Yes, the Access server will work in conjunction with Microsoft Active Directory to configure and authorize user accounts and groups.

There is normally no need for administrators to set up accounts directly in Acronis Cyber Files.

No. It's designed to support external ad hoc users, if allowed by the security permissions. A user can invite an external user by email address and an ad hoc account will be created automatically. The new user will receive an email invitation with a passkey link to set their password the first time.

Yes, though some features depend on AD integration, such as Policies.

No. To use the LDAP integration features, Microsoft Active Directory is required.

Through the Access web admin (General Settings --> LDAP --> LDAP Server Address) you can specify the Active Directory domain FQDN instead of a specific domain controller (e. g. just acme.com instead of dc1.acme.com). Then when the Access server sends an LDAP request, the first available domain controller will reply. This helps to ensure continuity if one of the domain controllers fails or goes offline for maintenance. If you need to authenticate users across multiple domains, note the following configuration and caveat.

If you want Access to authenticate users from multiple domains in the same Active Directory forest, then you can configure it to use a domain controller that has the Global Catalog role enabled. To do so, change the LDAP Server Port in Access from 389 to 3268 (or 3269 if the domain is configured for Secure LDAP).

Note that if you set the Global Catalog port and follow the recommendation to specify the LDAP Server Address as just the domain FQDN (e.g., acme.com rather than dc1.acme.com) you will need to ensure that all domain controllers can respond to Global Catalog requests on the specified port (3268 or 3269). Otherwise, there could be a situation where the normal controller becomes unavailable and Windows refers the request to a regular domain controller that is not handling Global Catalog requests.

You can confirm the status of your domain controllers as follows: In the Windows Server tool Active Directory Sites and Services, navigate to Sites --> Default-First-Site-Name --> Servers. The domain controllers should be listed there and the DC Type column will indicate GC for ones that support Global Catalog requests.

If you need Global Catalog support but cannot ensure that all domain controllers support it, then you can set the LDAP Server Address in Acronis Cyber Files to a DNS entry that points to a single Global Catalog server (e.g., gc1.acme.com), or a dynamic DNS entry (e.g., gc.acme.com) that's managed so that it points to one of the active servers configured to handle Global Catalog requests.

Note: To use the LDAP integration features Microsoft Active Directory is required.

Symptom:

When logging into the Access web interface a user sees the error "Invalid username/password combination"

Cause:

Of course, it may just be an incorrect password. But if the error occurs with a valid domain email address and password, it may be a sign that the LDAP configuration isn't set to properly recognize the domain name. If this is the case, you should find that logging in as john@mycompany.com fails but logging in as mycompany\john will work.

Resolution

1. In the web admin, navigate to General Settings --> LDAP
2. In "Domains for LDAP Authentication" specify the domains names corresponding to email addresses your Active Directory users may have. For example, if some users have addresses ending in mycompany.com and others have mycompany.co.uk, enter set the field to "mycompany.com, mycompany.co.uk".

Symptom:

When clicking on a Sync & Share folder through the Acronis Cyber Files app on a mobile device, the user gets an error "Logon failure: unknown user name or bad password. (1326)"

Cause:

This indicates that the mobile app is not able to authenticate the user through the Gateway service. There are several possible causes.

Resolution

1. Make sure the folder's Data Source settings point to the correct service and port. It should be for the Tomcat service, not for the Gateway Service.
2. Make sure the right domains are General Settings --> LDAP > Domains for LDAP Authentication. Note that if there are multiple domains involved, it may be necessary to add some or all of them in the field. For example, if there are users who have Windows logon IDs like john@mycompany.net but email addresses like john@mycompany.com, include both in the field -- i.e., "mycompany.net, mycompany.com".
3. Make sure the user's Active Directory account is properly set. It should entries in the following fields: First Name, Last Name, Display Name, User logon name, email address. Note that it's possible for an AD account to only have an entry in "User logon name (pre-Windows 2000)". It should also be specified in the regular "User logon field".

Acronis Cyber Files can connect users to file shares, SharePoint document libraries, and Acronis Sync & Share folders. File shares can be on the local server, a network volume, DFS, or a NAS device accessible to the server over SMB. Network home folders are also supported so that each user can have easy access to their own folder.

Starting with the 7.0.2 release on December 23, 2014, all sources are available through all methods -- web browser, the Acronis Cyber Files mobile apps (iOS, Android, Windows tablets), or the sync client for Windows or Mac. In earlier versions some methods could connect to some sources, but now it's truly any data anywhere.

Acronis Cyber Files can connect to document libraries on SharePoint 2007, 2010, and 2013 servers, and Microsoft 365 SharePoint sites.

Through the Access mobile apps, files can be opened, viewed, annotated (PDFs), edited (Office docs), and synced, just like regular file shares.

The capabilities are the same except that when a file is selected, the action pop-up menu will also contain Check Out, Check In, and Discard Checkout items to make use of SharePoint's checkout capabilities.

Web access to SharePoint is also supported, though Check In / Out is not yet supported via web.

Acronis Cyber Files does not handle non-document SharePoint objects, such as calendars and task.

Yes. When configuring a Data Source you can specify a UNC path to a DFS name space the same as you would a regular file share.

For Windows shares and SharePoint, Acronis Cyber Files always respects Active Directory / NTFS permissions, so no one will ever get access to a file they shouldn't.

By default Sync & Share folders are only accessible to the user who created them. Depending on the admin settings, an owner may be able to share a folder with others internally or externally. Sharing can be done to individuals or to Active Directory groups (distribution lists or security groups).

It depends. For file shares and SharePoint, the files are stored in their normal location. In this scenario, Access is brokering files with no additional storage involved.

With Acronis Sync & Share folders, files are stored in the location configured in Acronis Cyber Files (Acronis Configuration Utility --> File Repository tab --> File Store path). The File Store path can be on the same server, network storage, or even Amazon S3 storage.

