Installing a Jamf Pro web application in the DMZ allows computers and mobile devices to contact Jamf Pro outside of your internal network. It involves installing a secondary Jamf Pro web application on an external server and pointing the new Jamf Pro web application to the existing database.
This article provides some general guidelines for installing a Jamf Pro web application in the DMZ. It is important to note that each installation in the DMZ is unique to your environment, and additional steps may be necessary.
To secure the Jamf Pro web application in the DMZ, you should implement the recommendations in the Jamf Pro Security Recommendations article.
If you are using smart groups to send email notifications, the SMTP port from the external server to the SMTP server needs to be open. (The standard port for this is 25.)
If users are going to enroll computers or mobile devices externally using LDAP directory accounts, have policies or profiles that are scoped based on AD groups or exclusions, or will need to authenticate to Self Service externally, the LDAPS (LDAP over SSL) or LDAP port from the external server to the directory server needs to be open. The standard ports for these are 636 for LDAPS, and 389 for LDAP. For information on configuring LDAPS, see Configuring Jamf Pro to Use LDAP Over SSL When Authenticating with Active Directory.
If you do not plan to run client policies externally, ensure that all policies are limited only to internal network segments to avoid generating failed policy errors from external attempts to run policies. If you plan to run policies externally, you must have a distribution point accessible to external clients (i.e., in the DMZ or cloud-based). Use an all-encompassing network segment (0-255), and set the external distribution point as your default distribution point.
The type of devices (computers and/or mobile devices) that will be contacting Jamf Pro will determine which Limited Access settings are appropriate and the amount of network traffic to the external Jamf Pro web application. In addition, the type of devices will influence the way in which you should configure the scope of policies that run externally.
An external server running a supported operating system. The Jamf Pro web application on the external server can be installed on a different platform than the Jamf Pro web application on the internal server. For a complete list of supported operating systems, see the Jamf Pro System Requirements page of the Jamf Pro Release Notes.
Access to the internal server that hosts the existing Jamf Pro web application.
A single DNS name that exists on both the internal and external DNS servers and points to the appropriate IP address based on the location of the client checking in. For example, https://jamf.mycompany.com:8443/ points to the IP address of the internal Jamf Pro web application server on the internal DNS and points to the IP address of the external DMZ Jamf Pro web application server on the external DNS.
The organization's firewall must be configured to allow traffic on port 3306 from the external Jamf Pro web application to the internal server hosting the MySQL database. The server hosting the MySQL database may or may not be the same as the internal Jamf Pro web application server, depending on your environment.