apple.com URL Filtering Exception

Hi,

you would create an fqsn for music.apple.com, create a rule with the FQDN at the top of you rule list and set to drop traffic.

Apple sites do not like to be decrypted and scanned so rather than create exceptions you create a new rule based on the Apple.com etc fqdns and set that as the second rule in your firewall list.

If need I will post my apple rule?

ian

If you could post your rule that would be really helpful? Thanks

Hi,

The web exception are needed even if you are not scanning and decrypting apple traffic, some part of the XG does not follow the no web, no application and SSL/TLS ignore policies.

I did include a couple of other Apple sites because I was not sure at the time they were part of the Apple IP group.

I have Apple rules in IP4 and IPv6 firewall rules.

Ian

Just discovered a flaw in my disabling the Apple exceptions because there are a couple of non Apple sites that appear to be used by the App store that i have added to the exception list.

Further, found some more holes in my Apple setup while trying out ideas for you.

Hi,

The web exception are needed even if you are not scanning and decrypting apple traffic, some part of the XG does not follow the no web, no application and SSL/TLS ignore policies.

I did include a couple of other Apple sites because I was not sure at the time they were part of the Apple IP group.

I have Apple rules in IP4 and IPv6 firewall rules.

Ian

Just discovered a flaw in my disabling the Apple exceptions because there are a couple of non Apple sites that appear to be used by the App store that i have added to the exception list.

Further, found some more holes in my Apple setup while trying out ideas for you.

Hi,

another thought crossed my mind as to why I have the firewall rule and policies as shown above, I found the the Apple photo app would not download photos correctly even with the execeptions in place.

Ian

Strangely enough, I couldn't get the Apple Mac store to work until I unchecked the 'Use web proxy instead of DPI engine" box in the firewall rule even though I have the following web exceptions:

updates.cdn-apple.com

^([A-Za-z0-9.-]*\.)?apple\.com\.?/

^([A-Za-z0-9.-]*\.)?cdn-apple\.com\.?/

^([A-Za-z0-9.-]*\.)?mzstatic\.com\.?/

^([A-Za-z0-9.-]*\.)?apple\-cloudkit\.com\.?/

^([A-Za-z0-9.-]*\.)?icloud\-content\.com\.?/

^([A-Za-z0-9.-]*\.)?icloud\.com\.?/

^([A-Za-z0-9.-]*\.)?iicloud\-sandbox\.com\.?/

Any ideas why I had to uncheck the box to get the Apple Mac store to work?

Hi Brian,

because of the range of ports used by Apple. I have a list of active ports as part of my firewall rule, it is not the full list of ports shown on the Apple site. Web proxy covers web ports while DPI covers in theory all ports but not UDP.

Ian