allowing MS product activation and denying web access

[kjh]

I have a network that I want to allow MS product activation to work but web browsing and other internet activity to be denied.

I have two main security policies that apply just to this network although DNS and ntp is also allowed:

The first one is an application filter that allows all applications you get when you click on "software-updates".  And the port set is "application default".

The second rule is a deny all.

As I see it this should allow ms-product-activation but it doesn't.  Do I need a separate rule with just ms-product-activation.  Do I need to add any other applications to the rule to make it work?  For instance, say web-browsing and https and ports 80 and 443.  This would unfortunately allow web-browsing which I want to deny. 

[dieter_b]

In my experience, PA is not able to recognize MS product activation traffic reliably.

Sometimes it is recognized correctly, but most of the time PA recognizes it as ms-update or even web-browsing.

Doesn't help either that MS is secretive about the whole activation process, would be a lot easier if it were one type of traffic (for all MS products) and/or to fixed known destinations (subnets).

Maybe you're better of with a local KMS...

[mikand]

There is a list available at:

http://support.microsoft.com/kb/921471

one url not mentioned there seems to be:

wpa.one.microsoft.com:80

dunno if the above wpa url is still valid as part of the activation or not.

I guess the best would be if you could setup a local auth server for this and then just allow this particular server to reach microsoft's domains.

[GoranBerglund]

Hi. We used the application  ms-product-activation with good results. ( so no ssl only ms-product-activation )