In the Acronis Cyber Files web admin:

• Browse to Mobile Access --> Data Sources
• Click the New Folder button.
• Specify the type of data source
• Enter the path to a file share or URL for a SharePoint site.

Note that while the setting is under the Mobile Access section, these shares can now be made available to users through web browsers and the Windows/Mac sync client. To do so, you'll need to enable the appropriate checkboxes under Mobile Access --> Policies --> [Select appropriate policy] --> Server tab.

You can present folders in the iOS/Android/Windows mobile app through either or both of the following methods:

1. On the left navigation area of the app. This can make it easy to access a folder at the top level of navigation. You could have a folder presented to all users, or selectively -- e.g., users in the Marketing group see the Marketing folder, while users in the Legal group see a Contracts folder.
2. When browsing a server in the app. With this option the users see an entry for the Access server and then some or all folders under it.

With either method, users will only be allowed to see the contents of the folder if they have appropriate domain / NTFS permissions.

See additional questions for configuration information.

Usually it's because the option isn't enabled for the policy.

To enable it:

1. In the Acronis Cyber Files web admin, browse to Mobile Access --> Policies. (Note even though policies primarily relate to the mobile app, the setting for web access is there too.)
2. Select the policy you want to change
3. On the Server Policy tab, check the box "Allow File Server, NAS, and SharePoint Access from the Web Client"
4. Consider whether you want to also enable desktop syncing using the sub-options "Allow File Server, NAS and SharePoint Folders to be Synced to the Desktop Client" and "Allow Two-Way Syncing of File Server, NAS and SharePoint Folders to the Desktop Client"
5. Click Save.
6. Keep in mind that this is implemented as a per-policy setting to provide more flexibility. So you may want to enable the setting for other group or individual policies.

Follow these steps:

1. In the Acronis Cyber Files web admin, browse to Mobile Access --> Data Sources.
2. Find the folder you want and click the pencil icon at the right. Or click Add New Folder.
3. On the Edit Folder or Add New Folder page, search for an Active Directory account or group in the section "Assign This Folder to a User or Group". For initial configuration, it's often easiest to test by searching for your own account to eliminate any questions about group membership.
4. Select the intended user or group. Note even if the search returns only a single result, you need to click on it to assign it.
5. Click Save.

To Test: Re-launch the Acronis Cyber Files app on your mobile device and confirm that the folder appears.

For each Access server:

1. In the Acronis Cyber Files web admin, browse to Mobile Access --> Gateway Servers Visible on Clients (it's a tab onthe top).
2. Click the pencil icon to the right of the server.
3. Search for an Active Directory account or group in the section "Assign This Server to a User or Group". To make it visible to everyone, search for the Domain Users group.
4. Select the intended user or group. Note even if the search returns only a single result, you need to click on it to assign it.

NOTE: If the Display Name of the server is not what you want visible on the mobile device, see the steps in "How can I change the display name of my gateway server?"

For each top-level folder/share:

1. In the Acronis Cyber Files web admin, browse to Mobile Access --> Data Sources --> Folders.
2. Find the folder you want and click the pencil icon at the right. Or click Add New Folder.
3. Check the box Show When Browsing Server.
4. Click Save.

To Test: Re-launch the Access app on your mobile device and look for the server and then the folder.

Acronis Cyber Files always respects domain/NTFS permissions, so your users may see a list of sub-folders they don't have permissions to browse into if that's the way the permissions are set. To hide those folders and only show the ones that are accessible, follow the steps below. Note that you can also filter the folders to a user's AD username by specifying %USERNAME% in the path.

1. In the Acronis Cyber Files web admin, browse to Mobile Access --> Gateway Servers.
2. Click Edit from the drop-down arrow to the right of the server.
3. Go to the Advanced tab.
4. Check the box "Hide inaccessible items" to hide inaccessible local folders.
5. Check the box "Hide inaccessible items on reshares" if you want to hide folders on shares from other servers or NAS devices. Note that it can have a negative impact on performance when browsing folders.
6. Click OK.

An Acronis Cyber Files SharePoint data source can point to an entire SharePoint server, a specific SharePoint site or subsite, or a specific document library.

The instructions for adding a SharePoint Data Source are at http://www.acronis.com/en-us/support/documentation/AAS6.0/index.html#267.... The key thing for connecting to a SharePoint site is using the right URL.

Here are some tips:

1.  Keep in mind that Acronis Cyber Files provides access to documents, not calendars, tasks or other types of SharePoint objects. So the URL should be to a location that contains documents.
2.  In a browser, go to a SharePoint document location. It may be under a Document Library section.
3. Copy the URL from the browser and paste it into the URL on the Add New Folder page in Acronis Cyber Files --> Mobile Access --> Data Sources
4. Cut any file names off the end of the URL. Often it will end in something like default.aspx. Take that out.
5. Determine the real path of the site. The URL may be something like
   https://sharepoint.company.com/mysite/mysubsite/Shared%20%Documents. In that case the URL you want is
   https://sharepoint.company.com/mysite/mysubsite. The rest may be a document library name. So in this case put Shared Documents in the Document Library field (with spaces as needed, rather than the %20 substitution).

Tip: One way to find out the “real” URL without all of the extra “aspx” type elements is to browse to the SharePoint library, right click a file, and copy its URL.

The display name of your Gateway Server may be visible to mobile users. You can change it as follows:

1. In Acronis Cyber Files web admin, navigate to Mobile Access --> Gateway Servers
2. Click the drop down menu to the right of the server entry and select Edit.
3. Set the desired name in the Display Name field and click OK.

Acronis Cyber Files allows two fundamental types of sync folders. Here's how they relate:

• File Shares / SharePoint: Users can sync files from file shares and SharePoint through the Acronis Cyber Files mobile app for iOS/Android or sync client for Windows/Mac.
• Sync & Share Folders: These are individual (potentially shareable) folders through which users can sync files and folders to the server and other devices. They're similar to the consumer-oriented services like Dropbox and Box.net, except that the files are synchronized only to the Access server you control in your corporate environment. These files can be synchronized through the Access mobile app, or the Access sync client for Windows or Mac. They can also be accessed through standard web browsers on Windows, Mac or Linux.

