TLARWise Posted January 29, 2018 Posted January 29, 2018 We have just started to use Mosyle to manage our ipads and are starting from scratch so doing a full erase all content and settings. Devices that previously had IOS 10 installed on them proceed to activate and download apps, etc fine however devices that have been updated to IOS 11 are failing when it comes to downloading the configuration saying it is not available. Does apple use a different activation/DEP server for IOS 11 and if so do you know what the url/ip address of this server is so I can check if it is being blocked by our firewall/proxy server? 1
TLARWise Posted January 30, 2018 Author Posted January 30, 2018 Just to confirm, I tried taking the ipad home with me and running the activation process on my home wifi and it completed fine, so the issue is definitely something to do with our school network.
atcoates Posted January 30, 2018 Posted January 30, 2018 We get something similar but trying to get our lea to open ports is torture. I created another ssid that has less filtering and firewall rules applied to it. I do the initial connection to that. Once connected it downloads the profile and activates then we turn off that ssid and it joins the correct ssid and we enforce wi-fi whitelisting.
TLARWise Posted January 30, 2018 Author Posted January 30, 2018 Unfortunately our firewall/proxy servers are located off site so we can't bypass them. You don't by any chance know the address:port used for IOS 11 activation do you?
atcoates Posted January 30, 2018 Posted January 30, 2018 Unfortunately our firewall/proxy servers are located off site so we can't bypass them. You don't by any chance know the address:port used for IOS 11 activation do you? This help? https://support.apple.com/en-gb/HT202944
StevieM Posted February 1, 2018 Posted February 1, 2018 (edited) Devices that previously had IOS 10 installed on them proceed to activate and download apps, etc fine however devices that have been updated to IOS 11 are failing when it comes to downloading the configuration saying it is not available. Thank goodness it's not just me! I've been having sleepless nights thinking it was something I'd done wrong. This help? https://support.apple.com/en-gb/HT202944 I sent that link to the 'Keeper of the Ports' at the LEA a few weeks ago when I first started setting them up. I'll get in touch again and ask him if he can see anything being blocked since the iOS 11 upgrade. I'll post back if/when I find anything out. Just to confirm, I tried taking the ipad home with me and running the activation process on my home wifi and it completed fine, so the issue is definitely something to do with our school network. I'm using Profile Manager on a local Mac Mini, so I can't test from home, but at least I can carry on setting up the rest of the iOS 10 devices in school. Edited February 1, 2018 by StevieM
StevieM Posted February 1, 2018 Posted February 1, 2018 It seems that the address being denied us is: a23-51-123-27.deploy.static.akamaitechnologies.com (IP address: 23.51.123.27). I've raised a ticket to have it unblocked. I'll let you know if it works.
TLARWise Posted February 2, 2018 Author Posted February 2, 2018 It seems that the address being denied us is: a23-51-123-27.deploy.static.akamaitechnologies.com (IP address: 23.51.123.27). I've raised a ticket to have it unblocked. I'll let you know if it works. If I try to access that site from a web browser on my computer a small file is downloaded so it doesn't appear to be blocked for us, at least for http access, do you know if the remote management process uses a different port other than the standard 80/443 web traffic?
StevieM Posted February 2, 2018 Posted February 2, 2018 It seems that the address being denied us is: a23-51-123-27.deploy.static.akamaitechnologies.com (IP address: 23.51.123.27). I've raised a ticket to have it unblocked. I'll let you know if it works. Well it worked for the first iPad, but when I tried another I had the same problem as before. I've just spoken to the guy at the LEA and it seems that there are a whole variety of IP addresses being used. I'm going to need to get further details directly from Apple. If I try to access that site from a web browser on my computer a small file is downloaded so it doesn't appear to be blocked for us, at least for http access, do you know if the remote management process uses a different port other than the standard 80/443 web traffic? Apparently, all the addresses being denied are standard http/https.
StevieM Posted February 2, 2018 Posted February 2, 2018 Apple couldn't give me the information directly but, instead, pointed me towards the Amsys website: https://www.amsys.co.uk/2017/05/configuring-proxies-firewalls-apple-mdm-access It suggests whitelisting various domains for content download including *.akamaiedge.net and *.akamaitechonolgies.com. I can't see our LEA allowing that to happen!
StevieM Posted February 5, 2018 Posted February 5, 2018 Our LEA guy has done some digging and here are the address ranges used by Akamai Technologies: 184.84.0.0/14 (255.252.0.0) 104.64.0.0/10 (255.192.0.0) 23.192.0.0/11 (255.224.0.0) 23.51.112.0/20 (255.255.240.0) 88.221.87.0/24 (255.255.255.0) 88.221.88.0/24 (255.255.255.0) I hope these are useful to others in the same position as us. 1
StevieM Posted February 9, 2018 Posted February 9, 2018 Another thing I've discovered that Apple has changed in iOS 11 - the proxy URL now needs to have the 'http://' prefix in front of it in order for the iPads to locate it. With iOS 10, it only works if you don't include it. Thanks, Apple, that's really helpful! Did you manage to get your activations working, @HilcrRWise?
TLARWise Posted February 9, 2018 Author Posted February 9, 2018 Another thing I've discovered that Apple has changed in iOS 11 - the proxy URL now needs to have the 'http://' prefix in front of it in order for the iPads to locate it. With iOS 10, it only works if you don't include it. Thanks, Apple, that's really helpful! Did you manage to get your activations working, @HilcrRWise? No change yet for us. I have forwarded all the info previously discussedto our internet provider but haven't heard back from them yet and have been too busy to chase it up. I haven't come accross the issue with having to add http:// to our proxy server settings though as we have IOS 11 devices working fine without it.
StevieM Posted February 9, 2018 Posted February 9, 2018 (edited) I haven't come accross the issue with having to add http:// to our proxy server settings though as we have IOS 11 devices working fine without it. It's a strange one as neither did I to start with but we do now. I've just wiped and re-enrolled two devices side by side. The iOS 10 would only activate if I excluded http:// from the proxy pac url, and the iOS 11 would only activate if I included it. Oh well, at least I've got mine working now. Hope you get yours sorted before too long, @HilcrRWise. Edited February 9, 2018 by StevieM
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now