Skip to main content

Bypassing DPI for Apple Traffic in MDM Communication

What

Apple Push Notification service (APNs) traffic must not be intercepted or rerouted. Configure firewalls, proxies, and content filters so managed Apple devices can reach Apple's network at 17.0.0.0/8 without TLS inspection.

When/Why

Deep Packet Inspection (DPI), TLS inspection, and SSL interception let a security appliance examine encrypted traffic. That interception is useful for some services, but APNs treats inspected or rerouted connections as compromised.

FileWave uses APNs to notify Apple devices that management commands are waiting. If network inspection breaks that connection, enrollment and command delivery can stall even when the device can otherwise browse the internet.

How

Create a scoped inspection-bypass rule for Apple network traffic. Apple documents direct or proxy access from devices to 17.0.0.0/8; also allow the required hosts and ports listed in Apple's enterprise network requirements and FileWave's port reference.

  1. Review firewall, proxy, and content-filter settings

    • Log in to your firewall or content filter management interface.

  2. Create the inspection-bypass rule

    • Navigate to the section where you can create rules or policies.
    • Create a new rule to bypass DPI for the IP range 17.0.0.0/8.

  3. Verify Configuration:

    • Test enrollment or send a harmless management command to a pilot Apple device.
    • Check the security appliance logs to confirm the APNs connection was allowed without TLS or SSL interception.

Digging Deeper

Keep the exception limited to the documented Apple traffic rather than disabling inspection broadly. If APNs still fails after the bypass, compare the firewall policy with Apple's current host and port list and the FileWave port-usage article.

No comments to display

Back to top