topic Re: Windows update URLs with IP addresses show up as unknown in General Topics

Windows update URLs with IP addresses show up as unknown

ortmannteam — Fri, 08 Dec 2023 10:21:06 GMT

Hi, we have set our PA-440 (PAN-OS 10.1) to block all unknown URLs, which works amazingly well. However, I am seeing more and more URLs getting blocked which are probably for Windows updates that contain an IP address like

151.139.87.98/phf/c/doc/ph/prod5/msdownload/update/software/defu/2023/12/1024/am_delta_patch_1.403.99.0_ccea2ad383853e202858ba597af0a5ad45ceba41.exe.json?cacheHostOrigin=download.windowsupdate.com

This IP address is owned by StackPath, probably a CDN for Microsoft.

Are you seeing this too? What's the smartest way of dealing with this?

Cheers,

Andy Lietz, OrtmannTeam GmbH, Munich, Germany

Re: Windows update URLs with IP addresses show up as unknown

A_Astardzhiev — Fri, 08 Dec 2023 12:37:01 GMT

Hi @ortmannteam ,

Based on my experience even if this is CDN for Microsoft update, I would expect to see a hostname/domain and not URL request to specific IP address.

I don't see such behaviour, but according to other vendor it seems this is something new

I would recommend to submit the whole URL you detect to PAN for recategorization

https://urlfiltering.paloaltonetworks.com/query/ - check the verdict and then select Request Change

Re: Windows update URLs with IP addresses show up as unknown

OtakarKlier — Fri, 08 Dec 2023 20:46:28 GMT

Hello,

We also see this as MS spreads their updates all over. Just make sure you are allowing the following:

https://live.paloaltonetworks.com/t5/vm-series-in-the-private-cloud/allow-to-update-windows/td-p/557980

If one is blocked Windows tries a different one.

Regards,

Re: Windows update URLs with IP addresses show up as unknown

ortmannteam — Mon, 11 Dec 2023 08:44:29 GMT

Hi @OtakarKlier, thanks for pointing out the Windows update URL list for me. I've allowed those and will see whether Windows still uses addresses with IPs for its upgrades.

Re: Windows update URLs with IP addresses show up as unknown

Retired Member — Thu, 14 Dec 2023 22:08:15 GMT

thank you this was helpful!