ITunes behind an ISA 2004 Firewall

Question

Since upgrading to iTunes 6.0, I can no longer access the Music Store or any of the streaming radio stations. Installation went fine.
When attempting to go to Music Store, I get the following error: iTunes could not connect to the Music Store. "An unknown error occurred (502). Make sure your network connection is active and try again."
Seems that something has changed in the 6.0 release, thus causing me to have to reconfigure my ISA 2004 Enterprise firewall rules.
I currently allow the following outbound TCP ports:
3689
42000-42999
8000-8999
9022
What's changed, and does anyone else run ISA 2004 and iTunes successfully?
I understand that there may be some proxy settings in QT that get picked up and used by iTunes? Can anyone clairify?

Answer 1

hi Ashley!
Only problem: I'm not using the Firewall Client -- I'm doing all access via the web proxy.
hmmm. i've seen some versions of this caused when servers on a network aren't exempting the following domains:
phobos.apple.com
phobos.apple.com.edgesuite.net
the following text is from a post by Robert Eckdale:
I wanted to share my experience with connectivity issues to the iTunes Music Store. I am including some background info in this post... so it's admittedly a bit long-winded.
Users on my network were receiving the following error when attempting to connect to the iTunes Music Store (IMS):
"We could not complete your Music Store Request. An unknown error occured (502).
There was an error in the Music Store. Please try again later."
At first it seemed likely this was an IMS service outage, and given that IMS isn't a business critical app, I set it aside for a couple of days. When the issue still existed 3 days later it became apparent this was likely related to our firewall security configuration.
I performed a packet capture on a workstation while iTunes attempted to connect to IMS. Sure enough the results indicated that the request was rejected by the firewall's HTTP filter.
The firewall/proxy being used is Microsoft Internet Security and Acceleration Server 2004. (ISA 2004) One of the benefits of ISA is its advanced application-layer security. I won't get into the details, but if you want more info a good place to start would be http://www.microsoft.com/isaserver.
The next thing to determine was the specifics of the HTTP request and the cause for rejection. On the ISA server I setup a logging query that monitored live traffic from my test workstation for connections denied due to various HTTP filter values. The query indicated that the request was being denied because the HTTP traffic was encoded, thus not allowing the traffic to be inspected. Not sure why Apple is encoding HTTP traffic, but that’s another discussion.
So the solution: (It’s about time…right?) On the ISA server I created the following Domain Name Set:
Name: iTunes Music Store
Domain names included in this set: *.phobos.apple.com and *.phobos.apple.com.edgesuite.net.
I then created an Access Rule with the following properties:
Action: Allow
Protocols: HTTP (Disabled the Web Proxy application filter.)
Source: Workstations (This is just a group of IP’s used by our workstations)
Destination: iTunes Music Store (The Domain Name Set I created earlier)
I placed this new access rule “above” the default HTTP rule used by our workstations. This results in the new rule being processed first. So, if a workstation makes an HTTP request, the ISA server determines if its destination is to either of the domains used by IMS. If it is, the request is allowed and no application layer filtering is applied. If the destination of the request is not to either of the IMS domains, it is allowed but HTTP application layer filtering is applied.
There might be better ways to do this, but it seems like an acceptable solution. The security trade-off is that if there were an HTTP exploit used at either of those IMS domains my users would not be protected.
Eckdale post ends
love, b