Can't Connect To Windows Update

[rotto841]

Hi everyone we've restricted our Windows domain controllers from accessing the internet and I've been a sked to allow Windows Update to function. I tried creating a rule with the windows update and update optimization applications with the source of our domain controllers to destination internet (DNS such is a different rule) but no dice. 

So I updated the rule and created a network group using this page from Microsoft and added http and https. Yet we still can't connect I just see random IP addresses from Microsoft dropping I know that checkpoints aren't great when it comes to resolving wildcard domain names.

Its unfortunate that more updateable objects are available for download in this situation but I'm kind of banging my head at this now and wanted to post something to see if anyone else had luck opening the  required URLs and such for Windows update to function. 

Thanks for reading.

[PhoneBoy]

Hi, couple comments:

1. FQDN Domain Objects won't work here since you need to resolve for all *.download.microsoft.com instead of just .download.microsoft.com.
2. Updatable Objects are dependent on the underlying vendor (in this case Microsoft) providing the relevant information in a programmatically readable way so it can be consumed by our gateways.
3. "Windows Update" and the services http/https are redundant insofar as they both include http/https.

You can include the relevant domains in a Custom Application/Site object, which will be used as a service.
This requires: R80.40+, Categorize HTTPS Inspection enabled (it is by default), and App Control.

[the_rock]

Easiest way I always found to fix this issue is add custom url filtering group with *microsoft* and *windowsupdate* in it and dont even bother with updatable objects. Push policy, problem solved.

Reap the benefits : - )

Andy

[momoo168]

Hi Rock,

I too have to disable an internet rule that will impact Windows updates. I need to find a solution to block all internet traffic and only allow Windows updates to continue.

When I tried to add the custom domain into the URL filtering, it kept saying the domain must start with a "."

Any pointers?

I'm new and learning.

Thanks,

[PhoneBoy]

A Domain object does not work in the way you are attempting to use it.
What we're discussing is a Custom Application/Sites object where this IS allowed.
However, doing it in a wildcard fashion like this will allow stuff you probably do not want to allow.

There are a couple of Updatable Objects that might be useful here:

• Microsoft Updates -- HTTPS Bypass
• Microsoft Updates -- SmartAccel

See: https://support.checkpoint.com/results/sk/sk131852 

[the_rock]

Forgot to say, this is important, you do need blades @PhoneBoy mentioned enabled on the gateway.

Andy

[spottex]

I thought I would add our issue and partial working fix for others that arrive here. Windows AD hosts would not connect to Win updates. At first it needed a DNS forwarder to a public DNS service, we used Cloudflare, and allow rules for DNS traffic to the forward IP.
After that there were still dropped destination IP's that were not covered in any MS IP lists we added. TCPdump of the hosts DNS queries , showed they were trying to check certs using OCSP at digicert so we allowed *.digicert.com. Once that was allowed there were still some of the same blocked IP's but traffic started flowing and updates finally downloaded.
There must be another Domain\URL that needs to be added for the other IP's because to test we added about 25 from MS documentation.

But then converted to using App Control with the new knowledge:
Access rules:
AD hosts > any > http and https > allow
AD host > Couldflare IP > dns (udp/tcp) > allow

App Control
AD hosts > Microsoft Updates - HTTPS bypass > http/https  > accept
AD hosts > couldflare IP > dns udp/tcp >  accept
AD hosts > .digicert.com (non-FQDN) > http/https  > accept
AD hosts > any >any > drop

HTTPs bypass outbound
AD hosts > Microsoft Updates - HTTPS bypass > https > bypass

Update: Well that didn't last long

After 3 more manual update attempts to see if it would fail, it failed again with a new set of IP addresses

Added random guessed updatable objects to App control: Akamai Services, Azure Update Delivery Public Services, Azure Device Update Public - Global Services, Microsoft Updates - Smart Accel. ..and started to work again. Lets see for how long 🙂