Still drop

[Moudar]

Hi,

I have created a rule to allow all IPads to reach to .apple.com domain. The problem is that not all IPads are reaching to that domain, but some still drop, this is my rule:

Source: Ipad network

destination: .apple.com domain

services and application: any

Action:accept

Track:log

The IPad network is 10.10.32.0/19. After adding that rule some IPads are accepted to reach .apple.com:

 And some still drop:

So why some are still dropping? They are reaching to the Cleanup rule 59.12, where 59.3 is to accept all connections to Apple?!

59 is an Inline layer where IPad network is in the source of it.

What do I miss here?!

[G_W_Albrecht]

https://community.checkpoint.com/t5/Security-Gateways/Apple-and-HTTPS-Inspection/m-p/176039

[the_rock]

What @G_W_Albrecht is your best process to follow...now, IF you dont use urlf blade, then domain objects is fine, but make sure it says .*.apple.com and fqdn option is unchecked, otherwise, it may not match all needed sub-domains.

Andy

[Moudar]

When trying to make it *.apple.com i get this:

Now my domain object looks like this:

[Moudar]

What if URL and application blades are active, is there any better way to do that ?

[the_rock]

Yes, if those are enabled, please follow what @G_W_Albrecht suggested.

Andy

[the_rock]

Maybe you missed . in my post : -)

I mentioned .*.apple.com, but you can also do .*apple.com

Every domain object MUST start with .

Hope that helps

Andy

Please refer to below link:

https://support.checkpoint.com/results/sk/sk120633

[Moudar]

Now it looks like this:

But still have drops!

I don't really understand what @G_W_Albrecht suggestion is?!

How should I use app and url blades to achieve the same?

[the_rock · Accepted solution]

Just allow 17.0.0.0/8 subnet, that will fix it, as thats what Apple uses.

https://news.ycombinator.com/item?id=3341349

Otherwise, make sure urlf and appc blades are enabled and follow what Guenther suggested, screenshots are there, its pretty straight forward...you need to use built in applications in smart console, just type apple when adding it in the rule and bunch of stuff will pop up.

Andy

[Moudar]

It works fine now with 17.0.0.0/8 

URL and application, do you mean enable all these?

[G_W_Albrecht]

Could well be that only using 17.0.0.0/8 works for you, i would try before doing any other configuration !

[the_rock]

Not really, if that range works, then its good. I would leave it as is then.

Andy

[the_rock]

Also, as per below

https://developer.apple.com/forums/thread/44549