iPad's try to download full iOS instead of just update while Forticlient is installed?

[kkowalsky]

This is a weird one. When Forticlient is installed on an iPad, the current update filesize is 12.16Gb. When Forticlient is uninstalled, the iPad only tries to download 3.6Gb.

I'm assuming that what's happening is, for some reason, Forticlient changes whether the iPad can use the full update or just the incremental update, but I have no clue as to why that would be the case.

Has anyone run into this before?

[anperz]

It sounds like FortiClient is breaking the "Byte-Range Requests" required for the delta update.

Here is what is likely happening:

Incremental updates (the 3.6GB version) rely on specific HTTP headers to download just the changed data. If FortiClient’s Web Filter or SSL Inspection modifies these headers or interrupts the handshake, iOS cannot validate the integrity of the partial download. As a security failsafe, the iPad defaults to the full system image (the 12GB file) because it is safer and easier to verify than a potentially corrupted partial file.

You likely need to exempt Apple update domains (like mesu.apple.com and appldnld.apple.com) from SSL inspection and Web Filtering within your FortiClient profile or EMS policy.

Hope that helps!