The JumpCloud Agent also depends on NTP time services for installation and proper function of the agent. If your security policy requires a port number, port 123<\/strong> must be added to an allow list. If you are synchronizing with an internal NTP source, access to external traffic on port 123 may not be necessary.<\/p>\n\n\n\n If your company has an allow list of domains, add the domains listed in JumpCloud Agent Networking and Port Requirements<\/a> to your allow list.<\/p>\n\n\n\n Due to the elastic nature of the JumpCloud infrastructure, we currently do not publish lists of IP addresses for allow lists related to our JumpCloud Agent service at this time. Our servers are load-balanced, as well as regionally dispersed, which can lead to a wide variety of source IPs at any given time.<\/p>\n\n\n\n Our Agent uses mTLS (Mutual Transport Layer Security), which allows it to verify that it is talking to a real JumpCloud server and for JumpCloud to verify that it is talking to a valid enrolled device. Unlike traditional TLS used in the browser, mTLS requires our own private Certificate Authority (CA) to generate a certificate for our Agent to handle provisioning and renewals.<\/p>\n\n\n\n If your firewall is showing warnings about the JumpCloud CA certificate not being signed, or if you want to pin our CA certificates, you can download them using the command below and then upload them to your firewall (our Agent takes care of the device’s certificate independently).<\/p>\n\n\n\n curl https:\/\/kickstart.jumpcloud.com\/GetCACerts > \/tmp\/agent.jumpcloud.chain.pem<\/p>\n<\/div><\/div>\n\n\n\n If your firewall is performing HTTPS inspection for all traffic, you will need to add exceptions for traffic going to:<\/p>\n\n\n\n Without the exceptions, the Agent will flag the different certificates that your firewall generates to be able to decrypt our traffic, and your devices will not be able to connect to JumpCloud.<\/p>\n\n\n\n The JumpCloud LDAP-as-a-Service uses SSL for all communication when utilizing LDAPS, communicating over port 636. If your security policy requires a port number, port 636 <\/strong>must be added to an allow list.<\/p>\n\n\n\n The JumpCloud LDAP-as-a-Service uses StartTLS for supported clients, and otherwise plain-text, for all communications over port 389. If your security policy requires a port number, port 389 <\/strong>must be added to an allow list. <\/p>\n\n\n\n It is suggested that port 389 only be used for clients supporting StartTLS.<\/p>\n <\/div><\/div><\/div><\/div>\n\n\n\n If your company has an allow list of domains, please include the following domains to your allow list:<\/p>\n\n\n\n Due to the elastic nature of the JumpCloud infrastructure, we currently do not publish lists of IP addresses for allow lists related to our JumpCloud LDAP-as-a-Service at this time. Our servers are load-balanced, as well as regionally dispersed, which can lead to a wide variety of source IPs at any given time.<\/p>\n\n\n\n As an alternative option for additional security, you may inspect your firewall security policy for HTTPS inspection. Refer to JumpCloud LDAPS SSL Certificate<\/a> for the Certificate Authority, and your firewall vendor documentation for options and support for HTTPS inspection.<\/p>\n\n\n\n The JumpCloud RADIUS-as-a-Service uses StartTLS for all communication via either EAP-PEAP\/MSCHAPv2 or EAP-TTLS\/PAP for inner and outer authentication. If your security policy requires a port number, the port 1812<\/strong> must be added to an allow list.<\/p>\n\n\n\n If your company has an allow list of domains, include the following domains to your allow list:<\/p>\n\n\n\n Many networking devices will only allow for RADIUS server configuration via IP address, so creating an allow list of domains may not be necessary.<\/p>\n <\/div><\/div><\/div><\/div>\n\n\n\n If your company has an allow list of IP addresses, please include the following IP addresses to your allow list. While the JumpCloud infrastructure is elastic by nature, RADIUS clients generally do not<\/em> support for domain addressing, so IP addresses are provided:<\/p>\n\n\n\n As an alternative option for additional security, you may inspect your firewall security policy for HTTPS inspection. Refer to JumpCloud RADIUS Certificate<\/a> for the Certificate Authority, and your firewall vendor documentation for options and support for HTTPS inspection.<\/p>\n\n\n\n The JumpCloud Active Directory Integration uses SSL\/TLS for all communication. If your security policy requires a port number, the standard HTTPS port 443<\/strong> must be added to your allow list.<\/p>\n\n\n\n If your company has an allow list of domains, please include the following domains to your allow list:<\/p>\n\n\n\n Due to the elastic nature of the JumpCloud infrastructure, we currently do not publish lists of IP addresses for allow lists related to our JumpCloud Agent service at this time. Our servers are load-balanced, as well as regionally dispersed, which can lead to a wide variety of source IPs at any given time.<\/p>\n","protected":false},"excerpt":{"rendered":" Firewall allow lists provides access to specific addresses and programs that would normally be disallowed depending on your security policy. […]<\/p>\n","protected":false},"author":206,"featured_media":0,"template":"","meta":{"_acf_changed":false,"_oasis_is_in_workflow":0,"_oasis_original":0,"_oasis_task_priority":"","inline_featured_image":false,"footnotes":""},"support_category":[2939,2848],"support_tag":[],"coauthors":[2842],"acf":[],"yoast_head":"\nRequired Domains<\/h3>\n\n\n\n
Required IP Addresses<\/h3>\n\n\n\n
\n
<\/a>JumpCloud LDAP-as-a-Service<\/h2>\n\n\n\n
Required Ports<\/h3>\n\n\n\n
![](\"\/wp-content\/themes\/jumpcloud\/assets\/images\/gutenberg-blocks\/note-icon.png\"){kind=icon}
<\/p><\/div>Required Domains<\/h3>\n\n\n\n
\n
Required IP Addresses<\/h3>\n\n\n\n
<\/a>JumpCloud RADIUS-as-a-Service<\/h2>\n\n\n\n
Required Ports<\/h3>\n\n\n\n
Required Domains<\/h3>\n\n\n\n
\n
<\/p><\/div>Required IP Addresses<\/strong><\/h3>\n\n\n\n
\n
<\/a>JumpCloud Active Directory Integration<\/h2>\n\n\n\n
Required Ports<\/strong><\/h3>\n\n\n\n
Required Domains<\/h3>\n\n\n\n
\n
Required IP Addresses<\/strong><\/h3>\n\n\n\n