PRA jumpoint across sites

Forum|Forum|21 days ago
August 24, 2026
5 replies
149 views

Is it possible to deploy jumpoint across 2 sites - from jumpoints in PROD/DR the target systems are accessible, is that enough or should it be same VLAN as well?

T

tdearman

BeyondTrust Employee

I’m not sure I completely understand the ask, but be sure to review the jumpoint guide.

https://docs.beyondtrust.com/pra/v25.3/docs/jumpoint

J

Jens Hansen

Guru

@SFA

The requirements for Jumpoint/Gateways is to always deploy in a cluster. (min 2)
Then Your target Endpoint MUST be on the same network as the Jumpoint/Gateway.
sample 10.10.x.x

KR Jens

I

idontwanna

Rising Star

I understand you are probably referencing official vendor documentation but I do wonder why it matters if the jumpoint is on the same subnet/zone or not as the jump items/endpoints. With micro-segmentation and other security concepts in mind, enterprise and OT networks are going to be very segmented and if you followed this, you could have dozens of jumpoints which you then would want to be redundant to avoid single point of failure...seems unreasonable when a firewall can just allow the jump item port & app (ex: 3389 RDP) from the jumpoint subnet/zone to the endpoint.

M

Michael Seals

BeyondTrust Employee

The jumpoint just needs to be able to communicate with the endpoint on the required ports. For remote RDP/Shell Jump jump methods, it is simply port 3389/22 respectively. Some of the other jump methods (Intel vPro, remote jump) require specific ports that are usually blocked at firewall boundaries, so the generic recommendation is ‘same subnet’ for those jump types.

Badge Earners

Sign up

Login to the community