Windows Update - automatic policy without manual address definition

[jakub.kuchniak]

Hi,

is there a way on Palo Alto firewalls to allow Windows Update traffic without manually defining a list of addresses?

For example, is it possible to create a policy that automatically determines or updates the list of these addresses, without requiring manual administrator intervention?

I would appreciate any information on whether such solutions exist at all.

Best regards

[PavelK]

Hello @jakub.kuchniak

thanks for post!

You could try to create a security policy with app-id: "ms-update" to allow windows updates.

For reference, here are KB articles with instructions to allow allow Microsoft updates: How to Block Web Browsing while Allowing Microsoft Updates and to block them: How to block a Windows update (You can get required URLs from article to use them to allow traffic).

Kind Regards

Pavel