iPad DEP enrolment

[InspireICT]

I'm trying to setup some iPads on our MDM solution with Apple School Manager. Apple School Manager and Lightspeed MDM are connected perfectly and when I turn on a new iPad it says it has a configuration to download which it does perfectly but only when I connect the iPad on my home network. In school, it fails saying,

 

"The configuration for your iPad could not be downloaded from ......"

 

"Could not connect to the server"

 

I'm assuming this is a filtering/firewall issue. Any ideas?

[snagrat]

Have you read the Lightspeed ports that need to be opened for its MDM?

[InspireICT]

This is where it gets a bit tricky. I've been led to believe from an Apple Specialist that rather than being a port issue it is a filtering problem which would make sense as the school uses a proxy server for all internet traffic (through the LA internet) which, of course, you can't input when you first connect to the wireless. I was hoping that it may have been trying to connect with a website (e.g. dep.apple.com) which I could try to get the LA to unblock without using the proxy.

[InspireICT]

Also, once the iPad is joined to the wireless and the proxy has been entered, I can enrol it in MDM. I just can't do it the DEP way, i.e. on first boot.

[snagrat]

You can set a proxy. Join to wifi and then press the Home button. You get a menu for More Wifi Setting where a proxy can be set

[InspireICT]

But this only seems to allow me to enrol the devices in unsupervised mode. When I set the devices up at home, I turn it on, join it to the wireless, it recognises that it is a managed iPad and downloads it's configuration including Apps, iOS updates, screen layouts etc.

 

At school I have to run through the whole iPad setup process, i.e. enable/disable siri, enable/disable location services, etc etc etc, I then have to go to settings, input the proxy server, navigate to the lsmdm.com website to download the config settings to enrol the device. Once this is donw, it shows up as an unsupervised device with very few applied restrictions, no ability to update iOS etc etc.

 

If I could just get the devices to communicate without the proxy server, I'd be all sorted.

[snagrat]

Can you configure your filtering system to not require a proxy?

[InspireICT]

Sadly, this is all controlled by the local authority - we have no control over it but we can make requests. I'm hoping someone will know what the url is that iPads access to download configurations and I can asked the LA to allow that URL to be accessed without the proxy. Lightspeed have suggested that it's an Apple server that it contacts and not a Lightspeed server.

[snagrat]

I think DEP uses different ports to 80/443 so if you can configure your filtering to not require a proxy for the specific ports then the enrolment should work

[snagrat]

What LEA are you?

[InspireICT]

Hertfordshire

[defrostie]

You can set a proxy. Join to wifi and then press the Home button. You get a menu for More Wifi Setting where a proxy can be set

@InspireICT Did you try the above? I had this issue at a Suffolk school using the LEA's proxy broadband. The above method allows you to put in the proxy details BEFORE setting up the iPad. See here for more info - https://support.apple.com/en-gb/HT202693

[Brimstone]

The above solution works as I've done this with hundreds of schools, if you're still getting a problem then the filter is also blocking the certificate, here's the list of ports and I.P.'s that Apple use...

 

https://support.apple.com/en-gb/HT202944

[InspireICT]

You can set a proxy. Join to wifi and then press the Home button. You get a menu for More Wifi Setting where a proxy can be set

 

Thanks for this, I originally misunderstood what you wrote but it works perfectly - thanks.

[HTCPCP]

Thanks for this, I originally misunderstood what you wrote but it works perfectly - thanks.

Have you thought about getting a transparent proxy set up. HfL and Updata are able to set it up for you (although a certain amount has to be done by you without huge cost from HfL though). When setting it up we just used an old workstation with dual gigabit ethernet, with Server 2012 on it, set up with a dhcp scope with the IP range given to us. No need for proxy and all users get the standard student feed.

[kestrel1]

Have you tried the Meraki Mobile Device Manager. Seems easier to setup than the Apple School Manager.

https://meraki.cisco.com/solutions/mobile-device-management