment package names created in XenMobile 9.0 with special characters (:, !, $, (), #, % , +, *, ~, ?, |, {}, and []) cannot be edited after migration. In addition, local users and local groups created in XenMobile 9.0 that contain an open square bracket ([) cause problems in XenMobile 10 when creating enrollment invitations. Before migration, remove all special characters from Deployment Package names as well as open square brackets from local user and local group names. [#538639]

Prerequisites

Prerequisites

You need to complete the following prerequisites before you run the XenMobile 10 MDM Upgrade Tool.

Citrix License Server

Make sure that you install the 11.12.1 Citrix License Server (available on the page) and that you configure the server with the latest V6 MDM-only license. Ensure that the licensing server ports 27000 and 7279 are open to the server. This step is crucial to prevent unintentionally upgrading users' devices to XenMobile Enterprise mode, which may lead to a licensing violation and also force users to re-enroll their devices.

Database

Migration can only be done between databases of the same type. For example:

Supported

• PostgreSQL to PostgreSQL
• MSSQL to MSSQL

Not supported

• MSSQL to PostgreSQL
• PostgreSQL to MSSQL

During the data migration process, XenMobile needs the ability to access the database solution implemented on XenMobile 9.0 Device Manager. For example, the following ports must be open:

• For Microsoft SQL Server, the default port is 1433.
• For PostgreSQL, the default port is 5432.

To allow remote connections to PostgreSQL, you must complete the following steps:

1. Open the file pg_hba.conf and locate the following line: "host all all 127.0.0.1/32 md5"

2. Append a new line host all all [XMS address/external address]/32 md5 

3. Save the file.

4. Stop and start the service.

5. Locate and open the postgresql.conf file and change this line from:

"#listen_addresses = 'localhost'" to "listen_addresses = ‘*’"

Note: The line must be uncommented. This can be made restrictive by allowing only XenMobile 9.0 and XenMobile 10 server IPs to access the PostgreSQL database (listen_addresses = '10.x.x.1,10.x.x.2').

6. Stop and start the PostgreSQL service for changes take effect.

7. Ensure that XMS and the database are able to communicate with each other. (This also checks that the database is able to accept remote connections.)

If a custom port has been assigned to the database solution, you have to ensure that the port is allowed and open in the firewall protecting XenMobile 9.0 Device Manager. Doing so enables XenMobile 10 to connect to the database and to migrate the required information.

External SSL certificate

External SSL certificates must meet the conditions outlined in . Be sure to review your pki.xml before starting the migration to ensure that the SSL certificate meets those conditions.

Administrator account user name

The administrator account used to log on to the XenMobile 10 console can contain only lowercase letters; you will not be able to log on to the XenMobile 10 console after migration if the account contains uppercase letters. Create an administrator user account with all lowercase letters and with all permissions enabled so that after migration you can use that account to log on to the XenMobile 10 console.

Deployment Package names with special characters

Deployment package names in XenMobile 9.0 that contain special characters (!, $, (), #, % , +, *, ~, ?, |, {}, and []) migrate, but the Delivery Groups in XenMobile 10 cannot be edited after migration. In addition, local users and local groups created in XenMobile 9.0 that contain an open square bracket ([) cause problems in XenMobile 10 when creating enrollment invitations. Before migration, remove all special characters from Deployment Package names as well as open square brackets from local user and local group names.

Copy files from XenMobile 9.0 Device Manager

Assuming Device Manager is installed in the default location (C:\Program Files(x86)\Citrix\XenMobile Device Manager\tomcat), copy the following files into a temporary folder:

From C:\Program Files (x86)\Citrix\XenMobile Device Manager\tomcat\conf folder:

• server.xml
• https.p12
• cacerts.pem.jks
• pki-ca-root.p12
• pki-ca-devices.p12
• pki-ca-servers.p12

Note: If custom server SSL server certificates (.p12) were used on the server running Device Manager, make sure that you copy that certificate instead of https.p12 to the temporary folder.

From the C:\Program Files (x86)\Citrix\XenMobile Device Manager\tomcat\webapps\zdm\WEB-INF\classes\ folder, copy the following files into the same temporary folder:

• ew-config.properties
• pki.xml
• variables.xml

After you have copied all the preceding files, open the temporary folder and zip the files; do not zip the folder, only the files. The zipped files will be uploaded during the upgrade.

When you understand the known issues and meet all the prerequisites, start the upgrade. For details, see Running the XenMobile 10 MDM Upgrade Tool.