1

For a few years now, our Net Admin has blocked WiFi access to Apple servers which provide updates to iOS devices. We do this to minimize traffic to our users' devices when new updates are released, (we prefer they use their own home networks,) and more importantly, to keep our carted iPad fleet from updating until we have tested updates against installed apps, etc.

At one point, our AppleTVs were also blocked from tvOS updates through the same method, but with tvOS 13 and Apple TV4s, it seems as if new servers are in use which are not blocked and the ATV4s are being updated. We use our ATVs for AirPlay Conference Room display mode with PIN only. I realize now that I can turn off automatic updating, but it doesn't help at the moment.

This is a roadblock for us because after the update is done, the ATV requires clicking a Continue button on a What's New screen with a remote. Until this button is pressed, AirPlay Conference Room mode is unavailable: the ATV does not appear in the list of AirPlay devices on a macOS or iOS device. From early experiences with missing (stolen) ATV remotes, we do not provide a remote in any ATV location. This means I must go around to every ATV4 (and we have many of them) just to click a button to make it useful.

Can anybody please either let me know what the new tvOS Update server addresses might be, or point me in the right direction? I've done a fair amount of searching, but have found nothing definitive.

Additional information 12/11/2019:

Even though I manually disabled auto-update on the ATV4s, with the release of 13.3 yesterday, the ATV4 pops up a notice that an update is available, necessitating yet another remote button click to make the device useable.

The need to find the tvOS update server is now even more crucial than ever.

Improve this question

1 Answer 1

Reset to default
1

I would recommend three steps.

  1. Set up two caching servers per 1,000 devices you have on your network. Any recent Mac can run caching server, just needs a cheap external hard drive to store 250 GB or more of data. We use 2 TB drives as they are super cheap.
  2. Have your network team allow outbound traffic to all of 17.0.0.0 network. - https://support.apple.com/en-us/HT210060
  3. Profit

The caching servers ensure you only download one copy of each app, each update and no longer can have any sort of overload or denial of service when many devices all arrive and check for App Store or other downloads.

With the latest OS you will literally be breaking how the security works if you can't check for notarized apps and revoked certificates that have malicious software. Also, just not patching your devices is a risk. I would reach out to Apple for help, any workplace with a few devices qualifies for assistance from a local Apple store or direct from a corporate team to help with this.

Content caching needs to reach out to lcdn-registration.apple.com

Today that points at st11p01su-lcdnreg.isu.apple.com.akadns.net which has address 17.164.1.29

There are about 19 other names in the KB above for all updates to run.

Improve this answer
2
  • 1
    We have a caching server for our macOS devices (which vastly outnumber ATVs) and were relying on the firewall block. As I click the damned Continue button on every ATV, I also turn off automatic updates. Only 25 more to go. :-) Thanks, bmike.
    – IconDaemon
    Nov 13, 2019 at 23:06
  • Fight the good fight @IconDaemon - Apple should be able to help you quash any traffic that's out of line and convince networking that the rest is vital and balanced. We had one of our non US plants literally hobbled / slammed / out of order a couple times when too many updates came down the wire.
    – bmike ♦
    Nov 14, 2019 at 0:14

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .