05-08-2017 04:51 AM - edited 05-08-2017 04:52 AM
After spending several hours to analyze the behaviour, trying to replicate the issue and so on I can finally say that is is really tricky to handle.
Indeed, it involves both HTTP and HTTPS traffic, and I'm pretty sure there are very tight links with MS updates, since along with all replications of the issue I could see HTTP GET request to www.download.windowsupdate.com (User-Agent: Microsoft-CryptoAPI/6.1)
I tried to define custom apps for Adobe requests and MSupdate requests (based on the User Agent) but it still didn't work.
Finally I opened all tcp 80 / 443 for the users, allowing the updates to achieve and then deletes the rule and that did the trick.
To summarize : it would be really helpfull if PaloAlto could release an efficient contend-id signature for all these Adobe Creative Cloud related traffic...
