The mailing list for users of the eduroam Configuration Assistant Tool (CAT)

[Stefan Winter <address@concealed>]

Hello,

> I encounter some issues with eduroam CAT.
> 
> We have our firewall configured according the rules as described below
> (text form webpage ‘About eduroam CAT’).
> 
> But I cannot contact the Google playstore with this ruleset.
> 
> When we configure the firewall so that clients on the ‘onboarding
> network’ / ‘setup SSID’ can connect to whatever site and log the
> connections that are made, we see a lot of different/other connections.
> 
> So it looks like the ruleset as described on cat.eduroam.org is not
> valid /complete any more.
> 
> Is this a possibility?

It is of course not impossible :-)

You are however the first to raise such an issue, and many sites are
using onboarding networks and work with this ruleset.

The best approach is probably to place a device into the onboarding
network and take a close look at the rejected connection attempts at the
firewall. If there are any pertaining to a Google address, that's
probably it.

Or maybe someone at the list knows how to find Google's official page on
required-open firewall destinations for Google Play to work?

To be honest, if such a list exists, I'd rather include that one instead
of the list we compiled into the "About" UI.

Greetings,

Stefan Winter

> 
>  
> 
> REQUIRED
> 
> cat.eduroam.org (the service itself)
> 
> crl3.digicert.com, crl4.digicert.com (the CRL Distribution Points for
> the site certificate), also TCP/80
> 
> ocsp.digicert.com (the OCSP Responder for the site certificate), also TCP/80
> 
> android.l.google.com (Google Play access for Android App)
> 
> android.clients.google.com (Google Play access for Android App)
> 
> play.google.com (Google Play access for Android App)
> 
> ggpht.com (Google Play access for Android App)
> 
>  
> 
> RECOMMENDED for full Google Play functionality (otherwise, Play Store
> will look broken to users and/or some non-vital functionality will not
> be available)
> 
> photos-ugc.l.google.com
> 
> googleusercontent.com
> 
> ajax.googleapis.com
> 
> play.google-apis.com
> 
> googleapis.l.google.com
> 
> apis.google.com
> 
> gstatic.com
> 
> www.google-analytics.com
> 
> wallet.google.com
> 
> plus.google.com
> 
> checkout.google.com
> 
> *.gvt1.com
> 
>  
> 
> Kind regards,
> 
>  
> 
> Patrick Renkens | ICT Servicecentre (ISC) | Network dept.| Radboud
> University
> 
> Geert Grooteplein 41 | 6525 GA NIjmegen | +31 24 361 7800 | www.ru.nl/isc
> 
>  
> 
> To unsubscribe, send this message:
> mailto:address@concealed?subject=unsubscribe%20cat-users
> Or use the following link:
> https://lists.geant.org/sympa/sigrequest/cat-users


-- 
Stefan WINTER
Ingenieur de Recherche
Fondation RESTENA - Réseau Téléinformatique de l'Education Nationale et
de la Recherche
2, avenue de l'Université
L-4365 Esch-sur-Alzette

Tel: +352 424409 1
Fax: +352 422473

PGP key updated to 4096 Bit RSA - I will encrypt all mails if the
recipient's key is known to me

http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xC0DE6A358A39DC66

Attachment: 0xC0DE6A358A39DC66.asc
Description: application/pgp-keys

Attachment: signature.asc
Description: OpenPGP digital signature