Issue with enrolling with the JSS-DMZ.

[vobizzy]

Hello Everyone!

i am currently working on a project to place a JSS out on the DMZ. The current setup are as follows:

JSS-DMZ is running on Windows 2012 R2
JSS-DMZ is fully configured with Clustering and Limited Access to external connections
JSS-DMZ DNS is configured by split-dns so we have an internal name that mirrors the external name
The JSS-DMZ is using 3306 to contact the Internal-JSS which is the only port that is open to the internal network
Internal JSS is connected to AD but the JSS-DMZ is not

I can contact the JSS-DMZ just fine and was able to login to the web console before I closed it up but I am not able to enroll any external devices. I tried making a package from Recon internally with the external server's address but installing it fails. Using the old QuickAdd package fails as well. While trying to connect externally with Recon, it would say "Connecting to the JSS" but hangs. Lastly, enrolling with the jss.companyname.com:8443/enroll would hang at the "Assign User" screen (I am assuming because I don't have port 389 open to our DC).

I am trying to rack my brain on this but short of opening 389 (AD) port to our DC, I got nothing.

Any suggestions?

UPDATE: So apparently you can leave the "Assigned User" blank...but now it's hanging up at "Install Downloaded QuickAdd.pkg" and nothing has downloaded.

[davidacland]

Yep that "Assign to user" screen could really do with a "skip" button. It's not so obvious that you can leave it blank.

On the main issue, my understanding is that both JSSes would need to be able to communicate with the DC independently. If you've got SSL enabled on the LDAP service that shouldn't be an issue.

[vobizzy · Accepted solution]

Found the problem! For some reason when connecting to mySQL database on the internal JSS it somehow copied over the internal DNS name. I reconfigured it to the correct external name, restarted Tomcat and it works!