By default, documents are accessed while the mobile app is connected to the server, but if you want, folders can be synchronized to the device. There are basically two approaches for that -- an administrator can set certain top-level folders (set through Mobile Access --> Data Sources) to be 1-way or 2-way sync folders. Or a user can navigate to a specific folder and set it as a sync folder (also 1-way or 2-way, though typically a user would want it to be 2-way). There are also policy options available to control syncing -- you can prohibit users from creating their own sync folders or restrict syncing over cellular data connections..

Through a web browser, a user will see all folders that are available to them through Acronis Cyber Files -- file shares, SharePoint, and Sync & Share. They can place checkboxes next to the folders they want to sync. Their Windows or Mac sync clients will then synchronize those folders to their computer.

For file shares and SharePoint, they can start syncing at any level. For example, if a user has access to the share Boston, they could choose which branches to sync -- Boston\Marketing, Boston\Operations, etc. Or they could pick something more specific like Boston\Marketing\Current and Boston\Marketing\Launch. In each case the subfolders under the specified branch will be synchronized, if the user has NTFS rights to them.

For Sync & Share folders, users can enable syncing for a top level folder they own or one that's been shared out to them by another user. Subfolders will also be synchronized.

The easiest way is by installing the sync client for Windows or Mac. Point it to a local folder and any files dropped in will be synchronized up to the server. Depending on security settings, the folder(s) could be shared out with other users or groups.

You can also upload files through a web browser. Multiple files can be selected and dragged onto the page to upload together. To upload folder hierarchies or files larger than 2GB, use the sync client.

There's no need to sync existing file server shares with Acronis Cyber Files. You can just set up Data Sources in Access that link to the file shares. These can be made available through the mobile apps, browsers, the Windows/Mac sync clients.

There is no limit when syncing through the Access sync client for Windows or Mac. There is also no limit when downloading files through the web interface. The only limit is that when uploading through a browser, there is a limit of 2GB per transfer. To upload a file larger than 2GB, just drop it into a sync folder watched by the sync client.

When configuring the sync client for Windows or Mac, a local folder is specified as the sync folder. It must be a true local folder. It cannot be a network share or mapped drive letter. Syncing of network folders would first be configured by an administrator on the server. Then users can choose which of those they want synchronized down to the local sync folder on their computer.

While logged into the web interface as a licensed user, do the following:

1. Click on the user symbol at the top right
2. Select Download Access Desktop Client.

Note if the option is not available that means that you're logged in with an ad hoc account that's currently unlicensed. This means it's able to use the web interface but not the sync client. To use the sync client, an administrator will need to go to the Sync & Share in the web admin, select the account and click Convert To Licensed.

When a new external user is invited to a folder, an ad hoc account will be created based on the email address. Initially it’s considered a Free External user and does not count toward the licensed user total. There's an option on the Users page to “Convert to Licensed” to add additional functionality (see related questions).

It depends whether they’re licensed. Initially they’re free, unlicensed accounts with some restrictions – they can use the web interface but not the sync client; they can see folders shared with them but cannot create their own root folders; and they use the quota allocation of the person who shared with them. If an unlicensed ad hoc account is converted to licensed (Users page ? Convert To Licensed) they will have full capabilities.

There are several options across the various clients, compared in the matrix below. Sharing can be restricted or disabled through administrative controls. 

In the web admin:

1. Navigate to Mobile Access --> Gateway Servers.
2. To the right of the gateway server, select the drop down arrow and then Access Restrictions.
3. Check the box “Require that client is enrolled with an Acronis Cyber Files server”
4. Click OK

Symptoms:

When trying to connect with the Access mobile app a message is displayed "The specified account does not have a management profile"

Cause:

This usually means one of two things:

1. There are no policies enabled on the server
2. The user is not a member of any Active Directory group that has a policy set.

Resolution:

Make sure the user is covered by a policy, as follows:

1. In the web admin, navigate to Mobile Access --> Policies --> Group Policies
2. Check the Enabled box next to the Default policy, or add a new policy for an Active Directory group of which the user is a member.

You can also set up a policy specific to the user through Mobile Access --> Policies --> User Policies. This is sometimes a good way to test to eliminate any confusion about which AD groups the user is a member of. Keep in mind that user policies take precedence over group policies, so you may want to disable or delete the user policy later so a group policy applies to the user.

For file shares, you can search the current folder or the current volume.

Yes for folders that are local on the Gateway Server, as long as the Windows Search Service is configured. Content search is not yet supported for network reshare volumes.

With Sync & Share folders, the iOS app can do a local file name search of the current folder. It does not currently support searching across folders or by content for Sync & Share folders. 

How does it work for reshare folders? - You can search the current folder by name

All connections between the Acronis Cyber Files server and clients (mobile, desktop, browser) are done over secure HTTPS.

For external access there are four main approaches:

