too much download-sites

hy everybody

we have the following problem with the windows update service

we have our hosts behind the firewall and try to make the fw as much secure
as possible. because of that issue we also tried to allow the hosts just to
windowsupdate.microsoft.com with port 80. of course, that doesn´t work. now
we decided to allow everything to the whole microsoft-subnet. but the
problem is that microsoft has the most of it´s downloads on completly
different servers. like 200.61.45.133 or 195.176.255.143 and so on.

in my opinion it´s impossible to enable all this sites because i think they
are really dynamic. is there a way to point the updates to just one or two
servers so it is possible to enable such rules on the fw?

SUS is no alternative for it

thanks for all tips

kind regards
Hans

Hans,

You also need to enable port 443 to be able to access WU.


MowGreen [MVP]
===============
*-343-* FDNY
Never Forgotten
===============


Hans Moser wrote:

> hy everybody
>
> we have the following problem with the windows update service
>
> we have our hosts behind the firewall and try to make the fw as much secure
> as possible. because of that issue we also tried to allow the hosts just to
> windowsupdate.microsoft.com with port 80. of course, that doesn´t work. now
> we decided to allow everything to the whole microsoft-subnet. but the
> problem is that microsoft has the most of it´s downloads on completly
> different servers. like 200.61.45.133 or 195.176.255.143 and so on.
>
> in my opinion it´s impossible to enable all this sites because i think they
> are really dynamic. is there a way to point the updates to just one or two
> servers so it is possible to enable such rules on the fw?
>
> SUS is no alternative for it
>
> thanks for all tips
>
> kind regards
> Hans
>
>

> You also need to enable port 443 to be able to access WU.

i can´t believe you because i´ve currently just port 80 to all
destinations open and WU works fine.

maybe MS has a mechanism implemented which check if HTTPS is available,
otherwise WU works over HTTP??

but it doesn´t matter either if tcp/80 or tcp/443 is used, the bigger
problem is that the use a lot of different hosts do download the packages.

kind regards
Hans