Enable Android devices to connect to the internet

Some Android devices don't connect to the internet over wireless networks when SSL/TLS inspection is on.

Introduction

Mobile devices on some Android versions are unable to connect to the internet when SSL/TLS inspection is on. They're also unable to download or update Google Play Store apps.

These Android clients use certificate pinning, which associates the host server with its public key and stores the certificate in the client. When clients check for internet connectivity, they try to establish a test connection. This connection requires the certificate to connect to Google servers.

When Sophos Firewall intercepts traffic for SSL/TLS inspection, it acts as a man-in-the-middle and negotiates with the destination server. Once the handshake is complete, Sophos Firewall uses a different certificate to negotiate with the Android client. The Android client can’t verify the pinned certificate directly with Google servers to complete its connectivity check.

This is a known issue with SSL/TLS inspection for mobile devices on Android.

To allow these devices to connect to the internet, you need to bypass SSL/TLS inspection when they try to access Google domains. To do so, you can use the following method:

• Create a VLAN or wireless network containing mobile devices. To ensure security, limit the allow list to a VLAN or wireless network and isolate these network segments from access to sensitive resources.
• Create an SSL/TLS inspection rule for not decrypting traffic between the VLAN or wireless network you created and Google domains. Alternatively, you can use a firewall rule with the web proxy selected.

The following example shows how to configure your wireless network and an SSL/TLS inspection to allow these domains.

Add the Google URLs

Create FQDN hosts for the URLs that the Android system contacts to test internet connectivity.

1. Go to Hosts and services > FQDN host group, and click Add.

2. Create a new group definition to add Google URLs to.

   If you want to add URLs to an existing Google group, go to the next step.

3. Go to Hosts and services > FQDN host, and click Add.

4. Create a host for each of the following FQDNs:

   1. *.play.googlezip.net
   2. *.gvt1.com
   3. *.app-measurement.com
   4. Your local Google domain, for example *.google.co.uk

   Note

   Make sure you select the FQDN host group you created in the earlier steps for the URLs to be added directly to the group.

Create a Wi-Fi network for mobile devices

Create a wireless network just for your mobile devices.

If you wish to allow mobile devices access on your corporate Wi-Fi network, you can skip the network creation, create the SSL/TLS inspection rule, and apply that to your corporate Wi-Fi.

1. Go to Wireless > Wireless networks and click Add.

2. Enter the details of the Wi-Fi network you want to use for mobile devices to connect to. An example configuration is shown in the below image:

   

3. Click Save.

4. Go to Hosts and services > IP host and click Add.
5. Enter a name.
6. Set IP version to IPv4.
7. Set Type to Network.

8. Enter the network IP address and subnet mask for the wireless network you created earlier.
   An example of the IP host settings is shown in the below screenshot:

   

9. Click Save.

Create an SSL/TLS inspection rule

Create an SSL/TLS inspection rule specifying no decryption for the Google domains.

1. Go to Rules and policies > SSL/TLS inspection rules, and click Add.
2. Select Don't decrypt for Action.
3. Set Decryption profile to Maximum compatibility.
4. Select Wi-Fi as Source zones.
5. Select the wireless network IP host definition you created earlier for Source networks and devices.
6. Select WAN for Destination zones.
7. Select the Google IP host groups for Destination networks.

8. Click Save.
   An example of the SSL/TLS inspection rule is shown in the below screenshot: