Skip to main contentSkip to search
Powered by Zoomin Software. For more details please contactZoomin
Jamf Learning HubJamf Learning Hub
Learning Hub
Jamf Learning Hub
  • Home
  • Publications
  • EnglishDeutschEspañolFrançais日本語Nederlands繁體中文
  • Login

Jamf Connect Documentation

Endpoint Agent Traffic for Zero Trust Network Access

Save PDF
Save selected topicSave selected topic and subtopicsSave all topics
Share
Share to emailCopy topic URL
Expand All
Print
Contents
  • Jamf Connect Documentation
  • Jamf Connect
    • Capabilities Reference
    • System Requirements
    • Security Standards
  • Getting Started
    • Licensing Jamf Connect
    • Identity Provider Integrations
      • Microsoft Entra ID
        • Creating a Jamf Connect App Registration in Microsoft Entra ID
        • Configuring App Roles in Microsoft Entra ID
        • Cloud Password Validation in Entra ID for Jamf Connect
        • Jamf Connect and Microsoft Entra ID Conditional Access
          • Exempting Jamf Connect from Login Restrictions without MFA
          • Making Jamf Connect Compatible with Microsoft Conditional Access Polices
      • Okta
        • Configuring Okta Identity Engine with Jamf Connect
        • Creating an Okta App Integration with OpenID Connect
        • Configuring Okta Classic Engine with Jamf Connect
        • Creating Applications for Limiting Access to Devices
      • Google
      • IBM
      • OneLogin
      • PingFederate
      • RapidIdentity - Identity Automation
      • Custom Identity Providers
    • Configuration Methods
      • Jamf Connect Configuration
      • Creating Jamf Connect Configuration Profiles Using Jamf Pro
        • Configuring Enrollment-only Jamf Connect Settings
      • authchanger
    • Custom Branding
    • Authentication Protocols Used in Jamf Connect
      • OpenID Connect
      • Okta Authentication Methods
      • Passthrough Authentication with Jamf Connect
      • Network and Local Authentication Restrictions
      • Multifactor Authentication
      • Federated Integrations
      • Authentication Settings
  • macOS Account Management
    • macOS Account Management Requirements
    • Activating macOS Account Management Capabilities in Self Service+
    • macOS Account Management End User Experience
    • Password Syncing
      • Kerberos Integration
      • Keychain Item Syncing
    • Privilege Elevation
      • Configuring macOS Privilege Elevation using Self Service+
      • Auditing Privilege Elevation with Logs
      • Elevate macOS Privileges for Users via Jamf Pro Policy
    • Custom Menu Bar Actions
    • Pluggable Authentication Module
    • File Shares
    • State Settings and User Status
    • URL Scheme
    • Settings Reference
  • macOS Login Window
    • macOS Login Window Requirements
    • macOS Login Window Deployment Planning
      • Deployment Methods
      • Jamf Connect Integration with Jamf Pro
      • Deploying Jamf Connect via Automated Device Enrollment
      • Deploying Jamf Connect using a Jamf Pro Policy
    • Account Creation
      • Initial Local Password Creation
      • User Roles for Local Accounts
      • Local Account Migration
      • Turning On FileVault with Jamf Connect
      • Custom Short Name
    • Acceptable Use Policy Screen
    • Notify Screen
    • Adding a Login Script
    • Demobilizing and Unbinding Mobile Accounts with Jamf Connect and Jamf Pro
    • End User Experience and Workflows
      • Local Account Creation Experience
      • Subsequent and Routine Logins
      • Existing Local Account Migrations
    • Login Window Settings
    • Troubleshooting
      • Jamf Connect Logs
      • Preferences with the defaults Command-Line Tool
      • Editing the macOS loginwindow Application
      • Testing Network Authentication
      • Changing Identity Providers with Jamf Connect
        • Re-configuring the Jamf Connect Login Window with a new Identity Provider
        • Re-configuring Self Service+ with a new Identity Provider
      • Disabling the Jamf Connect Login Window
      • Microsoft Azure Active Directory Authentication Library Deprecation
        • Disabling Jamf Connect using a Jamf Pro Policy
      • Suppressing Google Consent Prompts in the Jamf Connect Login Window
      • Troubleshooting Deployments with Automated Device Enrollment
      • Verifying Local Account Creation
      • Uninstalling Jamf Connect
      • Re-enabling the Login Window After a Major macOS Upgrade
      • Unmigrating a Local Account
  • Zero Trust Network Access
    • Zero Trust Network Access Requirements
    • Network Architecture
      • Endpoint Agent Traffic
      • Application Access with Zero Trust Network Access
    • Deploying Zero Trust Network Access
      • Creating an Activation Profile for Zero Trust Network Access
      • Distribution Methods for the Jamf Trust App
        • Distributing the Jamf Trust App Using a Shareable Link
      • Optimizing Zero Trust Network Access Deployment for Managed Devices
        • Bootstrapping Jamf Trust App Activation via Managed App Configuration
        • Pre-Authorizing VPN Installation
        • In-App Enterprise Single Sign-On
    • Access Policy
      • Adding a New Predefined Application
      • Adding a New Custom Application
      • App Discovery in Jamf Security Cloud
      • Encrypting Jamf Security Cloud Proxy Traffic
      • Require Endpoint Security Software in Order to Use Zero Trust Network Access
    • Access Reports
    • Per-App VPN
      • Per-Application ZTNA versus Per-App VPN
      • Apple
        • iOS and iPadOS
        • macOS
      • Android
    • Configuring Cloud Access Control
      • Amazon Web Services
      • Google: Restricting Login Access
      • Microsoft 365: Restricting Login Access
      • Microsoft Exchange: Restricting Login Access
      • Okta
      • Bypassing MFA
        • Okta: Bypassing Multifactor Authentication
        • Azure AD: Bypassing Multifactor Authentication
    • Access Gateways
      • Network Gateway Types
      • Shared Internet Gateway IP Addresses for Zero Trust Network Access
      • Creating a Quick Connect IPSec Gateway
      • Creating a Custom IPSec Gateway
        • Creating a Jamf Connect ZTNA IPsec with Google Cloud
      • Creating a Dedicated Internet Gateway
      • Creating a Group of Gateways
      • Connecting to On-Premise Edge Infrastructure
        • Connecting to On-Premise Edge Infrastructure for Cisco IOS
        • Connecting to On-Premise Edge Infrastructure for SonicWall (Sonic OS)
        • Connecting to On-Premise Edge Infrastructure for Palo Alto Networks
        • Connecting to On-Premise Edge Infrastructure for Juniper
      • Connecting to Cloud Infrastructure
        • Connecting to Cloud Infrastructure for Amazon Web Services (AWS)
        • Connecting to Cloud Infrastructure for Azure Cloud
        • Connecting to Cloud Infrastructure for Cloudflare
      • Dead Gateway Detection
    • Zero Trust Network Access (ZTNA) Events Data Stream in Jamf Connect
  • Copyright and Trademarks
Table of Contents

