Some more informations would be helpful. Like ...
Since your configuration isn't the same between working and non-working units I would toss the fact that one of your sites is working out of the window. Troubleshoot the same way you would for anything else that is broken and ignore the working site all-together since they aren't actually the same (or at least, your comment makes them seem to not be the same).
Take a single "test" client that you can use at the non-working site and enable full logging for that client and take a packet capture of all of the traffic. When the update fails, review the firewall and the packet capture to identify what actually isn't being allowed to pass through the firewall. Chances are you'll see the traffic getting denied in your firewall logs and you won't have to go through the packet capture.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!