Allowing ms-update on app-default, File blocking PE and therefore no windows updates

[drewdown]

Me again and file blocking per PA best practice (PE, multi-level, etc..) and allowing ms-update on application default.  However the WSUS server is not able to download any updates and its classifying a PE file as a threat.  The file in question is am_delta_patch_1.249.1313.0_52b04aae0eb450654fc89884b43d10b7ed5 and threat-id is 52060 but nothing matches in the Threat Vault.  
 
Do I need a specific rule allowing windows updates that specifically allows PE files?  

[BPry]

@drewdown,

On the WSUS server you'll need to allow PE downloads, Once you have a policy allowing the WSUS server to actually download the PE files you should be good to go. 

[drewdown]

What the easiest way to do that for all users, ms websites and whatever relevant file types?  I read an old article about PA and MS-updates but I don't want to block web browsing.   

https://live.paloaltonetworks.com/t5/Configuration-Articles/How-to-Block-Web-Browsing-while-Allowing...

[BPry]

@drewdown,

Is your WSUS server in the same zone as your clients? 

[drewdown]

Yes.

[BPry]

@drewdown,

You really shouldn't have to worry about it then as the traffic wouldn't pass through your firewall so your File-Blocking profiles wouldn't effect anything. Allowing the WSUS server to go out and grab the updates should be the only step you need to take at that point. 

[drewdown]

---

@BPry wrote:

@drewdown,

You really shouldn't have to worry about it then as the traffic wouldn't pass through your firewall so your File-Blocking profiles wouldn't effect anything. Allowing the WSUS server to go out and grab the updates should be the only step you need to take at that point. 

---

It would if the machines weren't part of the domain (we have both domain and non-domain windows) and thus not getting updates from WSUS.   Therefore I need to make sure its allowed through.  To get it working until I (or PA support) can figure it out I just allowed PE files but that brings me to my next point which would fix this issue anyways.  Albeit not in any way shape or form that I would prefer it to be done.    

Another issue today with downloading large files from the internet and having any profile applied to the matching policy causes them to slow to a crawl or stop completely.  The only way I can make it so the files complete is by having 0 profiles applied to the rule.  PA don't know why its doing it and don't know when they can get a resolution to me because they are 'busy with other cases.'  Still haven't heard back from imaps case which I opened on 8/21 (status says researching) although you guys helped me fix that one.  

[Remo · Accepted solution]

1. Create a custom url category with the following entries: *.update.microsoft.com, *.windowsupdates.microsoft.com, *.windowsupdate.com, windowsupdates.microsoft.com
2. Create a new security policy rule and attach the custom url category from step 1 directly to this policy in the url category column
3. Attach the security profiles you want to this rule but other than your normal internet access rule, allow pe files here
4. (If you decrypt tls traffic) create decryption exclusion rule where you use the same custom url category from step 1

[BPry]

@drewdown,

Out of curiosity what PAN-OS version are you running? 8.0.4? 

[drewdown]

@Remo  Thanks.  Couple questions though,  I created the URL category already and allowed all of those, do I need to block everything else?  Do I need to allow the app-ids or just leave it any/any?

@BPry 8.0.2

[Remo]

In my rule I use web-browsing, ssl and ms-update. What exatly do you mean with "block everything else"?

If you added the custom category into the security policy as described, traffic will only match that rule for these URL's and nothing else.

[drewdown]

I was confusing URL filter with URL category.   Do you do any file blocking with this specific rule? 

Will give it a try.  

[Remo]

No, in this case I have set the fileblocking to log all

[Remo]

Not relevant in this topic, but if you ONLY want to allow windows updates and deny everything else towards the internet, you have to add crl.microsoft.com and www.microsoft.com as microsoft hosts two CRLs there. 

--> do not add *.microsoft.com to your custom url category as this will also allow the "customer experience" microsoft analysis service/spyware to send out data...

[HEscobar]

I have a specific rule for the wsus server to only connect to Microsoft for Windows updates (Just like the one recommend here).   The issue I have encounter so far is that it only downloads the definitions but won't download the actual update when I approve the KB.  Is there a specific URL where it downloads the update. I added all the URLs Microsoft recommends to the allowlist.