Thread Info
  • State Suggested Answer
  • +1 person also asked this people also asked this
  • Locked Locked
  • Replies 29 replies
  • Answers 1 answer
  • Subscribers 9 subscribers
  • Views 43924 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Cannot Connect to App Store Since Upgrading to iOS v11

busthead

Ever since upgrading our iOS devices to v11 they "Cannot Connect to App Store" when the connection is through our UTM. We are not experiencing any issues connecting these devices to the App Store through other non-UTM Internet connections.

There are no blocked packets in the Firewall logs and no blocked connection attempts in the Web Protection logs.

The "Apple Update [Allows Apple Update without content scanning side effects.]" Web Protection exception is enabled.

I'm running UTM v9.415-1 (and not interested in upgrading to v9.5 so please don't suggest that as a fix unless this is a known issue with v9.4).

Adding iOS devices to the "Skip Transparent Mode Source" list resolves the issue but is obviously a less than desirable solution.

I can't be the only one experiencing this issue. Please help.



This thread was automatically locked due to age.
  • 0 in reply to rfcat_vk

    rfcat_vk said:
    The error message indicates a DNS issue

     

    What error message? Can you please capture and share it here? It may provide a clue as to how to solve this issue.

     

    Also, if you update iOS on your iPad, it's able to connect to the iOS app store and update apps? Does your iPad have a cellular connection or only Wi-Fi? This issue appears to affect Wi-Fi only devices but not cellular enabled iPhones, etc.

     

    Could anyone with a Mac who is experiencing this issue grab a packet capture via 'sudo tcpdump port 53' please?

  • 0 in reply to busthead

    Further update. iPad is only wifi and checks software version okay but fails app store again.

    The error from the MAC

    Ian

     

    Update:- I see SYN error in the firewall log when I try to connect from any Apple device.

    More. The Apple site advises restarting IoS device after receiving the error. I did on the iphone and that worked, but not the iPad. The other interesting thing is if you take the device out of the network update it then bring it back into the secure environment the access to the app store works. So what is being blocked, I can't see whatever it is in any log?

    XG115W - v20.0.1 MR-1 - Home

    XG on VM 8 - v20 GA

    If a post solves your question please use the 'Verify Answer' button.

  • 0 in reply to rfcat_vk

    Hi,

    have a look at this url, might provide some insight about certificate errors.

    https://discussions.apple.com/thread/8161225

    Ian

    Doing a lot more digging the issue appears to be apple based to do with certificates expiring.

    XG115W - v20.0.1 MR-1 - Home

    XG on VM 8 - v20 GA

    If a post solves your question please use the 'Verify Answer' button.

  • 0 in reply to James Lee

    Thanks James, this is the only solution that helped me.  I'd rather transparent proxy everything I can, so am keen to find out why proxying this host causes iTunes store to not be accessible.

  • 0 in reply to James Lee

    My iPhone XS (iOS 12.1.4) stopped wanting to download from the App Store.  Behind UTM 9.601, I solved the problem as did James Lee above.  Out of an abundance of caution, I added a Network Group to the Transparent mode Skiplist that included apptrailers.itunes.apple.com, iosapps.itunes.apple.com, ocsp.apple.com & updates-http.cdn-apple.com.  I noted that I had had several app updates that then were downloaded.

    Cheers - Bob

     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
  • 0

    Like to add another wrinkle here. It seems Mojave 10.14 will not authenticate with FaceTime or the App store through the firewall. Messages works fine, and all necessary ports are open. It looks like it might be a 2 factor authentication issue, as I can reliably log into both on older Apple desktop OSes. The only solution I've found so far has been to turn off IPV6 or put it in Link-Local on Mojave. Connection is fine  and works once that is done. Anybody else experiencing this or know a workaround?

  • 0 in reply to John Barry

    In May of 2018 I added DNS host 'ocsp.digicert.com' to Web Protection->Filtering Options->Misc-Skip Transparent Mode Destination Hosts/Nets, and haven't had an issue since.

     

    Thx

  • 0 in reply to busthead

    I'm on an XG. Added it to exceptions and still having same issue. 

  • 0 in reply to John Barry

    John, I'll guess that your Exception has an error, but the best place for you to pursue that will be in the XG Firewall Community.

    Cheers - Bob

     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
Unfiltered HTML