Apple MDM Troubleshooting

Use this article to start troubleshooting Apple MDM enrollment and push-notification issues in FileWave.

Before digging into logs, confirm the basics first:

1. Your FileWave Server should use a fully qualified DNS name. This is the DNS name entered in FileWave Central under Preferences > Mobile.

2. If you changed the Server DNS Name in Preferences > Mobile, regenerate the certificate and trust the new certificate from the enrollment page, for example https://dns:20443/ios.

3. If the APNs certificate upload fails, confirm that the certificate was created from the matching FileWave Server DNS name and is not password protected.

4. If those checks are correct and the issue continues, create an admin user account for Django MDM debugging on the FileWave Server:
   sudo fwcontrol mdm addadminuser

5. Another important log file is "/usr/local/filewave/log/filewave_django.log"

6. Make sure FileWave Central shows "iOS/MDM Service OK" before expecting Apple devices to enroll or receive management commands.

The following are some of the problems encountered before:

Enrollment error: FileWave MDM Configuration is invalid

The profile "FileWave MDM Configuration" is invalid. The MDM payload
"Mobile Device Management" contains an invalid topic.

This usually points to an APNs certificate problem. Regenerate the APNs certificate and confirm it matches the current FileWave Server configuration.

Connection problems

If iOS or iPadOS devices fail to enroll, you may see an MDM check-in connection error in the server logs:

error
(61, 'Connection refused')
Request Method: PUT
Request URL: https://fwxserver.example.org:20443/ios/mdm_checkin
Exception Type: error
Exception Value:
(61, 'Connection refused')

Older APNs troubleshooting often referenced provider port 2195. Apple's current APNs network guidance uses TCP 443 or 2197 for sending notifications to APNs, and TCP 5223 for Apple devices to maintain their APNs connection.

Check current firewall requirements against Default TCP and UDP Port Usage and Apple's Apple Push Notification service network guidance.

Do not open legacy APNs ports from old notes without checking the current FileWave and Apple requirements for your environment.

TCP 5223: Apple devices to APNs

TCP port 5223 must be open so Apple devices can maintain their APNs connection and receive push notifications.

For the FileWave-side port list, see Default TCP and UDP Port Usage.