• Port 443 HTTPS: Acronis Cyber Files uses HTTPS for encrypted transport, so it fits in naturally with common firewall rules allowing HTTPS traffic on port 443. If you allow port 443 traffic to your Acronis Cyber Files server, authorized mobile clients can connect while inside or outside of the firewall. No other ports need to be opened for mobile access. (You can change to a different port if needed, though it's usually best to stick with the 443 standard.)
• VPN: Acronis Cyber Files supports access through a VPN connection. The built-in iOS VPN client and third-party VPN clients are supported. iOS management profiles can optionally be applied to devices using Mobile Device Management (MDM) systems or the Apple iPhone Configuration Utility to configure the certificate-based iOS “VPN-on-demand” feature, giving seamless access to Acronis Cyber Files servers and other corporate resources.
• Reverse proxy server: If you have a reverse proxy server such as Microsoft Forefront Threat Management Gateway, mobile devices can connect without the need for an open firewall port or a VPN connection. The Acronis Cyber Files client app supports reverse proxy pass-through authentication, username / password authentication, and certificate authentication.
• MDM Tunnel: Acronis Cyber Files supports integration with the secure app tunnels offered by the MobileIron and Good Technology MDM solutions:
  • Good Dynamics enabled Acronis Cyber Files client app: The client app includes the ability to be enrolled in and managed by the Good Dynamics platform. In this configuration, all network communication between Acronis Cyber Files clients and Gateway Servers is routed through the Good Dynamics secure communication channel and Good Proxy Server. For more details, see the Acronis Cyber Files for Good Dynamics manual page  http://www.acronis.com/en-us/support/documentation/AAS6.0/index.html#259...
  • MobileIron: If the Acronis Cyber Files client application is enrolled with MobileIron's AppConnect platform, then all network communication can be routed through the MobileIron Sentry. For more information see http://www.acronis.com/en-us/support/documentation/AAS6.0/index.html#052.... Note that in the MobileIron configuration you will need to specify a DNS entry for the Access Server. Connections from the MobileIron Sentry to Acronis Cyber Files will not work if specified by IP address.

The short answer is one, for trial purposes and for production use of Acronis Cyber Files. For high-volume production use with Acronis Cyber Files you may want two.

Acronis Cyber Files has two Windows services that users connect to directly. Since only one service can listen on a given IP address / port combination, the services will either need to use separate IP addresses or different ports on the same address.

The services are:

• Acronis Cyber Files Tomcat. This is the core service that hosts the web site for administration and user access. It's also the service that the Windows and Mac sync clients connect to. It’s configured through the Gateway Server tab of the Acronis Cyber Files Configuration Utility. By default, it's on port 3000, though an ideal configuration is to have it use 443 on a secondary IP address.
• Acronis Cyber Files Gateway. This is the service that mobile devices connect to using the Acronis Cyber Files app for iOS or Android. Any port can be used, but 443 is recommended. It’s configured through the Access Server tab of the Acronis Cyber Files Configuration Utility. By default, it's on port 443

Starting with 7.0, there's an option to run all connections through the Gateway service, which will pass requests to the Tomcat service as needed (in the Acronis Configuration Utility check the option "Proxy requests for Access Server"). This is recommended for trial purposes. For high-volume production use, performance can be improved by allowing direct connections to each service.

Adding a second IP address is easy through the Windows TCP/IP control panel. It's not necessary to have a second NIC.

If using multiple IP addresses, use the Acronis Cyber Files Configuration Utility to set the user services to the appropriate addresses. For example, you might have the Acronis Gateway service using 10.1.1.105 on port 443, and the Acronis Cyber Files service using 10.1.1.106 on port 443.

First, start by trying the Gateway server option "Proxy requests for Access Server". That's an easy way to start out and may be fine until concurrent load on the server is high enough to require scalability considerations.

If you do want to keep the services independent, but can only allocate a single IP address you’ll need to decide which one is more important to have on the default port 443. Keep in mind that mobile users will just enter the address once to configure the app on their device (and they can even do that by just clicking an enrollment link). On the other hand, users browsing to the web site may be typing the address in their browser. If the Tomcat service is on a port other than 443, they’ll need to append it (e.g. https://access.mycompany.com:3000). So you may want to put the Tomcat service on 443 and the Gateway service on 3000 or another port.

If you’re only using the mobile portion, then the priority will be the Acronis Cyber Files Gateway service. The Acronis Cyber Files Tomcat service would then only be used by administrators, so having it on a non-standard port wouldn’t matter much.

It depends. The Acronis Cyber Files Gateway service that mobile devices connect to currently handles only HTTPS connections. The Acronis Cyber Files Tomcat service that browsers and the desktop sync client connect can be configured to allow HTTP connections. This requires changing the Tomcat configuration by hand and also setting REQUIRE_SSL=false in the acronisaccess.cfg file. Once those changes are made, the SSL certificate could be installed on the firewall, which could then decrypt HTTPS connections and send just HTTP on the internal network.

Acronis Cyber Files Configuration Utility

Gateway Server tab should have the internal IP address that mobile devices connect to

Access Server table should have the internal IP address used for the web site and Window/Mac sync client

Web Admin --> Mobile Access --> Settings

Mobile Client Enrollment Address should be the public DNS entry or IP address that maps to the Gateway Server. If a port other than 443 is used, append it. For example, mobile.mycompany.com:1234. Do not add https:// before the setting.

Web Admin --> Mobile Access --> Gateway Servers

Click the drop down arrow to the right of your Gateway Server and select Edit.

The Address for administration should match the IP address and port you set for the Gateway Server in the Acronis Configuration Utility. Unless you changed it, it should just be the local IP address on port 443 (in which case you don't need to append the port). Don't confuse it with the address/port set for the Access Server. It's only used by the server itself.

The Address for client connections should be a DNS entry that will resolve properly for devices that are connecting from inside or outside the firewall. Internally it should resolve the IP address specified on the Acronis Configuration Utility on the Gateway Server tab. Externally, it should resolve to the public IP address that the firewall maps to the internal IP address. This is the address that mobile devices will use to get files.

Web Admin --> General Settings --> Server

The "Web Address" should be the DNS entry (or IP address) for the web site. Include the prefix https:// and append the port if it's not on 443. For example, https://access.mycompany.com:3000. This is also the address that will be used in the Windows/Mac sync client (if you're using that). This setting will be used in email invitations to shared files and folders. If using the Gateway option "Proxy requests for Access Server" then set it to the same address used for the Gateway service.

First, consider whether the Access server needs a public IP address. If you’re making it available through an open port in the firewall it will need at least one. If you’re just making it available through the VPN or an MDM tunnel, internal IP addresses are fine.

