topic Re: Problem with Windows Update R80.20 in General Topics

Problem with Windows Update R80.20

Milos_Stanojevi — Thu, 24 Oct 2019 11:41:20 GMT

Hello,
we are having issues accessing Windows Update with HTTPs Inspection enabled (Check Point R80.20 ) and "Bypass HTTPS inspection of traffic to well-known software update services" option checked. We made a group with all the known Microsoft addresses:

The hosts are which also include some other Microsoft services:

ams15s32-in-f3\.1e100\.net
wdcp\.microsoft\.com
wns\.windows\.com
wdcpalt\.microsoft\.com
update\.microsoft\.com
download\.microsoft\.com
windowsupdate\.microsoft\.com
download\.windowsupdate\.com
wustat\.windows\.com
ntservicepack\.microsoft\.com
stats\.microsoft\.com
wns\.windows\.com
nexus\.officeapps\.live\.com
fe2\.update\.microsoft\.com
delivery\.mp\.microsoft\.com
vortex-win\.data\.microsoft\.com
cp601-prod\.do\.dsp\.mp\.microsoft\.com
geover-prod\.do\.dsp\.mp\.microsoft\.com
big\.telemetry\.microsoft\.com
ctldl\.windowsupdate\.com
audownload\.windowsupdate\.nsatc\.net
au\.download\.windowsupdate\.com\.hwcdn\.net
slscr\.update\.microsoft\.com
sfdataservice\.microsoft\.com
windowsupdate\.com
windows\.com
slscr\.update\.microsoft\.com
slscr\.update\.microosft\.com\.akadns\.net
v10\.events\.data\.microsoft\.com
v10\.event\.data\.microsoft\.com\.aria\.akadns\.net
onecollector\.cloudapp\.aria\.akadns\.net
fe2cr\.update\.microsoft\.com
fe2cr\.update\.microsoft\.com\.akadns\.net

and creating a bypass rule with all address. We did everything as in sk96125 - Windows Update fails through Security Gateway with enabled HTTPS Inspection.

And the update still doesn't work. When we turn off HTTPS inspection everything works fine.

Any advice ?

Thank you,

Miloš

Re: Problem with Windows Update R80.20

Nick_Doropoulos — Thu, 24 Oct 2019 14:54:37 GMT

Hey Milos,

Your issue appears to be very similar to the one found here:

https://community.checkpoint.com/t5/General-Management-Topics/Windows-Update-Services-with-HTTPS-inspection-enabled/m-p/62928

So, I think it's probably to do with the fact that Microsoft have changed their servers to support only ECDSA cipher suites which are not proposed by the firewall as default.

You might need to end up enabling ECDSA and update https_inspection_white_list.bin so contact Check Point TAC to get the solution.

I hope this helps.

Re: Problem with Windows Update R80.20

Ilya_Yusupov — Thu, 24 Oct 2019 16:26:38 GMT

Hi,

known issue just enable ECDSA will fix the problem.

Thanks,

Ilya

Re: Problem with Windows Update R80.20

Milos_Stanojevi — Fri, 25 Oct 2019 06:07:30 GMT

Thanks a lot . I'll try with enable ECDSA. 🙂