BES users able to browse subnet!

[dpmchris]

Good evening, and sorry if this is a stupid question.

We have a test BES and a handful of test users on Curve 8310s. One user can discovered that they can browse the intranet, and after I tested further OTHER servers on the internal network, whether on the DMZ or not!

This is very scary behavior, I am not sure how it would be able to do such a thing. The BES is on a virtual machine on an internal host. Is this known behavior? Is there a place that I am not seeing to turn it off? Any insight would be greatly appreciated!

[slothrop]

Yes, this is the default behaviour of a BES server and of Blackberry devices. Your devices are using the default "Blackberry Browser" which routes web traffic through the BES server. Therefore, your Blackberry devices have the same access as your BES server. In your case that includes your Intranet. If you change the device browser to "Internet Browser", requests will go directly to the web. Depending on how you'd like to control access to the web you can use the BES server to force devices to use one browser or the other. To manually change the browser on a Curve select the browser and click the blackberry button then Options -> Browser Configuration and change the Browser.

[wagazarm]

I discovered the very same thing when trying to find showtimes with my wife from my Blackberry. We use OpenDNS internally and I found it rather amusing that I was being blocked. Changing it to 'Internet Browser' bypasses the problem ... or blessing depending on the usage.

I now have 20 people deployed in the field with Blackberry Curves with the BES hookup and Zimbra. Utilizing the Blackberry Browser, I am able to give them access to our intranet site, and SugarCRM internally without having to set-up anything on the network or poke additional holes in the firewall.

The usage of OpenDNS when tied to the BES, just makes it even nicer to know that those company issued Blackberry's are being used for only precisely what I want them to be used for.