Access to Apple APP store broke overnight

Question

Hi folks, 
 this morning 3 of my Apple devices failed to connect to the APP store. I cannot find any reason in the logs. 
 I turned off wifi on my iPhone and connected to the APP store where two updates were flagged. Turned the wifi on and accessed the APP store and the updates were processed. 
 The question what downloaded and broke the APP store access. 
 I will try using my wife's iPhone later because it is in a different rule group to see what happens and report back. 
 Ian

Dom Nik · Answer

Hi, 
 I had the same problems and tried a lot with Web Exceptions and FQDN hosts. The big problem with the App Store definitely is the Malware Scan for http, as the app updates (and maybe images etc. ) are transfered using http. Additionally the FQDNs are still problematic so I added the complete Class A network which belongs to Apple. 
 
 My working solution (which I'm using for >1 years now) is the following WAN rule which I assign to all Apple Devices: 
 
 Destination networks: 
 FQDNs: *.apple.com *.icloud-content.com *.icloud.com *.mzstatic.com *.apple.com.edgesuite.net *.cdn-apple.com *.itunes.com *.apple-dns.net *.aaplimg.com *.apple.com.akadns.net *.ls-apple.com.akadns.net *.itunes-apple.com.akadns.net *.apple.com.edgekey.net *.ls2-apple.com.akadns.net *.origin-apple.com.akadns.net *.content-storage-download.googleapis.com *.content-storage-upload.googleapis.com *.mail.me.com *.mail.me.com.akadns.net 
 Network: 17.0.0.0/8

Ports TCP: 80, 443, 5223, 2195, 2196, 5224, 5228

Ports UDP: 16384:16472, 3478:3497

Web and content scanning: nothing selected (!), Google QUIC disabled

Advanced: - IPS rule: Category = app-detect, browser-chrome, browser-firefox, browser-other, browser-plugins, browser-webkit, exploit-kit, file-executable, file-image, file-java, file-multimedia, file-office, file-other, file-pdf, indicator-compromise, indicator-obfuscation, indicator-shellcode, malware-backdoor, malware-cnc, malware-other, misc, netbios, os-mobile, os-other, policy-other, protocol-dns, protocol-ftp, protocol-icmp, protocol-imap, protocol-other, protocol-services, protocol-voip, pua-other, scan Platform = Unix, Mac, Other Target = Client - Custom Web policy without restrictions but with logging enabled.

I hope this will help. :-) 
 Best Regards 
 Dom Nik