HTTPS Inspection MacOS

[Charles_Cranefi]

Problem:

We have enabled HTTPS inspection on our network via our Checkpoint blades, all is working just fine apart from inspection of MacOS traffic.
Our certificates are trusted system wide and work for most applications, including Safari but Apple applications like iCloud, iMessage, AppStore etc do not work. I believe this is due to certificate pinning.

An obvious solution would be excluding Apple IPs from inspection but we cant because Apple uses the Akamai CDN and therefore the IPs change almost hourly.

Does anybody here have a solution? Is there a way to somehow efficiently whitelist Apples IPs?

Thank you!

[Ryan_St__Germai]

You could try an HTTPS inspection bypass for the "Apple Services" application...

[Charles_Cranefi]

Unless I am missing something, you can only bypass HTTPS based on site categories and not applications. So Apple falls into the “Web Services Provider” category, but bypassing that would bypass inspection for all web service providers?

[_Val_]

Hi, please look into the following articles: 

Login failures for Apple devices when HTTPS Inspection is enabled on the Security Gateway 

iTunes application cannot log in when HTTPS Inspection is enabled 

[Charles_Cranefi]

Thank you for these links! The first one applies to iOS devices but is definitely helpful for us.

The second link is spot on for our issue but we are worried about excluding entire subnets of Akamai. Would excluding such a large range of IPs also exclude us from inspecting dangerous content? Eg; Non Apple services on Akamai CDN

[Timothy_Hall]

R80.20 and later features "Updatable Objects" that includes Geo Countries and Azure/AWS networks to help avoid the need to exclude constantly-changing swaths of IP addresses in situations like this.  There is not an updatable object for Apple networks to my knowledge, but that sure would be a good RFE...

https://www.checkpoint.com/rfe/rfe.htm 

--
"IPS Immersion Training" Self-paced Video Class
Now Available at http://www.maxpowerfirewalls.com

[Charles_Cranefi]

Thanks for pointing this out, I have submitted an RFE.
I don't think Updateable Objects can be excluded from HTTPS inspection policies at this time? Is that correct?
I have another RFE open for that!

Charlie

[_Val_]

Correct, you cannot use updatable objects in HTTPS inspection rulebase at this moment

[_Val_]

Apple services are not included into the updatable objects.

[_Val_]

As the SK says, Apple owns the whole segment. It should not interfere with other services

[Danny]

It's all fixed in the latest R77.30 JHF (Take 345). Just check the list of resolved issues.