IP range for Win update servers?

[Guest]

What IP addresses must I allow access to so that clients behind the firewall
can access all windows update servers?

 

[Torgeir Bakken \(MVP\)]

What IP addresses must I allow access to so that clients
behind the firewall can access all windows update servers?

Hi

Take a look at the post in the link below on how to configure
Norton Firewall to let Windows Updates through:

http://groups.google.co.uk/[email protected]

Essensially:

Permit communications with

download.windowsupdate.com
v5.windowsupdate.microsoft.com

on ports 80 and 443 (TCP and UDP)

 

[Guest]

Thanks for the info but I was really needing IP addresses (or range(s)) for
my firewall. Those DNS names reflect multiple IP addresses.

 

[Guest]

Thanks for the info but I was needing IP addresses (or range(s)) for my
firewall. Those DNS names translate to multiple IP addresses.

 

[Colin Nash [MVP]]

Thanks for the info but I was needing IP addresses (or range(s)) for my
firewall. Those DNS names translate to multiple IP addresses.

That's because Microsoft uses some 3rd party 'load balancing' companies that
have servers all over the place, on multiple subnets. It's to minimize
spikes due to popular downloads or DDoS attacks. I guess you could put in
every IP that currently resolves to those DNS names, but of course this
could change on a regular basis and it's possible that these hosting
companies don't even notify Microsoft (since Microsoft has contracted it
out.)

One idea for you is to deploy SUS... which basically lets you have your own
Windows Update Server (while also giving you some control over which patches
get deployed.) Of course, your SUS server would need to be able to talk to
the Microsoft servers but you could just stick that box in a DMZ.

 

[Colin Nash [MVP]]

One idea for you is to deploy SUS...

Sorry... meant to include this URL for info about SUS:
http://www.microsoft.com/windowsserversystem/sus/default.mspx