Endpoint Agent Traffic for Zero Trust Network Access

Save PDF
Save selected topicSave selected topic and subtopicsSave all topics
Share
Share to emailCopy topic URL
Expand All
Print
  •  
  • Last UpdatedApr 25, 2024
  • 2 minute read
    • Jamf Connect
    • Technical Documentation

Client Configuration Endpoint

The Jamf Trust app communicates with Jamf Security Cloud via HTTPS for provisioning and onboarding.

This requires outbound TCP/443 traffic to any IP address. Jamf Security Cloud does not provide specific IP addresses for this part of the infrastructure due to the dynamic nature of the micro-service architecture.

Identity Provider (IdP) Authentication

Jamf Connect's' Zero Trust Network Access endpoint communicates directly with the your organization's identity provider (IdP) before the service is activated on the device. This traffic uses HTTPS TCP/443 and must be permitted through your firewalls to Entra ID and any federated identity providers.

This is usually already open to allow logins to cloud apps, and should not require any additional configuration.

VPN/SDP Communication

The Jamf Trust app configures a VPN tunnel between the device and Jamf Security Cloud's infrastructure.

This tunnel is over UDP port 32005 for all devices globally.

All clients use a DNS lookup to automatically discover its nearest and available Jamf SDP POP (Point of Presence) for optimized performance and routing. The DNS address used by default is wpa.wandera.com, which will automatically return an IP address that is appropriate for that device's geographic location and the Jamf Security Cloud SDP infrastructure state.

Infrastructure IP Addresses

The following table lists the IP addresses that are returned by the wpa.wandera.com lookup. For environments where outbound access on UDP/32005 is blocked (from client-to-server), these addresses must be added as permitted exceptions. Only UDP/32005 must be configured as an outbound rule since most firewalls automatically allow the return traffic over the same port in the opposite direction.

For a list of the external IP addresses used by Zero Trust Network Access, see Shared Internet Gateway IP Addresses for Zero Trust Network Access.

IP Addresses By Region

RegionIP Addresses

Americas - US West

(Boardman, Oregon, United States)

  • 44.232.168.72

  • 44.232.62.192

  • 52.40.74.185

Clipboard friendly:

44.232.168.72,44.232.62.192,52.40.74.185

CIDR notation:

44.232.168.72/32,44.232.62.192/32,52.40.74.185/32

Americas - US East

(Ashford, Virginia, United States)

  • 54.81.37.163

  • 52.71.99.101

  • 34.227.37.91

Clipboard friendly:

54.81.37.163,52.71.99.101,34.227.37.91

CIDR notation:

54.81.37.163/32,52.71.99.101/32,34.227.37.91/32

North America - Canada

(Toronto, Canada)

  • 52.60.123.39

  • 99.79.107.210

  • 3.98.239.24

Clipboard friendly:

52.60.123.39,99.79.107.210,3.98.239.24

CIDR notation:

52.60.123.39/32,99.79.107.210/32,3.98.239.24/32

Europe - UK

(London, United Kingdom)

  • 3.9.34.90

  • 3.8.243.87

  • 35.179.83.61

Clipboard friendly:

