JumpCloud Agent Networking and Port Requirements

The agent does not listen on any port for traffic initiated external to the localhost, thus does not increase potential attack vectors. However, as outbound connections are made, any egress filtering performed by Antivirus software, firewalls, routers, etc.. would need to be opened. No inbound TCP connections need to be explicitly defined.

Environments using DNS proxies, or other mechanisms that may cache JumpCloud IP addresses may pin themselves to a single server. For larger environments, this could result in rate limiting which will disrupt installations and functionality. Caching JumpCloud IPs is not recommended.

Note: Clients downloading the agent installer need to use TLS 1.2 or higher. Any clients (browsers, curl, PowerShell, etc.) may need to be updated or explicitly told to use TLS 1.2 or higher in order to successfully download the agent installer.

The JumpCloud agent accesses the following servers and ports:

• a1hrq03pdcca60-ats.iot.us-east-1.amazonaws.com:443

• agent.jumpcloud.com:443

• assist.jumpcloud.com:443 – used by Remote Assist agent

• cdn02.jumpcloud.com:443

• kickstart.jumpcloud.com:443

• private-kickstart.jumpcloud.com:443

• pwm.jumpcloud.com:443 – used by JumpCloud Password Manager

• s3.amazonaws.com:443

• pool.ntp.org:123 (UDP)*

*Time synchronization is necessary for the installation and proper function of the agent; as this can be accomplished on an internal network, access to an external host on port 123 is not necessarily required.

Proxy Support

For installation, Linux (initd) and Mac support routing through an https proxy. Use the following commands to set a proxy server for the installer, then run the installer normally.

Linux