For a public facing server with both services in use, this would be an example of an ideal configuration with two public IP addresses:

Internal IP 1: Acronis Cyber Files Gateway service on port 443 (e.g., 10.0.1.105:443)
Internal IP 2: Acronis Cyber Files Tomcat service on port 443 (e.g., 10.0.1.106:443)
Public IP 1: NAT/Forward to Internal IP 1 (e.g., 69.20.59.105 maps to 10.0.1.105:443)
Public IP 2: NAT/Forward to Internal IP 2 (e.g., 69.20.59.106 maps to 10.0.1.106.443)
DNS 1: Resolve externally to Public IP 1, and resolve internally to Internal IP 1 (e.g., mobile.mycompany.com resolves to 69.20.59.105 or 10.0.1.105)
DNS 2: Resolve externally to Public IP 2, and resolve internally to Internal IP 2 (e.g., access.mycompany.com resolves to 69.20.59.106 or 10.0.1.106).

If you can only allocate a single public IP address, the configuration would be like this:

Internal IP: Acronis Cyber Files Gateway service on port 443; Acronis Cyber Files Tomcat service on port 3000
Public IP: NAT/Forward to Internal IP. Specified port should map to destination address. (e.g., 69.20.59.105:443 goes to 443 on the internal address while 69.20.59.105:3000 goes to port 3000 on the internal address)
DNS: Resolve externally to Public IP, and resolve internally to Internal IP  (e.g., mobile.mycompany.com resolves to 69.20.59.105 or 10.0.1.105)

It depends. The mobile devices must be able to contact the server using the "Address for client connections" specified on the Gateway Server. If an internal IP address is used, that won't work from outside the firewall unless a VPN connection is used. If a public IP address is used, you'll need to ensure that devices trying to connect from inside the firewall are routed through it properly (networks are often set up with the expectation that devices inside the firewall will access corporate servers using their private IP addresses).

An advantage of using a DNS entry is that it can be set to resolve properly inside and outside the firewall. Also, if the connection is run through a MobileIron App Tunnel, there must be a matching DNS entry in the MobileIron configuration and in the "Address for client connections" setting; MobileIron will no work with an IP address.

First is there already a Gateway Server shown at Mobile Access --> Gateway Servers? There should be one there by default named Local, and that's probably all you need at this point. Mostly what you'll want to do is add folders on the Data Sources page pointing to your target file servers.

The administration key is used to add or re-add a Gateway Server. To get the administration key you would browse to that same IP address from the server itself or an Remote Desktop session to it, like https://10.0.1.30:443. If you do that from the server it will show you the administration key to copy and paste. Note if you browse to the gateway from another server you'll get a message saying "You have browsed to an Acronis Cyber Files Gateway Server's HTTPS port.  This connection is only used for communication with the mobile client." The admin key is meant as a security measure to establish that you have admin access to the server.

Tip: If the server is in a state where you cannot currently browse to get the key, you can find it in the file C:\Program Files (x86)\Acronis\Access\Gateway Server\database\mobilEcho.sqlite3. Open the file in Note Pad and search for the term administration_key. They key will be the 12 letters and numbers right after that (e.g., administration_keyXR34-6NJM-ZF2A)

The Gateway Server entries in the Acronis Cyber Files Web admin tell the system which Gateway Servers the mobile apps will communicate with to retrieve files. Normally there's a default entry and that should be all you need for a trial (more can be added for scaling purposes later if needed). If that's not present due to an earlier problem or configuration change, you can add it as follows.

1. Navigate to Mobile Access --> Gateway Servers

2. Click the button Add Gateway Server.

3. Pick a Display Name. This may be visible to users in the mobile app, depending on other settings.

4. For Address for Administration set the local IP address of the server. Do not use the public IP address or DNS name. Note that you must append the port number if not using the default port of 443. You can check through the Acronis Configuration Utility that's installed on the Windows server. If the Gateway Server tab of the utility shows a port other than 443, append it to the Address for Administration (e.g., 172.16.2.15:444).

5. Select "Use alternate address for client connections".

6. In Address for Client Connections, set the DNS name for the server, if you have one (e.g., mobile.mycompany.com). If you don't have one yet, you can start with the private IP address of the server. If you appended a port number in step 4, then do the same here (e.g., mobile.mycompany.com:444).                                                                 

7. Get the Administration Key using a browser running on the server itself. You may be able to browse to https://localhost/gateway_admin to see it. If the Gateway Service is not using port 443, then append it (https://localhost:444/gateway_admin). If that doesn't work, use the private IP address of the server, appending the port if it's not 443. Remember to browse using https:// not http. For security reasons, the Administration Key will only be displayed if browsing from the local server.

8. Enter the Administration Key.

Symptoms:

The Access iOS or Android app displays an error such as:

• "Failed to connect to server - the specified server may not be running Acronis Cyber Files"
• "The share is unavailable"
• "Error enumerating folder from server: The request timed out."

Cause: 

This is often a sign that the Gateway server's "Address for client connections" is set incorrectly. 

The errors "Failed to connect to server - the specified server may not be running Acronis Cyber Files" and "The share is unavailable" often indicate that "Address for client connections" is set to IP address or port used for the Acronis Cyber Files Tomcat web service instead of the Acronis Cyber Files Gateway Service that mobile devices connect to.

The error "Error enumerating folder from server: The request timed out." often means that "Address for client connections" is set to an IP address or DNS entry that is not reachable from the network where the mobile app is connected. If the devices is connected from outside the network (including over cellular while in the office), it could be a sign that the firewall is not open, the public DNS entry is not established, or that an internal IP address was specified.

Resolution:

Check and correct the "Address for client connections" in the Gateway Server settings of the web admin. For details, see the question "Which IP addresses and DNS entries go where?"

Cause:

This error will occur when you click a passkey link that's pointing to the Acronis Cyber Files Gateway service, which is intended for mobile devices. The link should be pointing to the Acronis Cyber Files Tomcat service, which is used for syncing and web access. By default that service runs on port 3000.

