iPads and filters!!

[tj2419]

Hi

 

Does anyone know what exceptions you have to make to allow ipads to update and download apps etc?

 

I have had a look through the forums and added these but still no luck.

 

 

itunes.apple.com

ax.itunes.apple.com

ax.init.itunes.apple.com

albert.apple.com

gs.apple.com

ax.phobos.apple.com.edgesuite.net

mzstatic.com

apple.com

evintl-ocsp.verisign.com

evsecure-ocsp.verisign.com

 

Thanks

[jinnantonnixx]

You'll need to add the user agent 'ocspd' direct access. I have a feeling that you'll need to allow the agent 'iTunes' as well, as neither of these provide user credentials when they bang on the door of the proxy. FPITA. Edited September 21, 2012 by jinnantonnixx

[tj2419]

You'll need to add the user agent 'ocspd' direct access.

 

Hi thanks for the reply. Could you elaborate a bit more please.

[jinnantonnixx]

Certainly. When an app talks to the proxy, it provides a user agent, which is normally related to the application. The Mac update service uses the user-agent called 'ocspd'. We know that this doesn't provide credentials to the proxy server (on my Squid servers I get unauthenticated users when the Macs update) so I allow this service out without authentication. I'm not a Mac expert, this is from analysing my Squid logs on my Linux servers. If anybody knows of a better way to get Macs to update through proxies I'm all ears, but this works for me. Edited September 21, 2012 by jinnantonnixx

[OhDear]

Certainly. When an app talks to the proxy, it provides a user agent, which is normally related to the application. The Mac update service uses the user-agent called 'ocspd'. We know that this doesn't provide credentials to the proxy server (on my Squid servers I get unauthenticated users when the Macs update) so I allow this service out without authentication. I'm not a Mac expert, this is from analysing my Squid logs on my Linux servers. If anybody knows of a better way to get Macs to update through proxies I'm all ears, but this works for me.

Is this the same with Microsoft TMG 2010? We have a bank of iPads which all pop-up asking about HTTPS authentication, got me thinking if this has anything to do with it?

 

Thanks

[jinnantonnixx]

Is this the same with Microsoft TMG 2010? We have a bank of iPads which all pop-up asking about HTTPS authentication, got me thinking if this has anything to do with it?

 

Thanks

 

It could be that you have SSL inspection turned on and a certificate problem. Proxies can't peek into encrypted (SSL) traffic, so they create two sessions - one from the client to the proxy (with an internal certificate), the other from the proxy to the target website (with the 'real' certificate). It impersonates the end-point web sites by generating a certificate used within your organisation. You'll have to install this on the Macs. It's effectively a man-in-the-middle attack, but done by your proxy to check your https traffic, albeit with a certificate issued by your organisation. If you don't have this certificate on the machines, you'll get problems.

 

This might help.

Mac OS Clients fail to access SSL Websites after you enable HTTPS Inspection in Forefront TMG 2010 - Forefront TMG Product Team Blog - Site Home - TechNet Blogs

Edited September 21, 2012 by jinnantonnixx