Why Set Application ID "apple-push-notifications", but gateway.sandbox.push.apple.com not working

[JamesBang]

hello~

I used the "apple-push-notifications" application id to add a new firewall rule. Afterwards, I found that the URL "gateway.sandbox.push.apple.com" is not working properly. Why?

Image Source：https://applipedia.paloaltonetworks.com/

[reaper]

could you add a little information? How did you configure the security policy, and what abouyt the url did not work properly? When you try to access that URL, do you see the session being logged against that new security policy, are there any dropped connections being reported that belong to that session?

[JamesBang]

set the  firewall rule is our network management, i just know there infomation...

Address：any

Application：apple-push-notifications

Service：any

URL Category：any

and we add other rule like this, it's work.

URL：api.sandbox.push.apple.com、gateway.sandbox.push.apple.com

port：443

I want to know if apple-push-notifications contains api.sandbox.push.apple.com, gateway.sandbox.push.apple.com?

Otherwise why would you want to set it separately?

[JamesBang]

Hello @reaper ,

I want to know if apple-push-notifications contains api.sandbox.push.apple.com, gateway.sandbox.push.apple.com?

can you provide information for me to understand?

[OtakarKlier · Accepted solution]

Hello,

No, the application only identifies the application. The other part is the URL filter. These are two seperate engines. You will need to find out why that URL is getting blocked then allow for it.

Regards,

[JamesBang]

Thank you, I will find problems from URL filter.

[kshahata]

apple push notifications some time use port 2195

[kshahata]

check this document 

making-apple-push-notification-service-available-on-your-network.pdf (jamf.com)