Quick update. Added my IP to the 'all clear' list in my Cisco ASA device and the download is working fine. So it's definitely a port issue. But what port? I unblocked: 3689, 5297, 5298 5353, 8000-8999 and 42000-42999 as suggested by the Apple site. Did I miss one?