Map failed to Load - iOS 7 - Cisco AnyConnect VPN

[KristianVerlinna]

Hi

We are using a MDM (Citrix XenMobile MDM) solution to push out the ArcGis iOS app and a Per-App-VPN Policy.
When starting up the ArcGIS app, VPN automatically starts in the background.

But ArcGIS displays error "Map Failed to Load - The map failed to load. Please check your network connection and try again".
When pressing "Try Again" "Configuration Error - Cannot access ArcGIS Portal".

No problem browsing to our ArcGis portal in Safari.

Any idea where we should focus our troubleshooting?

[KristianVerlinna]

Tried without the Per-App-VPN app attribute (on-demand VPN linked with the app id). And it works.
But we want it to work with this attribute. Is this a bug in the app?

The Policy and App Attribute info:
http://support.citrix.com/proddocs/topic/xenmobile-87/xmob-dm-manage-create-per-app-vpn.html
http://support.citrix.com/proddocs/topic/xenmobile-87/xmob-dm-manage-create-app-attributes-profile-t...

[SuganyaBaskaran1]

Can you try loading some other SDK object on the app - perhaps load a web map or a feature layer that's on your internal network on the app and see if that works? That might help narrow the issue.

[NCSTATE_CPC]

 Kristian Verlinna‌, Were you ever able to resolve this issue you had a few years ago? I am currently having a similar issue with Citrix VPN and ArcGIS Collector. I can access the portal and sign in and view maps but upon loading a map layers fail to load and result with an error message stating

Layer Not Loaded

Unable to load layer "World Imagery" from services.arcgisonline.com

The request timed out.

I have tested opening maps that do not contain any services from my portal and only a basemap from ESRI with the same error regardless of the map.

[ZoltanKelly1]

Hi Charlie Charping, Kristian Verlinna, did you ever overcome this? we're facing an identical issue trying to use Citrix MDM VPN with Esri mobile apps (Collector/Explorer). Configured with per-app VPN, I can connect to our Portal and use a map with only internal services; but any connection to basemaps from arcgisonline.com just times out. Shows 500 errors in logs.

While connected to VPN we also can't even log onto ArcGIS Online either (instead of Portal) - timeout error also.

Configured with iOS 13 and Portal 10.7.1, using Citrix MDM (Secure Hub + SSO app). 

[Nicholas-Furness]

Certainly sounds like your per-app VPN is not configured to allow access to certain ArcGIS Online domains. Your VPN config could either whitelist the domains through the VPN or could be configured to bypass VPN entirely for those domains.

Perhaps this document can help? https://downloads.esri.com/resources/enterprisegis/AGOL_Domain_Requirements.pdf 

[ZoltanKelly1]

Thanks Nick. Leaving a couple comments below for the next poor soul who comes along with the same issue from Google, apologies for wall of text

I agree, it's has to be something on Citrix side, however all the MDM solutions on iOS have limited configuration options available, and Esri apps (apparently) follow standard AppConfig rules.

I have already sent the above + the FQDN list from the Esri Trust site to the network team, who are currently crawling through logs with Citrix support. i'll update this if something comes of it.

Esri support have advised it's a network thing (which I understand), and as Citrix don't know Esri product specifically, they have no idea. These issues are always difficult to get resolved.

One poorly documented requirement is to add the the Enterprise Portal domain to the per-app config as a Safari Domain, or from 10.6 the login popup can't be accessed (as that's a Safari window). this is only referenced in the Navigator documentation and not for any other apps (Collector, Explorer, QuickConnect).

https://doc.arcgis.com/en/navigator/iphone/help/deploy.htm

What a Safari Domain does is tunnel the whole safari app after that is triggered (until whenever your VPN is set to disconnect), which isn't ideal but we can live with. This can be seen as I can :
- log into Esri app > Enterprise Portal > triggering the Safari Domain rule set on that portal domain

- then open up the actual Safari browser app, which shows VPN connection in the corner. Also verified as I can access our intranet sites, and shows in VPN + iOS Fiddler logs

- Until the VPN session times out, via Safari I can access ArcGIS Online fine and login, and view basemaps (and also Portal).

So agreed is definitely some app-level config issue, however there's limited 'spots' in the Citrix config to put the whitelisting for all the AGOL service URLs.