How to configure JMX for Tomcat7 that is running behind firewall.
1. 修改Tomcat 7的源码:org.apache.catalina.mbeans.JmxRemoteLifecycleListener. Add Getter and Setter methods for property clientAuth. update properties rmiRegistryPortPlatform and rmiServerPort humanly to rmiRegistryPort and rmiServerPort. Modify method names corresponding these properties. Delete below lines:

// String clientAuthValue = System.getProperty(
// "com.sun.management.jmxremote.ssl.need.client.auth", "true");
// clientAuth = Boolean.parseBoolean(clientAuthValue);

// String authenticateValue = System.getProperty(
// "com.sun.management.jmxremote.authenticate", "true");

2. Package this single class to a jar file and place this jar file in Tomcat_home/lib.

3. Modify server.xml:
Add a lisener into server.xml:
<Listener className="org.apache.catalina.mbeans.JmxRemoteLifecycleListener" rmiRegistryPort="1098" rmiServerPort="1099" authenticate="false"/>