topic Windows Update Traffic (ms-update) being recognized as web-browsing in General Topics

Windows Update Traffic (ms-update) being recognized as web-browsing

sgoethals — Wed, 29 May 2019 11:22:01 GMT

Hi Everyone,

I have an issue that I haven't been able to resolve. I have a small domain setup with a Windows Server Update Service that is located in a DMZ. The machinges that are in the inside network (trusted), are setup to pull their Windows updates from the server in the DMZ. I have setup Group Policy to make this happend, and it works fine for all of my servers.

The issue is that I have a Windows 10 machine that refuses to connect to the WSUS server. The same group policy is applied and when I look at Monitor, I can see attempts to connect to the server over port 8530 ( Default Port), but the traffic is identified at web-browsing instead of ms-update.

Since 8530 isn't a standard port for web-browsing, the traffic isn't allowed. I know I could always setup an application override, but I shouldn't have to. I cannot figure out why this particular machines traffic is recognized as web-browsing instead of ms-update.

If anyone has any suggestions, I would like to hear them.

Thanks

Re: Windows Update Traffic (ms-update) being recognized as web-browsing

OtakarKlier — Fri, 31 May 2019 14:22:49 GMT

Hello,

The PAN takes time to identify traffic, unfortuantly its getting blocked prior to being inspected properly. Just create a new policy that allows web-browsing and ssl. Then set the services to http, https, and create a custom service for 8530-tcp.

Hope that makes sense.

Re: Windows Update Traffic (ms-update) being recognized as web-browsing

sgoethals — Sun, 02 Jun 2019 14:42:38 GMT

Thanks for the reply.

I ended up opening a case with support regarding this. I sent them some packet captures, and they were able to replicate my issue.

They are going to relay this information to their content team and have the signatures updated from ms-update.

Re: Windows Update Traffic (ms-update) being recognized as web-browsing

Lavanya — Fri, 18 Oct 2019 12:31:20 GMT

Hello,

Did support fix this issue? I have same issue too, where ms-update traffic is categorized as web-browsing and being denied. Please let me know.

Thanks!

Re: Windows Update Traffic (ms-update) being recognized as web-browsing

sgoethals — Sun, 20 Oct 2019 09:24:02 GMT

I did work with support on this, and they did find that they were identifying the traffic incorrectly. They made a change and released it as a part of their weekly content updates. Since doing this, I haven't had an issue.

Re: Windows Update Traffic (ms-update) being recognized as web-browsing

Han.Valk — Fri, 20 May 2022 08:51:18 GMT

Hi Everybody,

This issue poped-up in my case as well. It was working before so I opened a case with support.

Solution from the engineer was to configure "Any" as the service.

Regards.