Overview

Jamf Infrastructure Manager is a service managed by Jamf Pro that allows traffic to pass securely between Jamf Pro and an LDAP directory service. The Infrastructure Manager and the LDAP Proxy typically reside within the DMZ of your organization's network. Infrastructure Manager instances can be installed on Linux and Windows.
Note:

Network Communication

When using the LDAP Proxy, the Jamf Infrastructure Manager can be customized for incoming TCP access on any available port. For Linux, port 1024 or greater must be used because lower-numbered ports are reserved for root services. The port used must be opened, inbound, both on your firewall and on the computer on which the Infrastructure Manager is installed. Configure inbound firewall rules on your connection and the Infrastructure Manager host's operating system to allow connections on this port only from Jamf Pro. For Jamf Cloud-hosted environments, limit the source IP addresses to the list for their hosting region. For more information, see the Permitting Inbound/Outbound Traffic with Jamf Cloud article.

Note:

The Infrastructure Manager does not currently respect network proxy settings configured in the host operating system or in Java. Therefore, the Infrastructure Manager must be enrolled with Jamf Pro and receive its initial configuration on a network that does not require connection via an outbound proxy. Unless a firewall rule is created to allow the Infrastructure Manager to connect to Jamf Pro without using an outbound proxy, the Infrastructure Manager will not receive LDAP configuration updates or be able to notify Jamf Pro that it is operational. It will still be able to receive the inbound LDAP lookup requests from Jamf Pro, however.

For communication between the Infrastructure Manager and an LDAP directory service, your LDAP server’s regular incoming port is used. This port is specified in the LDAP server’s configuration in Jamf Pro. The most common configurations are port 389 for LDAP and port 636 for LDAPS. This communication occurs between the Infrastructure Manager in the DMZ and an internal LDAP directory service only.

Note:

Internal domain addresses (for example, .local, .company, or .mybiz) are not supported at this time. The Infrastructure Manager must be resolvable to the external Jamf Pro server.

The following diagram shows network communication with example ports between your LDAP directory service and Jamf Pro with the Infrastructure Manager installed:
Important:

Jamf Infrastructure Manager 2.3.0 requires Jamf Pro 10.27.0 or later for environments with the Infrastructure Manager instance added as an LDAP proxy server.

For more information about network communication and the connections initiated between the Infrastructure Manager and Jamf Pro, see Network Ports Used by Jamf Pro.