When an iPad is on your network, users may have issues accessing iTunes to download apps, as well as access the iCloud
Setup a rule in a Web Access Layer
For the Source you can leave it set to Any, or the IPs of your iPads, or the username or user-agent, if your iPads have been authenticated.
For the Destination
We need to allow Apples block of IPs, since Apple is a trusted company, allowing their block of IPs should not open any security issues. When requests for iCloud are made, requests are also sent to the Amazon Cloud, so need to allow that subnet as well.
Add the follow to the Destination:
Apples block of IPS--18.104.22.168/8
Set Action to Allow.
Once this is done, iPad users will be able to access iTunes and download apps as well as access iCloud for back-ups/restores.