Guest User!

You are not Sophos Staff.

Thread Info
  • State Verified Answer
  • +1 person also asked this people also asked this
  • Locked Locked
  • Replies 28 replies
  • Answers 2 answers
  • Subscribers 30 subscribers
  • Views 8687 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

XG Firewall Apple TV+ Connection Issues

Casual_User

Ok, so I decided to give Apple TV+ a try.  I am aware of how finicky Apple products can be, but decided to give it a whirl anyway.  Perhaps I'm beating a dead horse on this.

The first issue was the XG blocking QUIC, once I allowed QUIC, streaming seemed to work fine.  Then things started going off the rails.  I now get intermittent issues where Apple Music and Apple TV+ cannot connect.  Apple TV+ provides the following message "Content Unavailable".  This occurs no matter if I use an iPad, iMac or Android box.

I use Android boxes with the Apple TV+ app installed.

Apple Music and Apple TV+ drop out every 15 or 20 minutes and they remain gone for several minutes before miraculously connecting.  During the Apple down time, the Apple TV+ connection tests pass connecting to the internet but fail with connection to Apple.  I can stream using Disney+ with full 4k HDR10 without a single hiccup at any time and no rule exemptions.  My Speedtest shows absolutely no issues with my fibre line.

I have tried a number of "troubleshooting" steps with disabling one thing or the other.  This became extremely time consuming since the XG takes a very long time to update a firewall rule.  To speed things up, I have created the following rule at the top of my rules list:

  • LAN to WAN
  • Allow any service
  • Allow any source
  • Allow any destination
  • Web Policy = "Allow All"
  • Malware scanning disabled
  • Use web proxy instead of DPI
  • App Control = "Allow All"
  • IPS = "None"

Believe it or not, with the above rule the Apple TV+ and Apple Music still refuse to connect.

At this stage I am at a complete loss as to how to troubleshoot this further.  I cannot see how the XG might be interfering with the connection.  

I should add that I am attempting to troubleshoot this from my iMac by testing the Apple TV+ app on it.

As I finish typing this post, Apple TV+ & Apple Music both came back online.



This thread was automatically locked due to age.
  • 0 in reply to rfcat_vk

    Ok, to summarize:

    I created a firewall rule for all traffic to the Apple IP address range since every device in the house can access Apple TV+.  In that rule I set "Web Filtering" to "None", "App Control" to "None" and "IPS" to "None".  This should mean that none of those security options are deployed (therefore no SSL/TLS) on the Apple IP address range.

    The logs seem to show that while a number of connections are made to the Apple IP address range, those addresses are not used for streaming.  It appears that Apple uses Akamai, AWS and a variety of other services for streaming.  Those servers are then caught by my standard LAN to WAN firewall rule which employs web filtering and will involve SSL/TLS scanning.  If those servers don't like their packets scanned, that would lead to issues.

    I don't know how to capture all the possible servers Apple might be using for streaming in order to put them into my Apple Service firewall rule.  Instead, it is likely best to just disable SSL/TLS inspection.  Or am I missing something?

  • 0 in reply to Casual_User

    Hi,

    here is my Apple access firewall rule.

    The above rules seem to work for most sites the AppleTV, I haven't tried them all. The rule sits above the general access to the internet rule.

    Ian

    XG115W - v19.5.1 mr-1 - Home

    If a post solves your question please use the 'Verify Answer' button.

  • 0 in reply to rfcat_vk

    Thank you for sharing Ian,

    This is both interesting and confusing since your rule appears identical to mine.  I will take a detailed look at this tomorrow.

  • 0 in reply to Casual_User

    I forgot to add the FQDN configuration.

    I have a FQDN group which comprised of two wildcard FQDNs.

    As best as I can determine these cover all Apple sites (today).

    Ian

    XG115W - v19.5.1 mr-1 - Home

    If a post solves your question please use the 'Verify Answer' button.

  • 0 in reply to rfcat_vk

    Thanks again Ian,

    Of course I had to give this a try tonight.  There is good news and bad news.  The bad news is that Apple TV+ streamed for about 14 minutes before it died as it did before with the rule I had.  The only good news is that this means that the rule I had before wasn’t off base.

    I got Apple TV+ streaming again by turning off SSL/TLS scanning.

  • 0 in reply to Casual_User

    Even with SSL/TLS disabled Apple TV+ dies after 13 minutes.  The regularity is perplexing but it is getting to the point that I might as well just cancel Apple TV+.  No other streaming service requires this level of troubleshooting.

    Anyway, time to watch Disney+

  • 0 in reply to Casual_User

    Do not use SSL/TLS scanning on Apple sites, it does not work as well, it does not recognise UDP traffic.

     I gave up and use the Proxy. Apple sites do not like decrypt and scan or even ignore. Just use the plain proxy, it works reliably.

    Ian

    XG115W - v19.5.1 mr-1 - Home

    If a post solves your question please use the 'Verify Answer' button.

  • 0 in reply to Casual_User

    When you have a problem, the first thing you want to do is go to the SSL/TLS logs and look for hosts/domains that might be related to your problem and that are being decrypted. Add them to an exception. Works fairly quickly and every time. It's the FIRST thing I look at since it causes mysterious problems -- the XG doesn't have an issue, the software/server have an issue -- so you won't really see an error.

    You'll get this working and a month from now, it'll stop working and you'll see that AppleTv added a new domain that's involved with its streaming. Add it to the list. In my case, I eventually tired of this and exempted our physical AppleTV (our streaming device of choice). And also did some traffic shaping to prioritize the stream as well.

  • 0

    I am giving up on this.  There is nothing that I can seem to do to get Apple TV+ working.  I've had an android box running all day trying to stream a movie through Apple TV+.  It never gets more that 15 or 20 minutes before the stream stops and there are no connections to Apple.  For reference, here are my FW settings:

    The Apple IPv4 network is the 17.0.0.0/8 block of IP addresses.  I added it since there are a number of 17.x.x.x addresses that Apple doesn't get domain names for and would not be caught by the *.apple.com domain.

    Looking at the FW log and filtering results for "log subtype is not Allowed" no packets are logged indicated that all packets are allowed.

    Looking at the SSL/TLS log and filtering results for "Action is not Do not decrypt" nothing appears for any sites other than Sophos.  All other packets are labeled as "Do not decrypt".  I have included a snippet below for the only items appearing in my SSL/TLS logs.  There is nothing for any other website.  They are all for *.sophos.com

  • 0 in reply to Casual_User

    Hi,

    more questions, have you disabled scanning audio and video in the web settings? Is your Apple rule at the top of your rule list? Does log viewer show the AppleTV using your apple rule?

    Unless you have an IPv6 rule adding the IPv6 addresses to the exception list gives no benefit. 

    Ian

    extra, I have IPv6 rules for my Apple devices and find they prefer to use IPv6 rather than ip4.

    XG115W - v19.5.1 mr-1 - Home

    If a post solves your question please use the 'Verify Answer' button.

Unfiltered HTML