Connectivity settings
The beem app offers several connectivity features that control how and when your device connects to beemNet. This page explains how the ‘Stay connected’ and ‘Untrusted network warning’ features work, and how administrators can configure Fail-mode behaviour in Concerto. These settings are found under ☰ → Connection details.
Stay connected
When running the beem app, you can pause your connection to beemNet if necessary. If the Stay connected option is activated, the beem app automatically re-establishes the connection to beemNet after a time span defined by the beem administrator in Concerto. The reconnection time span is shown as a pop-up notification when Stay connected is active and you disconnect from beemNet.
Untrusted network warning
The Untrusted network warning option serves as an additional security feature when Stay connected is active and a device is disconnected from beemNet. It shows a notification when a connection to an ‘untrusted network’ is established, meaning any network that is not integrated with beemNet and therefore not protected by it. Typical examples include public Wi-Fi hotspots, private home networks, and mobile data connections from SIM cards that are not connected to beemNet.
When the beem app is running in the foreground, a toast message will be displayed on the home screen. If running in the background, the app issues a system notification to the device in use.
WARNING
Due to technical limitations in iOS and iPadOS, the beem app cannot display untrusted network notifications on these operating systems while running in the background.
Fail-mode behaviour
The behaviour of Stay connected depends on the configurations made by the beem administrator. Apart from setting a reconnection time span, administrators can choose between the Fail-open and Fail-close modes:
- Fail-open prioritises availability. When there is no connection to beemNet (whether encrypted or not) or a system malfunction occurs, the beem app allows unprotected internet access.
- Fail-close prioritises security. When there is no encrypted connection to beemNet or a system malfunction occurs, the beem app resorts to a restricted state, blocking all internet access. If an unencrypted beemNet connection is available, the beem app resorts to a limited state, where internet access remains available, but access to corporate resources is restricted.
Configuring Fail-mode in Concerto
beem administrators can configure the Stay connected behaviour in Concerto, including the choice between Fail-open and Fail-close.
Open Concerto, select your beem tenant and navigate to:
Configure → Secure Access → Client-based Access → Policy Rules → select Rule Name → Client Configuration → Client Controls → Advanced settings
| Fail-mode | Fail-close | Fail-open | |
|---|---|---|---|
| Priority | Security first | Availability first | |
| Access type | Restricted state | Limited state | Internet access only |
| Trigger condition | No secure, encrypted connection to beemNet or system malfunction | beemNet connection without encryption or VPN malfunction | No connection to beemNet (encrypted or not) or system malfunction |
| Internet access | Access to all network resources is denied | Internet access is allowed and protected | Unprotected internet access is allowed |
| Access to business applications | Access to all network resources is denied | Limited access to corporate data and resources is allowed | Access to all corporate data and resources is denied |
| Response to public Wi-Fi or untrusted network | Blocked | Allowed | Allowed |
| User experience (default behaviour) | May cause loss of access or service interruption | Connectivity continues with reduced access | Connectivity continues with reduced security |
| Risk exposure | Minimal (no unprotected access granted) | Higher (data may flow over unsecured network) | |
| Use case suitability | Sensitive environments (e.g. enterprise, compliance-driven) | Less sensitive contexts (e.g. casual browsing) | |
INFO
The beem Essential and Standard Security Editions have their connectivity settings fixed: Stay connected is always activated with Fail-open mode. The Plus and Premium Security Editions let administrators configure these features.