Apple and the 23.0.0.0/8 block

23.0.0.0/8 is owned by Akamai, and I believe Apple uses it for Push notification range in addition to 17.0.0.0/8...

Yes that's one of Akamai's many many CDN's around the world. You'll hit a different one depending on geographic location, and sometimes ones purely at random.

For reference look at @bradtchapman 's JNUC 2017 talk on APNS.

Thanks @franton !

This is one of those times where you need to tell your network / firewall admin that whitelisting by IP address is sooooo 1990s. In my talk I mentioned “next generation firewalls” that can deny or allow apps by their traffic signature.

I’d suggest asking the team in charge of the firewall whether they will accept a request to whitelist DOMAINS rather than address ranges. If they say they can’t, point out that a lot of cloud based apps use CDNs and Global Traffic Management (GTM) to shuffle through a huge range of ever-changing IP addresses. If they still can’t do this, appeal directly to the CIO (or through your director/VP) and inform them that you are alarmed because the network stack appears to be incapable of supporting modern security practices, and the institution is at risk of attacks due to outdated infrastructure.

IP addresses and ports do NOT tell the whole picture. A health care organization such as yours should care about being able to accurately monitor traffic going in and out of the network.

23.0.0.0/8 is owned by Akamai, and don't do SSL data decryption at the firewall when reaching anything at Apple.com or Akamai. You will find MDM profiles disappearing on your macOS devices.