Mobile Device managers

I am implementing the Meraki MDM for my Ipads.
These are the ports I have opened.. and the hosts that I need to have connect too.. Systems Manager

Clients using Meraki Systems Manager initiate outbound management connections to the Meraki cloud using the following addresses and ports:

Mac/Windows

64.156.192.220, 64.156.192.221, 74.50.63.14, 74.50.63.8, *.amazon.com - TCP ports 80, 443, 993, 60000-61000 iOS

64.156.192.220, 74.50.63.14, 50.18.152.159 - TCP port 443
* - TCP ports 2195, 2196, 5223

Android

64.156.192.220, 74.50.63.14 - TCP port 443
* - TCP port 5228


Heres the problem.. I can get the iPad (from internal network) to phone home, enroll itself in the MDM, but the MDM cannot access the iPad (on the internal network) once it is enrolled.

I have looked at the firewall log.. can cannot see anything being denied from the inside to the outside, and nothing denied on those ports to the inside.

any ideas would help..

thanks