There is an issue with the JMX monitoring that even though it listens on a single, predefined port number, it requires another, random port for the further communication with JMX client.

This effectively disables JMX monitoring for installation protected by firewalls.