Apple iOS downloads classified as HTTP

Overview

Traffic which should be classified as iOS OS Update is appearing as HTTP instead. This problem can be viewed in Monitor > Real Time.

Cause

If there is already an application object setup for iOS updates, then this is caused by the Layer 7 signature not working correctly.

By default, here is how the application with this signature is setup:

Workaround

Since the signature is not working properly, a workaround would be to setup the application differently. Find out the IP addresses which are used for IOS updates, and create a network object with those IPs included. You can then modify the application to be based off of that network object.

Resolution

Starting in ExOS 6.4.7 and 7.0.3, the Layer 7 signature for iOS updates works properly. Updating to this firmware should resolve the issue.