This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Cannot Connect to App Store Since Upgrading to iOS v11

Ever since upgrading our iOS devices to v11 they "Cannot Connect to App Store" when the connection is through our UTM. We are not experiencing any issues connecting these devices to the App Store through other non-UTM Internet connections.

There are no blocked packets in the Firewall logs and no blocked connection attempts in the Web Protection logs.

The "Apple Update [Allows Apple Update without content scanning side effects.]" Web Protection exception is enabled.

I'm running UTM v9.415-1 (and not interested in upgrading to v9.5 so please don't suggest that as a fix unless this is a known issue with v9.4).

Adding iOS devices to the "Skip Transparent Mode Source" list resolves the issue but is obviously a less than desirable solution.

I can't be the only one experiencing this issue. Please help.



This thread was automatically locked due to age.
Parents
  • I have the same problem ~ It still cannot be solved.... 

    IPAD with IOS 11 cannot connect to Apple App Store, or cannot download any apps or update.

    Sometimes, It can be solved by connecting the IPAD to a mobile tethering once, and back to company AP. However, it is only solved in limited and short time.

    It seems that is a certificate problem in IOS11 with Sophos UTM. 

     

    we are using Sophos SG310 (Firmware version: 9.506-2)

     

    Cato

  • Please share the solution with us after you work with Sophos Support.

    Cheers - Bob

     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
  • This issue persists but it appears that only wi-fi only iPads are affected and not iPhones? Can anyone confirm that their wi-fi only iPad cannot connect to the app store but that any cellular capable iOS device can connect to the app store - even when using the same wi-fi network as the iPads that cannot connect?

    Thx

  • Hi folks,

    while not currently a UTM user but an XG user, I have the same issue. MACs and iPads fail, but iphones connect, strange? The work around was to connect the MACs and iPad via a hotspot initiate the APPLE store connection and then put the devices back on to the LAN works fine but.... For some unknown reason mine broke a couple of days ago and all my rules failed to allow connection which had worked in the past.

    So, working with Sophos Community Support Team I tried some different firewall rules this morning. In the end the one that worked was allow MAC devices by IP address and any as the service and destination. After all the devices have accessed the Apple store I disabled that rule and the MACs and iPad can now access the Apple store without error.

    I suspect the issue is caused by a tcp rst error I see in the logs, but can't reproduce the failure to do additional testing.

    I hope the above provides some help.

    Ian

    Late thought:- this is probably an XG only issue, but I did find at one stage that the *.apple.com did not work, almost as if there is addresses missing or apple has a non apple address in use?

    XG115W - v20 GA - Home

    XG on VM 8 - v20 GA

    If a post solves your question please use the 'Verify Answer' button.

Reply
  • Hi folks,

    while not currently a UTM user but an XG user, I have the same issue. MACs and iPads fail, but iphones connect, strange? The work around was to connect the MACs and iPad via a hotspot initiate the APPLE store connection and then put the devices back on to the LAN works fine but.... For some unknown reason mine broke a couple of days ago and all my rules failed to allow connection which had worked in the past.

    So, working with Sophos Community Support Team I tried some different firewall rules this morning. In the end the one that worked was allow MAC devices by IP address and any as the service and destination. After all the devices have accessed the Apple store I disabled that rule and the MACs and iPad can now access the Apple store without error.

    I suspect the issue is caused by a tcp rst error I see in the logs, but can't reproduce the failure to do additional testing.

    I hope the above provides some help.

    Ian

    Late thought:- this is probably an XG only issue, but I did find at one stage that the *.apple.com did not work, almost as if there is addresses missing or apple has a non apple address in use?

    XG115W - v20 GA - Home

    XG on VM 8 - v20 GA

    If a post solves your question please use the 'Verify Answer' button.

Children
  • Ian, my theory is that you can ignore blocked RST packets unless there's a problem.  I think that your distance from the Apple Store causes the connection tracker to terminate a connection too soon for the communication to continue.  I'm not a TCP/IP guru, so I don't know which ip_conntrack_tcp_timeout needs to be increased.  running Wireshark on a packet capture would probably give us the answer.  The options are:

    "ip_conntrack_tcp_timeout_close" => 10,
    "ip_conntrack_tcp_timeout_close_wait" => 60,
    "ip_conntrack_tcp_timeout_established" => 86400,
    "ip_conntrack_tcp_timeout_fin_wait" => 120,
    "ip_conntrack_tcp_timeout_last_ack" => 30,
    "ip_conntrack_tcp_timeout_max_retrans" => 300,
    "ip_conntrack_tcp_timeout_syn_recv" => 60,
    "ip_conntrack_tcp_timeout_syn_sent" => 120

    Cheers - Bob

     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
  • Hi Bob,

    thank yo u for your thoughts. I have passed a link to this thread to the Sophos Community Support Team to read and see if that is an answer.

    Ian

    XG115W - v20 GA - Home

    XG on VM 8 - v20 GA

    If a post solves your question please use the 'Verify Answer' button.

  • Please note: my experience has been that the suggested work arounds only remediate the issue until either the Apple device OS or Sophos UTM OS is updated, which causes the issue to return.

  • Hi,

    I had a lot of issues with this until the latest release of IOS for ipad and high sierra for mac books. It was working fine after the updates until I broke my XG configuration the other day.

    Ian

    XG115W - v20 GA - Home

    XG on VM 8 - v20 GA

    If a post solves your question please use the 'Verify Answer' button.