3.9.34.90,3.8.243.87,35.179.83.61

CIDR notation

3.9.34.90/32,3.8.243.87/32,35.179.83.61/32

Europe - Germany

(Frankfurt, Germany)

  • 52.59.54.116

  • 3.71.217.144

  • 35.156.182.253

Clipboard friendly:

52.59.54.116,3.71.217.144,35.156.182.253

CIDR notation:

52.59.54.116/32,3.71.217.144/32,35.156.182.253/32

Europe - Ireland

(Dublin, Ireland)

  • 34.253.55.163

  • 52.214.227.148

  • 34.250.21.199

Clipboard friendly:

34.253.55.163,52.214.227.148,34.250.21.199

CIDR notation:

34.253.55.163/32,52.214.227.148/32,34.250.21.199/32

Asia Pacific - Australia

(Sydney, Australia)

  • 13.237.185.171

  • 3.106.49.51

  • 3.104.14.94

Clipboard friendly:

13.237.185.171,3.106.49.51,3.104.14.94

CIDR notation:

13.237.185.171/32,3.106.49.51/32,3.104.14.94/32

Asia - Singapore

(Singapore)

  • 18.142.31.113

  • 18.140.106.152

  • 54.151.180.141

Clipboard friendly:

18.142.31.113,18.140.106.152,54.151.180.141

CIDR notation:

18.142.31.113/32,18.140.106.152/32,54.151.180.141/32

Asia - Hong Kong

(Hong Kong)

  • 18.167.1.241

  • 16.162.196.60

  • 18.163.43.36

Clipboard friendly:

18.167.1.241,16.162.196.60,18.163.43.36

CIDR notation:

18.167.1.241/32,16.162.196.60/32,18.163.43.36/32

Asia - Japan

(Tokyo, Japan)

  • 54.199.229.167

  • 35.75.246.199

  • 52.68.210.16

Clipboard friendly:

54.199.229.167,35.75.246.199,52.68.210.16

CIDR notation:

54.199.229.167/32,35.75.246.199/32,52.68.210.16/32

Asia - India

(Mumbai, India)

  • 3.109.103.127

  • 3.7.34.33

  • 13.235.249.165

Clipboard friendly:

3.109.103.127,3.7.34.33,13.235.249.165

CIDR notation:

3.109.103.127/32,3.7.34.33/32,13.235.249.165/32

South America - Brazil

(Sao Paulo, Brazil)

  • 54.232.135.245

  • 18.229.66.35

  • 54.94.89.64

Clipboard friendly:

54.232.135.245,18.229.66.35,54.94.89.64 

CIDR notation:

54.232.135.245/32,18.229.66.35/32,54.94.89.64/32

Africa - South Africa

(Cape Town, South Africa)

  • 13.245.103.224

  • 13.246.100.111

  • 13.246.100.252

Clipboard friendly:

13.245.103.224,13.246.100.111,13.246.100.252

CIDR notation:

13.245.103.224/32,13.246.100.111/32,13.246.100.252/32
All Global IP Addresses

Clipboard friendly:

44.232.168.72,44.232.62.192,52.40.74.185,54.81.37.163,52.71.99.101,34.227.37.91,52.60.123.39,99.79.107.210,3.98.239.24,3.9.34.90,3.8.243.87,35.179.83.61,52.59.54.116,3.71.217.144,35.156.182.253,34.253.55.163,52.214.227.148,34.250.21.199,13.237.185.171,3.106.49.51,3.104.14.94,18.142.31.113,18.140.106.152,54.151.180.141,18.167.1.241,16.162.196.60,18.163.43.36,54.199.229.167,35.75.246.199,52.68.210.16,3.109.103.127,3.7.34.33,13.235.249.165,54.232.135.245,18.229.66.35,54.94.89.64,13.245.103.224,13.246.100.111,13.246.100.252

CIDR notation:

jamf_connect_ztna_endpoint_agent_ip_addresses.txt (Jamf Github)

For an enhanced experience and access to additional features, log in to the Jamf Learning Hub with your Jamf ID.

Login
Jamf's purpose is to simplify work by helping organizations manage and secure an Apple experience that end users love and organizations trust. Jamf is the only company in the world that provides a complete management and security solution for an Apple-first environment that is enterprise secure, consumer simple and protects personal privacy. Learn about Jamf.
Quick Links
  • Jamf Support
  • Training & Certifications
  • Jamf Account
  • Jamf Resources
  • Jamf Integrations
  • Jamf Blog
  • Jamf Nation
  • Marketplace
  • Become a Partner
  • Find a Partner
Solutions
  • The Jamf platform
  • Zero-touch deployment
  • Mobile Device Management (MDM)
  • Application management
  • Inventory management
  • Self Service
  • Identity and access management
  • Endpoint protection
  • Threat prevention and remediation
  • Content filtering and safe internet
  • Zero Trust Network Access (ZTNA)
  • Security visibility and compliance
  • CookiesCopyrightPrivacyTerms of UseTrustModern Slavery Act StatementTwitterLinkedInYouTubeInstagramFacebook
TitleResults for “How to create a CRG?”Also Available inAlertDownload