Resolution:

1. Determine the Acronis Cyber Files web URL. This is the address you use when you administer the server or access files from a browser. By default, the web service runs on port 3000, so it may be something like https://sync.mycompany.com:3000. If you don't have a DNS entry set up yet, you can us the IP address.
2. From the admin web site, navigate to General Settings --> Server --> Web Address. Set it to the correct address from step 1. If the web site is running on a port other than 443, make sure the port is appended. For example, if your server address is sync.mycompany.com and you have the web site / sync service running on the default port 3000, you would set Web Address to https://sync.mycompany.com:3000 so that the emails have the right URL.
3. Send another email invitation and confirm that the passkey works.

Note: For production, the ideal configuration would be to have two IP addresses on the server, so the mobile and web services can each use port 443 on a different address. Then no port number will need to be appended. You can change the addresses and ports through the AcronisAccessConfiguration.exe utility, which is installed by default in C:\Program Files (x86)\Acronis\Access\Configuration Utility. Of course, if you update the address or port there, make sure to update the Web Address setting above, along with other relevant settings in the web admin.

Do the following:

1. In the Acronis Cyber Files mobile app, navigate to the folder
2. Selection the action menu and then select "Copy Photos & Videos"
3. Click the photos you want and then Save
4. After a few seconds they will be added to the current folder.

For a standard installation, a virtual or physical Windows server is needed meeting the requirements below. See the Scalability section for large scale deployment options.

• Operating System:

  Recommended: Windows Server 2008 R2, 2012, or 2012 R2.
  Also supported: 2008 R1. 64-bit version strongly recommended for improved performance.

• CPU: At least 4 processor cores. More cores may be beneficial for heavy load with hundreds or thousands of users.
• RAM: At least 8GB for production. Can be run with 4GB for trial environments.
• Disk Space - Installation: 1GB required for the installer to run. Initial installation takes about 300MB.
• Disk Space - Usage: Sufficient disk space will be needed for the files that are synchronized into sync repository. The repository can be located on the same server, network storage, or Amazon S3. 50GB or more is generally recommended. If only used for mobile access to existing shares or SharePoint, no additional disk space is needed since the server is providing access to existing files.
• IP Address(es): At least one static IP address. One is fine for trial purposes and some production load if using the Gateway option "Proxy requests for Access Server". If being used for mobile and desktop access in a high-volume production environment, two addresses are recommended so that each service can run on port 443. If only a single address is used, the services will need to be set to different port numbers. The second IP address can be added through the Windows TCP/IP control panel -- a second NIC is not required.
• DNS names matching the above IP address(es) strongly recommended for production usage.
• Network access to a Microsoft Active Directory domain controller for LDAP lookups.
• Network access to an SMTP server for sending email notifications.

The Acronis software itself does not need much storage. Initial installation requires under 300MB. More space will be required as user activity generates more log entries, but total size is likely to stay under 1GB for a long time. Some logs are generated as text files by the Tomcat and gateway services. These logs are not that verbose by default and rarely cause disk space issues but if that is still a concern there's an option to automatically export and purge logs from the SQL database after x number of days/weeks/months (Audit Log --> Settings in the web admin, starting with version 6.1).

There are two main categories of user data stored by Acronis Cyber Files:

1. Files passed through to existing file storage locations such as network shares and SharePoint. Acronis Cyber Files does not change storage requirements related to these types of files since it's just another way to access files that are already stored.
2. Files synchronized into the Acronis encrypted repository. With the sync and share functionality, users will typically be synchronizing in additional files from their local computer, so this will represent new utilization of network storage, though if it's used to replace another form of backup the net change may balance out. Another consideration with synchronized files is that Acronis Cyber Files can maintain copies of prior revisions and deleted files. Depending on the configuration settings and usage the additional copied. There are administration settings to control how many old or deleted copies are kept. The repository can be located on the same server, network storage, or Amazon S3. 50GB or more is generally recommended, and terabytes can easily be appropriate for larger deployments.

Windows XP, Windows Vista, Windows 7, Windows 8, Windows 8.1, or Windows 10

Mac OS X 10.6.8 and higher (64-bit), including OS X 10.9 Mavericks, OS X 10.10 Yosemite, and OS X 10.11 El Capitan.

Supported OS's:

• iPads and iPhones running iOS 7 or later, including iOS 9.x.
• Android 2.2 or later (The standard ARM procerssor architecture is supported. There are a few Android tablets that use the x86 processor architecture, which is not supported)
• Windows 8.1 or later tablets and phones. Windows RT is not supported. The Access app for Windows tablets can also run as a Windows Universal (aka "Metro") app on Windows 8.1 and Windows 10, providing an option for a secure document container on laptops.

Firefox

Google Chrome

Internet Explorer 8 or later (For server administration, IE 9 is the minimum)

Microsoft Edge

Safari 5.1.10 or later

The installer will set up an Apache Tomcat web server. IIS is not required, though it can operate in parallel as long as the sites are set to use different IP addresses or ports.

The server installer will set up a PostgreSQL database, which will contain most of the settings and logging. The main exception is that the Gateway Server settings and data sources will be stored in an embedded SQLite database file (there is no server process that runs for the SQLite database).

The Acronis Cyber Files installer will set up three Windows services that handle most of the functions of the solution:

1. Acronis Cyber Files Tomcat. This is the core service that hosts the web site for administration and user access. It's also the service that the Windows and Mac sync clients connect to. It’s configured through the Gateway Server tab of the Acronis Cyber Files Configuration Utility. By default, it's on port 3000, though an ideal configuration is to have it use 443 on a secondary IP address.
2. Acronis Cyber Files Gateway. This is the service that mobile devices connect to using the Acronis Cyber Files app for iOS or Android. Any port can be used, but 443 is recommended. It’s configured through the Access Server tab of the Acronis Cyber Files Configuration Utility. By default, it's on port 443. As of Access 7.0, the Gateway can also proxy connections from web browsers and the Windows/Mac sync clients, passing them to the the Access Tomcat service. This allows use with a single IP address and port.
3. Acronis Cyber Files File Repository. This is a service used internally on the server to store files in the encrypted repository. It will be accessed by the other services. It uses port 5787 by default and there’s usually no need to change that. There is no need to open the port on the server or network firewall since it's just only used within the server itself. You can configure the settings through the File Repository tab of the Acronis Cyber Files Configuration Utility.

