Using a private IP for Jamf Pro Server with translated address for outside access.

[mking529]

Hey everyone, I have a question about Jamf Pro hosted on site.

Currently, we host Jamf Pro on a Windows Hyper-V instance with the public IP address directly on the network adapter of the virtual server. Our Internet Service Provider has informed us that we will no longer be able to have a public IP address on the physical adapter on our equipment without major changes to our network. If we did not want to make these major modifications, we’d need to set a private IP address internally/on the adapter and use a translated address for outside access to Jamf Pro and Web services. I am curious how if we went to this Private IP how it would affect our Jamf installation. I know that I can set a custom Forward Lookup Zone in our Windows server DNS servers to make the domain work internally, but will this have any drawbacks if our Jamf Pro URL is resolving to different IP addresses internally versus externally? Is the Jamf Binary, Apple MDM, and/or macOS DNS smart enough to re-resolve the address as it enters/leaves our network? Thanks for any help you can provide! 

[sdagley · Accepted solution]

@mking529 Having different IP addresses on internal and external networks for the FQDN of your Jamf Pro server is the normal practice for on-prem installations that are publicly accessible. Don't forget you'll need to do the same for your DP (if you're not going to have separate DPs for internal and external access), and since most orgs will not allow a public facing SMB server you'll want to enable HTTPS content delivery for your DP.

[mking529]

Thanks! Yeah, the DP situation is all set as Jamf started requiring https a while back. I had a feeling this was the case, but I wanted to double check before I threw a thousand Macs potentially in the dark management-wise!