Unable to play Youtube videos on managed ipads (meraki)

[iMangles]

Hi there

 

Have a problem I can't seem to figure out here

 

School environment with a bunch of ipads managed by Meraki mdm

I have youtube auto pushed out to every one of these ipads. However, if I open Youtube on any of these ipads, no videos load.

The app loads successfully, and I can see the correct search results etc. on screen, but the videos themselves are blank.

If I select one, it loads the video with blank grey vid + error message "Something went wrong. Tap to retry"

 

I have tried deleting the meraki pushed app and reinstalling from the app store using an apple id account. Same results.

 

If I get a non managed iPad and install Youtube on this it works correctly, so it doesn't seem to be blocked by the school proxy.

 

Both are connected to the same network, with the same proxy configurations and the same certificates installed.

Only difference is one is managed by meraki, one is not.

 

Here's a snippet from the console log. I couldn't quite tell which was the relevant section to grab, so I can paste more if this does not appear useful

 

iPad YouTube(UIKit)[326] : -canOpenURL: failed for URL: "vnd.youtube.music://" - error: "The operation couldn\M-b\M^@\M^Yt be completed. (OSStatus error -10814.)"Aug 4 09:31:13 iPad YouTube(UIKit)[326] : -canOpenURL: failed for URL: "vnd.youtube.gaming://" - error: "The operation couldn\M-b\M^@\M^Yt be completed. (OSStatus error -10814.)"Aug 4 09:31:13 iPad YouTube(UIKit)[326] : -canOpenURL: failed for URL: "vnd.youtube.kids://" - error: "The operation couldn\M-b\M^@\M^Yt be completed. (OSStatus error -10814.)"Aug 4 09:31:13 iPad YouTube(UIKit)[326] : -canOpenURL: failed for URL: "vnd.youtube.tv://" - error: "The operation couldn\M-b\M^@\M^Yt be completed. (OSStatus error -10814.)"Aug 4 09:31:13 iPad mediaserverd(CoreMedia)[24] : -CMSessionMgr- cmsSetDiscoveryMode: CMSession: 'FigPlayer - 326' com.google.ios.youtube(pid = 326) requesting to set the discovery mode to DiscoveryMode_NoneAug 4 09:31:13 iPad mediaserverd(CoreMedia)[24] : -CMRoutingMgr- CMRoutingMgr_SetDiscoveryMode: CMSession: Session requesting to set the discovery mode to DiscoveryMode_NoneAug 4 09:31:13 iPad mediaserverd(CoreMedia)[24] : -CMRoutingMgr- CMRoutingMgr_SetDiscoveryMode: CMSession: NULL requesting to set the discovery mode to DiscoveryMode_NoneAug 4 09:31:13 iPad assertiond[59] : client HWM increased to 6 because of " (finishTask:180s); id:\M-b\M^@\M-&558F25143C28>Aug 4 09:31:13 iPad assertiond[59] : client HWM increased to 7 because of " (finishTask:180s); id:\M-b\M^@\M-&EBB447E65BB7>

[Jehanzeb]

Filter issue? Is your web filter like Smoothwall, Lightspeed, RM filter or firewall blocking it?

[iMangles]

We have Zscaler and that was my prime suspect, however I dismissed this because iPad that are not managed, but still hooked into the same network can access the videos fine.

Maybe it is still related somehow though, Ill dig through all the settings on zscaler admin and see what I can find

[nottsure]

Have you checked the policies in Meraki? I believe you can restrict youtube from the settings>policy page.

Gut feeling is it's something to do with Meraki rather than the filter.

[Jehanzeb]

There could also be a restriction policy from Google Admin portal if you have separated/divided Student and Teaching staff into different sub organisations. You can set different policies for different sub organisations.

There is also an option in Meraki to restrict age group but then it wouldn't allow to even push Youtube let alone installing the app, running it but not showing/playing any videos sounds more like filtering.

[iMangles]

Well I've now trawled through every page in Meraki searching for anything that might appear to be blocking youtube but can't find anything suspect. There are currently no active Security Policies in Meraki

 

I'll hunt through all the Zscaler settings next. It's just strange that this only affects those iPads that are managed by Meraki, and so far only seems to be affecting youtube videos specifically,

 

The only link these iPads would have to Google Admin is that I created the email there that is now acting as the apple ID. I don't think any kind of policies should be coming from there, but definitely will check all that too

[Jehanzeb]

Hmmmm so if you remove the Meraki profile from one of the affected iPads and use the same Apple ID you created, the video from YouTube plays fine?

 

I would also try and take the affected iPad (with Meraki Profile) outside of School network and then try and play the Youtube video. This will def confirm it is not your school network/inhouse filter (unless you proxy it).

 

Keep us posted with your findings. Good luck.

 

Kindest regards

J.

[iMangles]

Hrmm, now I actually haven't performed those exact troubleshooting steps to be honest. This gives me some great options to try to really nail down some factors. Thanks so much for the suggestions.

 

I had taken a factory default iPad and installed Youtube with a different apple id, but have not tested with this new apple id as yet. This factory default iPad was also not DEP managed, whereas these new ones are.

Neither have I tested simply removing the Meraki profile from the affected iPads and testing again.

 

I will be testing on an outside network connection tonight too. I don't know why I hadn't thought to test this sooner!

 

Thanks a lot. Will report back soon

[iMangles]

Just to add a bit more info here

 

Taking an affected iPad home and connecting to my own wifi, Youtube works correctly.