We recommend using a cluster of independent servers behind a load balancer with each running one or two of the key components of the Acronis Cyber Files solution — the Tomcat web/sync service, the mobile gateway service, or the PostgreSQL database. The load balancer can distribute traffic to handle load and ensure that connections are directed to a working node if one becomes unavailable. Detailed configuration instructions are available at http://www.acronis.com/en-us/support/documentation/AAS6.0/index.html#289...

We generally recommend sizing this configuration at 5,000 users per node. This is likely to be conservative. After rollout you may find that you can get good performance with 7,500 or more users per node.

The ideal OS would be Windows 2012 or 2012 R2 because it has the best performing SMB2 implementation, which will be important for access to reshared network devices (if needed). 

While Microsoft failover clustering is supported, we strongly recommend the load balanced approach described above, which is easier and provides better options for redundancy and scaling.

For a distributed organization, it may make sense to have users connect through gateway servers that are closer to them or to the targets, rather than through a central global point.

Not as part of a single system. However, when sizing a system for thousands of users, consider whether there is a need to have them all use a single repository. If there is natural separation between them (e.g., by region, domain, function), it may make sense to have each group connect to a separate server. This will generally be transparent to users when working with their own files, or files on network shares or SharePoint. If there is a limited need to share Sync & Share folders across groups, it may be possible to treat users in other grouse as ad hoc accounts, though there are some considerations involved depending on the domain names used for email addresses.

There are a few approaches.

1. Single Server

The simplest configuration would be one server with some of the Data Sources set up as UNC paths to the shares in other locations. If you're already using DFS shares to replicate those between offices, you point Access to the DFS name space so it could pull files from the closest storage.

The mobile devices will connect through the one server, and on the back end it will connect to the target file shares to retrieve files and send then back out over the Access HTTPS port.

This would work well when the servers and users are in a certain region or have solid connections between the sites.

Of course, it can be less efficient in more distributed topologies. For example, if a user in London connects to a Gateway Server in New York to access files residing on a server in Paris, there will be two transatlantic hops for each request (four considering round trips). So this is a case where you may want to consider a multi-server architecture that supports more direct regional access. 

2. Single Management Server with Multiple Gateway Servers 

You can have one Access server handling management and enrollment tied in with multiple Gateway Servers. For example, a server in New York can be linked to Gateway Servers in New York and Paris. Then if an iPad user in London needs a file that resides on a file share in Paris, the transfer can go directly between London and Paris without being routed through New York. This assumes that the Gateway Server is reachable directly from London -- e.g., internal WAN, a port is opened in the firewall, VPN connection, reverse proxy, MDM tunnel, etc.

First, let's consider an example where Access is used for the Sync & Share functionality from browsers and the Windows/Mac sync clients, without the mobile side.

It's important to understand that when Sync & Share files are added they're transferred using HTTPS to the Tomcat web service, which then stores them in the File Store location configured on the server, along with meta data stored in the PostgreSQL database.

It's possible to set up a cluster of Tomcat services behind a load balancer. This can be done to handle high load or for redundancy in case one the servers becomes unavailable. It could also be done on a more regional basis so that users in a certain country hit a Tomcat server that's closer to them. Keep in the mind though that on the back end, the Tomcat services will be connecting back to the same PostgreSQL database and File Store location. The architecture does not currently support splitting those up. 

Of course you could set up entirely separate servers. So for example users in London hit a local server that has the web, database and storage local. That will work well so they can sync their own files across devices and share with other people based on that server. The tradeoff would be if they frequently need to share folders with colleagues based on another server. In that case, if a London user wants to invite a New York user to a shared folder, the New York user would end up needing to work with both servers independently.

It depends. Certainly you may want to consider having one master server linked with multiple regional Gateway Servers to optimize the traffic for mobile users accessing file shares.

Or if you're concerned about the performance with all regions connecting back to the same central database and file repository, then you may want to break it up into separate Access servers, each linked to one more local or regional Gateway Servers.

There is no fixed limit to the number of users that can be provisioned on a single server, but our recommendation is to plan to add another server in the cluster for every 5000 -10000 users. A key factor will be concurrent usage, discussed below.

First we need to make a distinction between types of concurrent users:

1. Concurrent connected users: At any given time there may be many users connected to the server through a mobile device, the desktop sync client or an active browser session. A single server can easily handle thousands of current connected users. We have tested with up to 30,000 simulated concurrent connections.

2. Concurrent active users: The more demanding type would be concurrent active users that are uploading or downloading files at a given time. Typically this will only be a small fraction of concurrent connected users. While the load will vary a lot depending on the size of the files and the speed of the network connection, our general guideline is that a single server can support good performance for 100-200 concurrent active users.

Keep in mind that network bandwidth is typically a bottleneck before server capacity. For example if you have one user downloading 100MB of data through a 100 megabit/second Internet connection, it would take 8 seconds at the theoretical maximum speed (of course, real world network speeds are always lower than theoretical maximums). But if you have 200 people simultaneously downloading 100MB each through the same connection, the bandwidth would be shared among the 200 users the calculation would be 8 seconds * 200 = 3200 seconds = 26 minutes.

So if concurrent active usage is high enough that the network becomes the bottleneck, adding additional servers may not be important until the network bandwidth is increased.

In addition to the front-end bandwidth between the clients and the server, you may need to consider the bandwidth between the server and other data sources. If the Access server is connecting mobile users with files that reside on other network shares or SharePoint sites, then the back end bandwidth to the other servers can be a factor, along with the capacity of those servers themselves.

The following are ideal hardware recommendations for a scaled environment running the mobile and desktop sync capabilities of Acronis Cyber Files. If you're only running the mobile side, you will still need a database server but the demands on it will be lower. Keep in mind that load considerations can vary greatly, as discussed in the previous question.

