mdm URL and proxy server

APNS does not work via a proxy. This threat (https://jamfnation.jamfsoftware.com/discussion.html?id=9264) is still relevant.

EDIT: "Thread" Nobody is making threats here.. Easy boys...

@AVmcclint just +1 to what @thoule said, & a link to my post in that thread.

I now work for an MSP, but we have to get customers to whitelist those IP's for APNS to work. No worky via a proxy, nothing has changed.

On iOS, WPAD and DHCP proxy auto detection is working for us. After connecting to an open wifi for config we go into "More Settings" and select auto proxy leaving the pac file url blank.

All of our sites have a local proxy that is chained to an upstream proxy. Originally we had lots of problems because of the way our upstream proxy farm was configured would cause different parts of the same action to come from different IP addresses. Originally bypassing the upstream proxy for gs.apple.com solved many issues and lately intermittent issues have been reported by others to be much better now the upstream proxy is bypassing the whole 17.0.0.0/8 address space. The local proxy is still in operation for all requests.

At my specific site we have implemented a separate local proxy (squid) with its own internet connection that the proxy.pac (and wpad.dat) files are pointing all apple traffic too. This proxy will drop all traffic other than *.apple.com, 17.0.0.0/8 or a couple of other specific sites.

Regards
Graeme

The pushback that I am getting from our InfoSec team is that they don't want to make the entire Apple Class A network range 17.0.0.0/8 available without going through the proxy. "That opens us up for attack from 16 million addresses!" "leave it to Apple to make something not work through the proxy." I really hate working with teams who have so much hostility toward all things Apple.

Hey @AVmcclint : if you're coming to JNUC 2017, please consider attending my presentation called "A Push Odyssey: Journey to the Center of APNS." I will be covering APNS in great detail with a focus on MDM, the protocol, and the network infrastructure. I hope to resolve a lot of misconceptions and (mostly unfounded) concerns that InfoSec might have about the push notification service.

@bradtchapman I wish I was going to JNUC. Unfortunately I'm not the one who needs to be convinced of the necessity of APNS and all it entails. This problem also extends to the MBP with TouchBar's ability to install/update the embeddedOS. If your presentation is going to be recorded, maybe I can send the video to our InfoSec team.