05-29-2019 04:22 AM
Hi Everyone,
I have an issue that I haven't been able to resolve. I have a small domain setup with a Windows Server Update Service that is located in a DMZ. The machinges that are in the inside network (trusted), are setup to pull their Windows updates from the server in the DMZ. I have setup Group Policy to make this happend, and it works fine for all of my servers.
The issue is that I have a Windows 10 machine that refuses to connect to the WSUS server. The same group policy is applied and when I look at Monitor, I can see attempts to connect to the server over port 8530 ( Default Port), but the traffic is identified at web-browsing instead of ms-update.
Since 8530 isn't a standard port for web-browsing, the traffic isn't allowed. I know I could always setup an application override, but I shouldn't have to. I cannot figure out why this particular machines traffic is recognized as web-browsing instead of ms-update.
If anyone has any suggestions, I would like to hear them.
Thanks
06-02-2019 07:42 AM
Thanks for the reply.
I ended up opening a case with support regarding this. I sent them some packet captures, and they were able to replicate my issue.
They are going to relay this information to their content team and have the signatures updated from ms-update.
05-31-2019 07:22 AM
Hello,
The PAN takes time to identify traffic, unfortuantly its getting blocked prior to being inspected properly. Just create a new policy that allows web-browsing and ssl. Then set the services to http, https, and create a custom service for 8530-tcp.
Hope that makes sense.
06-02-2019 07:42 AM
Thanks for the reply.
I ended up opening a case with support regarding this. I sent them some packet captures, and they were able to replicate my issue.
They are going to relay this information to their content team and have the signatures updated from ms-update.
10-18-2019 05:31 AM
Hello,
Did support fix this issue? I have same issue too, where ms-update traffic is categorized as web-browsing and being denied. Please let me know.
Thanks!
10-20-2019 02:24 AM
I did work with support on this, and they did find that they were identifying the traffic incorrectly. They made a change and released it as a part of their weekly content updates. Since doing this, I haven't had an issue.
05-20-2022 01:51 AM
Hi Everybody,
This issue poped-up in my case as well. It was working before so I opened a case with support.
Solution from the engineer was to configure "Any" as the service.
Regards.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!