Return to school wifi, Youtube does not work.

 

Zscaler is our filter system, youtube is whitelisted for all users and devices.

I went to youtube on a device that works, and one that does not and checked Zscaler logs. Its a little hard to filter out the noise and figure out exactly which device is which, so Ill need to test this on the weekend with no kids around to isolate each device. But, it appears that the policy action for each is showing as allowed, however I can see one device is a URL that looks correct, and the bytes used looks right.

Another device is listed with an odd username and it is just hitting URLs that look like i9.ytimg.com:443 and www.youtube.com:443

Also it only ever uses around 300bytes for each of these hits.

So I'm guessing this was the affected device

 

Additionally, I have some iPads which are managed by Meraki, but are not DEP. These ones I have manually added to Meraki using AC2 manual config.

These ones CAN still access Youtube fine.

 

So the only devices affected are those that are specifically DEP listed in Apple School Manager

If it is just setup with an appleid and unmanaged, works fine

If it is manually added to meraki mdm management, works fine.

If it is auto added to meraki by DEP, no dice

 

Also, in the app I cannot see the thumbnails or the video

If I access with safari, I can see the thumbnails, but not the video.

If, in Safari, I load a video, it'll sometimes flash up the start of the video or preroll advertisement, then fall back to "An error occurred. Please try again later. (Playback ID: P2n0XPbNQocn8hO1)"

If I then hit refresh (in safari), the video fills with the thumbnail and displays the play icon. Hit play and same this occurs, flashes up the start of the vid then errors out

Edited August 11, 2017 by iMangles

[Jehanzeb]

Have you actually looked at the school filter running a realtime report by entering the affected device ip to see what is being blocked while accessing youtube. You do need to whitelist

1. YouTube.com

2. Ytimg.com

3. Googlevideo.com

Additionally check how https decryption is working.

Good luck and keep us posted

Kindest regards

J.

[geezersoft]

Is this an issue with blocking the quic protocol in Meraki MDM??

[iMangles]

OK, so some partial success I think!

 

I had an iPad that did not work. I tried re-imaging it and a few things like that with no success.

 

I didn't test it this morning, but I have to assume it was NOT working at that time.

 

I put a global whitelist on youtube.com, ytimg.com and googlevideo.com

 

I then tested youtube on that iPad and it didn't work.

I then updated the iPad to the latest IOS, and youtube worked!

Video thumbnails still wouldn't load in the app, but videos would play correctly.

Youtube on Safari, the thumbnails DO load, but videos DO NOT

 

I figured the issue was well enough resolved then, however, it appears the other iPads I tested continue to not work.

 

I tried re-imaging one of them but still no go.

 

I guess my next step is to figure out exactly what is different about 2 iPads where one works and the other doesn't.

The 2 I am testing were both purchased at the same time and setup the same way with the same settings.

Obviously I did something to iPad A when I was toying with it over the last couple weeks that has enabled it to work though.

 

I have to guess that the extra whitelist entries in zscaler were a key step though, so thankyou for suggesting that one

 

I will continue to investigate

[RLR]

Can you tether an ipad to a mobile phone and check if the video loads then? This will bypass any school filtering which can help narrow it down. Or take one home and test on your home wifi?

[iMangles]

Success!

 

Problem is now (mostly) resolved.

 

After adding the following URL's to the zscaler global whitelist, youtube.com, ytimg.com and googlevideo.com

I tested Youtube and found it still did not work, or so I thought.

After some additional testing, I discovered that SOME youtube videos would play, others would not. So I figured I was missing some other top level domain access.

I just keyed in any youtube domain combination I could think of that might have been related. At first it did not appear to fix the issue, however after leaving for a week and returning, it appears to have taken effect and all Youtube videos appear to play.

Here is the list I used (I know some of these are duplicates, I was adding these at different times)

.googlevideo.com

.googleapis.com

.youtube.com

.ytimg.com

apis.google.com

googlevideo.com

i.ytimg.com

m.youtube.com

s.youtube.com

youtu.be

 

youtube.com

ytimg.com

 

I'm still not getting any video thumbnail previews, so I'm guessing there is some other URL that is still being blocked.

 

I don't have an answer as to why Zscaler was only blocking Youtube videos on iPads setup in this particular fashion and not others.

But everything is resolved well enough for people to continue using them now anyway

 

Thanks for all the input everyone

[KibosJ]

Having this issue too, also using Meraki.

 

I have got YouTube videos playing but unfortunately haven't got thumbnails on the iPads.

 

Does anyone have any more ideas, nothing is being blocked as far as I can see.

[iMangles]

I haven't figured out the thumbnails yet either, still trying things here and there. Will update back here if I figure out a solution

[KibosJ]

I haven't figured out the thumbnails yet either, still trying things here and there. Will update back here if I figure out a solution

 

That's great, really bugging me I might raise a support ticket with Smoothwall.

[KDW1987]

On 06/08/2017 at 23:37, iMangles said:

We have Zscaler and that was my prime suspect, however I dismissed this because iPad that are not managed, but still hooked into the same network can access the videos fine.

Maybe it is still related somehow though, Ill dig through all the settings on zscaler admin and see what I can find

Zscaler are not curently listed on the UK safer Internet centre as an approved filtering vendor. When I questioned about why a member of their team that has since left they do not have the iwf or ctru block lists included within their solutions web filtering. Which I believe is a DFE mandatory requirement.