Hey everyone,

I'm in the middle of setting up ManageEngine MDM and hitting a roadblock during device enrollment — I keep getting "site can't be reached" errors on the enrolling device.

I've got two strong theories and would really appreciate validation before escalating this internally. Hoping someone here has hit this before.

Theory 1: Corporate Firewall Issue

• Enrollment fails on mobile network but works perfectly on corporate WiFi.

• This makes me think the corporate firewall might be blocking external traffic to the MDM server.

Question:
Is this normal behavior in corporate environments? Do MDM setups commonly get blocked this way?

Theory 2: Android Hotspot Isolation

• Using a Google Pixel phone as a hotspot for a test laptop (laptop runs MDM server).

• Laptop gets internet just fine via the hotspot.

• But the phone can’t connect back to the laptop’s MDM server — no enrollment possible.

Question:
Is this expected? Does Android apply client isolation/NAT that blocks devices from seeing each other?

Bonus: Am I Missing Anything Obvious?

I want to make sure this is a real network limitation and not something misconfigured on my end before going to management.