Wireless Access

Good day community, I am busy implementing a warehouse solution using Zebra Android devices. The device access is locked down tightly to only the specific internet sites it needs to connect to for the warehouse functions. The challenge we have is that we want to use the built-in Android connectivity check feature to switch over to mobile data if the primary internet is not available. The challenge we have is that due to the level of internet lockdown we have to allow only the services that perform internet connectivity check to pass the firewall. I have added the domains, connectivitycheck.gstatic.com and clients3.google.com to be allowed, but the device still shows no internet access. If I open the access it works and i do not see any other traffic when looking at the flows from the device. Is there other domain or services that needs to be allowed for this to work? I have attached a screenshot of my test iAP ACL

I would capture the client traffic and see what is blocked.

A good reference would be this ClearPass Onboard whitelist, that allows the minimal Android access and access to Google Play. If that works, and you don't want Google Play access, you may start stripping out rules until you see that the issue comes back.