Low-Range: 1 to 1000 total users

• Quantity: One server running all Acronis Cyber Files components should be sufficient load-wise, though you may want have a cluster with additional servers for redundancy.
• OS: Windows: Windows Server 2012, 2012 R2 or 2008 R2 recommended. Windows 2003 SP2 or later and 2008 R1 are also supported but not recommended. 64-bit operating systems should be for best performance (2008 R2 and later are always 64-bit)
• CPU: At least 4 processor cores. More cores may be beneficial for heavy load with hundreds of users.
• RAM: At least 8GB for production. Can be run with 4GB for trial environments.
• Disks: 7200RPM+ SATA or SSD in redundant RAID configuration
• Network: Gigabit network connectivity between servers

Mid-Range: 1000 - 5000 total users

• Quantity — Access / Gateway Server: Two or more behind a load balancer for capacity and redundancy
• Quantity — Database Server: One, ideally with a second for failover
• OS: Windows Server 2008 R2, 2012, or 2012 R2
• CPU: Xeon-class processor with 8 or more cores
• RAM: 16 GB or more
• Disks: 7200RPM+ SATA or SSD in redundant RAID configuration
• Network: Gigabit network connectivity between servers

High End: 5000 or more total users

• Quantity — Access / Gateway Server: Two or more behind a load balancer for capacity and redundancy. For load, add another server for each approximately each 5000 users
• Quantity — Database Server: One, ideally with a second for failover
• OS: Windows Server 2012 R2
• CPU: Xeon-class processor with 8 or more cores. Ideally the database servers would be expandable to 12 or 16 cores in case there's a need to add more later to scale up
• RAM — Access / Gateway Server: 16GB
• RAM — Database Server: 64 GB or more. For best performance under load, it will need enough RAM to hold all of the index data in memory.
• Disk — Database Server: 1 TB SSD in redundant RAID configuration
• Disks — Tomcat / Gateway Server: 7200RPM+ SATA or SSD in redundant RAID configuration
• Network: Very fast network connectivity to the Tomcat servers; e.g., 10 Gbps or teamed NICs

If needed to troubleshoot an installation problem, you can get the server installer log file as follows:

1. From the Windows Start menu or a Run dialog, type %temp%
2. In the Explorer window that opens, find the folder named Acronis Access Installer
3. Right click that folder and select "Send to —> Compressed (zipped) folder"

To get the local sync logs on Windows 7 / 8 /10, do the following:

1. Navigate to the hidden ProgramData folder (not Program Files) by typing the following from the Run dialog: C:\ProgramData\GroupLogic, Inc
2. Zip up the activEcho client folder

To get the local sync logs on a Mac, do the following:

1. In the Finder, click on the Go menu and select Go To Folder
2. In the Go to Folder dialog, type the following: ~/.activEcho
3. Click Go and a hidden folder named .activEcho should open
4. Press Command A to select all the files
5. Select Compress from the File menu

The resulting zip file will contain the logs and local database file that may be useful for troubleshooting problems.

If needed, the preferences file can be found in ~/Library/Preferences called com.grouplogic.activecho.plist

If needed to troubleshoot a problem, the iOS logs related to Acronis Cyber Files can be found as follows:

1. Get the iPhone Configuration Utility for Mac or Windows, which is available from Apple at

   Mac: http://support.apple.com/kb/DL1465
   Windows: http://support.apple.com/kb/dl1466

2. Plug in the device and open iPhone Configuration Utility
3. Select the device under DEVICES in the left-hand column
4. Select the Console tab
5. Press the "Save Console As..." button in the lower right of the window to export the Console log.

Symptoms:

The log indicates an error such as "Warning: Exception occurred retrieving free space from the file system repository at http://127.0.0.1:5787: Connection refused - Connection refused" or "File system repository specified but could not be contacted at..."

Cause:

This indicates that the Tomcat web portion of Acronis Cyber Files is unable to contact the File Repository service on the specified IP address. This only affects the Sync & Share functionality of Acronis Cyber Files. If the server is only used for mobile access, the error will not matter, though you may want to resolve it to avoid having the warning logged each day.

Resolution:

1. Launch the Acronis Configuration Utility, from the installation directory
2. On the File Repository tab, check the specified IP address.
3. On the web admin, go to the File Repository page and set File Store Repository Endpoint to the IP address in step 2 (keep the "http" and ":5787"), rather than 127.0.0.1. The error on that page that will clear as soon as the setting is updated.

Here are some tips to get the right configuration in General Settings --> SMTP so that Access can send email notifications:

• Confirm expected connection type and ports. If server requirements are unclear, test with “Use secure connection” on and off. Usually port 25 is used with unsecured connections. Ports 465 and 587 are more commonly used for secure connections. Try to telnet to the server on the intended port if there’s a question about firewall blocking.
• Try first without authentication. Keep in mind that some servers will require authentication to send to addresses outside the domain.
• If the SMTP server rejects the connection, determine whether the sender server’s IP address needs to be authorized. If there are multiple IP addresses on the server, get them all authorized.
• Confirm you can send to internal recipients first. Then test to see whether the SMTP server is allowing relay to external recipients.
• Test with the From Name matching what’s normally used for the specified From Email Address. Some SMTP servers expect them to match (e.g., can’t use Echo Administrator for john.smith@abcd.com)
• Test the same settings and credentials from a regular email client. It can be useful to test from the server itself if there's a question about the connection getting through or whether the server's address needs to be authorized.
• Test with a different SMTP service, like authsmtp.com.

You can also test by sending through Google’s SMTP service using these settings:

SMTP Server Address: smtp.googlemail.com
SMTP Server Port: 587
Use secure connection? Checked
From Name: Your Name
From Email Address: youraddress@gmail.com
Use SMTP authentication? Checked
SMTP Username: youraddress@gmail.com
SMTP Password: your password