> For the complete documentation index, see [llms.txt](https://help.security.gallagher.com/knowledge-hub/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://help.security.gallagher.com/knowledge-hub/products/cloud-services/command-centre-mobile-client/troubleshoot/mobile-client-unable-to-add-a-mobile-c.md). # Cannot add a Mobile Client during initial setup Diagnose Mobile Client enrollment failures, port access, certificate binding, and logon errors. The mobile device connects over the network on **port 8901 and 8902** (default) to the Command Centre service. * **Cellular:** the external IP must be fixed, or use a domain or VPN. The internet connection needs **port forwarding of both ports** to the Command Centre server. * **WiFi and Cellular:** needs two connections unless using Domains or a VPN. * **Changed ports:** if the default ports are changed, the certificates must be **manually re-bound** to the new ports. See the White Pages on Mobile Client in the install media. ## Diagnosing certificate binding with the FTSupport tool (vEL7.90 and below) Bound correctly: ``` HTTPS Configuration for port 8901: storeName: Gallagher Applications thumbprint: [site-specific certificate thumbprint] HTTPS Configuration for port 8902: storeName: Gallagher Applications thumbprint: [site-specific certificate thumbprint] ``` Not applied: ``` HTTPS configuration on port 8901 not found HTTPS configuration on port 8902 not found ``` "Not found" means the Gallagher certificate has not been applied to the Mobile Connect ports. This is typically because the ports were changed from the default 8901/8902 without manually re-binding the certificate. **Quick fix (only if ports are still at default 8901/8902):** fix the comms problem (usually over-zealous firewall rules), then reinstall Command Centre. This re-binds the certificate to the ports automatically. > **Note:** The FTSupport certificate display only applies to **vEL7.90 and below**. In **v8.00** the Mobile Client web server changed, and you will no longer see thumbprints bound to these ports. See "Changing the Mobile Client Web Service" in the install media for the version in use. ## Using WiFi and Cellular connections to the server **8.50 and below** - different public-facing and WiFi IPs mean you must create **two devices** in Command Centre per physical device and register them independently: * On WiFi you cannot reach the public IP interface; on 3G/4G you can reach the public IP but not the internal range. * Each physical device therefore needs **2 Mobile Device licences** and two server entries, one per connection. * The only workaround is a **Domain** handling all the site's IP traffic. **8.60+** - the **Gallagher API Gateway** lets the Command Centre server make a secure outbound connection to the Gallagher cloud (the same one used for Mobile Credentials), then routes Mobile Client traffic back through it. This **removes** the need for port forwarding and multiple device entries when a device is used on both WiFi and Cellular. ## Unexpected logon result 403 / "403: Forbidden" * Android: 403 error on logon. * iOS: error **-1206** "The server requires a client certificate" - the Windows server is rejecting valid client certificates. Causes and fixes: 1. **Mobile Client Web Services disabled** - ensure it is enabled. If it was disabled then re-enabled, **restart the Command Centre services** (changes only apply after a restart). 2. **TLS issue on the Gallagher server** - use the [IISCrypto utility](https://www.nartac.com/Products/IISCrypto/Download) with the "Best Practices" button; ensure TLS 1.0 to 1.2 are enabled. If TLS 1.2 is disabled, **both TLS and Signed Token fail**. 3. **Windows Update disabled the authentication** - apply the SChannel `ClientAuthTrustMode = 2` key. See [Domain=NSURLErrorDomain Code=1206](/knowledge-hub/products/cloud-services/command-centre-mobile-client/troubleshoot/mobile-client-domain-nsurlerrordomain.md). ## Unable to log in with the "System" account The error "This account is not allowed to log on to a mobile device" means you are using the **System** account. Create a normal user account and log in with that. You **cannot** log into Mobile Connect with the System account. *** 🔗 **Related** * [Connection Options - Signed Token vs TLS Client Certificate](/knowledge-hub/products/cloud-services/command-centre-mobile-client/configure/mobile-client-connection-options-signe.md). Choosing a connection method. * [Domain=NSURLErrorDomain Code=1206](/knowledge-hub/products/cloud-services/command-centre-mobile-client/troubleshoot/mobile-client-domain-nsurlerrordomain.md). The SChannel registry fix after a Windows Update. * [Testing the connection without a mobile device](/knowledge-hub/products/cloud-services/command-centre-mobile-client/troubleshoot/mobile-client-testing-the-connection-w.md). Confirming whether the fault is networking. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://help.security.gallagher.com/knowledge-hub/products/cloud-services/command-centre-mobile-client/troubleshoot/mobile-client-unable-to-add-a-mobile-c.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.