I've setup the profile manager and locking a laptop works great while on the same LAN as the Lion server but if I'm outside the office it will never get the remote lock request. The Lion server is behind a NAT. Do I need to forward ports to the lion server?

1 Answer 1


Yes, you'll need to either forward these ports to your Lion server, or put the Lion server in your firewall's DMZ. You will also need to make sure that the DNS name of your Lion server is resolvable to devices outside of your network.

The Apple Push Notification service used by Profile Manager will tell your device "Check in with this server", but your server needs to be resolvable and accessible for your device to actually check in and get the command that you've set for it in Profile Manager. That's why the lock command is working while your laptop is on the same LAN as the server.

  • That's the way. Commented Jun 12, 2012 at 14:11
  • do you know what ports need to be opened?
    – Mike
    Commented Jun 13, 2012 at 9:29
  • 2195, 2196 - TCP - Used by Profile Manager to send push notifications 5223 - TCP - Used to maintain a persistent connection to APNs and receive push notifications 80/443 - TCP - Provides access to the web interface for Profile Manager admin 1640 - TCP - Enrollment access to the Certificate Authority
    – Rich
    Commented Jun 14, 2012 at 18:57

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .