Windows update URLs with IP addresses show up as unknown

[ortmannteam]

Hi, we have set our PA-440 (PAN-OS 10.1) to block all unknown URLs, which works amazingly well. However, I am seeing more and more URLs getting blocked which are probably for Windows updates that contain an IP address like

151.139.87.98/phf/c/doc/ph/prod5/msdownload/update/software/defu/2023/12/1024/am_delta_patch_1.403.99.0_ccea2ad383853e202858ba597af0a5ad45ceba41.exe.json?cacheHostOrigin=download.windowsupdate.com

This IP address is owned by StackPath, probably a CDN for Microsoft.

Are you seeing this too? What's the smartest way of dealing with this?

Cheers,

    Andy Lietz, OrtmannTeam GmbH, Munich, Germany

[aleksandar.astardzhiev]

Hi @ortmannteam ,

Based on my experience even if this is CDN for Microsoft update, I would expect to see a hostname/domain and not URL request to specific IP address.

I don't see such behaviour, but according to other vendor it seems this is something new

I would recommend to submit the whole URL you detect to PAN   for recategorization

https://urlfiltering.paloaltonetworks.com/query/ - check the verdict and then select Request Change

[OtakarKlier · Accepted solution]

Hello,

We also see this as MS spreads their updates all over. Just make sure you are allowing the following:

https://live.paloaltonetworks.com/t5/vm-series-in-the-private-cloud/allow-to-update-windows/td-p/557...

If one is blocked Windows tries a different one.

Regards,

[ortmannteam]

Hi @OtakarKlier, thanks for pointing out the Windows update URL list for me. I've allowed those and will see whether Windows still uses addresses with IPs for its upgrades.

[Retired Member]

thank you this was helpful!