Endpoint Agent Traffic for Zero Trust Network Access
- Last UpdatedApr 25, 2024
- 2 minute read
The Jamf Trust app communicates with Jamf Security Cloud via HTTPS for provisioning and onboarding.
This requires outbound TCP/443 traffic to any IP address. Jamf Security Cloud does not provide specific IP addresses for this part of the infrastructure due to the dynamic nature of the micro-service architecture.
Jamf Connect's' Zero Trust Network Access endpoint communicates directly with the your organization's identity provider (IdP) before the service is activated on the device. This traffic uses HTTPS TCP/443 and must be permitted through your firewalls to Entra ID and any federated identity providers.
This is usually already open to allow logins to cloud apps, and should not require any additional configuration.
The Jamf Trust app configures a VPN tunnel between the device and Jamf Security Cloud's infrastructure.
This tunnel is over UDP port 32005 for all devices globally.
All clients use a DNS lookup to automatically discover its nearest and available Jamf SDP POP (Point of Presence) for optimized performance and routing. The DNS address used by default is wpa.wandera.com, which will automatically return an IP address that is appropriate for that device's geographic location and the Jamf Security Cloud SDP infrastructure state.
The following table lists the IP addresses that are returned by the wpa.wandera.com lookup. For environments where outbound access on UDP/32005 is blocked (from client-to-server), these addresses must be added as permitted exceptions. Only UDP/32005 must be configured as an outbound rule since most firewalls automatically allow the return traffic over the same port in the opposite direction.
For a list of the external IP addresses used by Zero Trust Network Access, see Shared Internet Gateway IP Addresses for Zero Trust Network Access.
Region | IP Addresses |
---|---|
Americas - US West (Boardman, Oregon, United States) |
Clipboard friendly:
CIDR notation:
|
Americas - US East (Ashford, Virginia, United States) |
Clipboard friendly:
CIDR notation:
|
North America - Canada (Toronto, Canada) |
Clipboard friendly:
CIDR notation:
|
Europe - UK (London, United Kingdom) |
Clipboard friendly:
CIDR notation
|
Europe - Germany (Frankfurt, Germany) |
Clipboard friendly:
CIDR notation:
|
Europe - Ireland (Dublin, Ireland) |
Clipboard friendly:
CIDR notation:
|
Asia Pacific - Australia (Sydney, Australia) |
Clipboard friendly:
CIDR notation:
|
Asia - Singapore (Singapore) |
Clipboard friendly:
CIDR notation:
|
Asia - Hong Kong (Hong Kong) |
Clipboard friendly:
CIDR notation:
|
Asia - Japan (Tokyo, Japan) |
Clipboard friendly:
CIDR notation:
|
Asia - India (Mumbai, India) |
Clipboard friendly:
CIDR notation:
|
South America - Brazil (Sao Paulo, Brazil) |
Clipboard friendly:
CIDR notation:
|
Africa - South Africa (Cape Town, South Africa) |
Clipboard friendly:
CIDR notation:
|
All Global IP Addresses | Clipboard friendly:
CIDR notation: jamf_connect_ztna_endpoint_agent_ip_addresses.txt (Jamf Github) |