Fortigate problems and Google Play Store / Android App Store

[PotNoodleTech]

Hey guys just hoping someone can shed any light on a problem we've had here for a while.

 

My LEA has a Fortigate filtering system. I don't know the specifics of the versions etc.

 

We can not reliably use the Play store on Chromebooks or Android Play Store on Android devices. 90% of the time it won't even connect to the play store and most often doesnt let you log in to it.

 

The LEA are stumped. Fortigate have done the usual supplier trick and said everything fine, and passed the buck back to the LEA.

 

So far we've worked out the only way to get it to work 100% reliably through the fortigate filter is to disable SSL inspection on that device. We've done it just on my school phone and it's been working flawlessly since. That is of course an absurd thing to do on hundreds (in my school, thousands across the LEA) of pupil use devices.

 

Anyone experienced with or has a Fortigate setup that is working successfully with the app store/play store?

 

At my witts end here as I am asked almost every day for a useful free app of some kind on our chromebooks and simply can't deliver!!

 

Thanks

[Arthur]

The LEA are stumped.

Have they seen the following article from Google?

 

https://support.google.com/chrome/a/answer/6334001?hl=en&ref_topic=3504941

 

For Chrome devices to work on a domain with TLS inspection (also known as SSL inspection), some hostnames need to be exempt from inspection. This is because certificates can only be imported at the user level and are only honored for user-level traffic. Some device-level traffic doesn’t use the TLS or SSL certificate to protect users against certain kinds of security risks.

 

To ensure that Chrome devices work with TLS inspection, you need to whitelist the following hostnames on your proxy server. For details on how to whitelist hostnames, check with your web filter provider.

 

*.1e100.net
accounts.google.com
accounts.google.[country]
accounts.gstatic.com
accounts.youtube.com
alt*.gstatic.com
chromeos-ca.gstatic.com
clients1.google.com
clients2.google.com
clients3.google.com
clients4.google.com
commondatastorage.googleapis.com
cros-omahaproxy.appspot.com
dl.google.com
dl-ssl.google.com
*.gvt1.com
gweb-gettingstartedguide.appspot.com
m.google.com
omahaproxy.appspot.com
pack.google.com
policies.google.com
safebrowsing-cache.google.com
safebrowsing.google.com
ssl.gstatic.com
storage.googleapis.com
tools.google.com
www.googleapis.com
www.gstatic.com

[PotNoodleTech]

Have they seen the following article from Google?

 

https://support.google.com/chrome/a/answer/6334001?hl=en&ref_topic=3504941

 

Thanks for that! I've passed it on to them!