Server behind TMG to grab updates from WSUS server

-

hey guys,

the last topic created grab superseeded updates wsus, stil cause can't accept installing updates manually answer. went ahead did more research on this.

to keep simple went ahead , adjusted local group policy / computer conf / admin templates / windows comp / windows update / specify intranet microsoft update server (http://172.16.3.3:8530)

allowed rule through tmg allow directional traffic of tcp 8530 between server lan (172.16.8.x <-> 172.16.3.3)

when click check updates can see established connection using netstat on port 8530.
click download updates, tries grab internet based servers... can see syn_sent right away , can see blocked http traffic on tmg.

so went ahead , set gpo setting , removed port allocation behind (http://172.16.3.3) doing netstat after clicking check updates showed connection attempt 172.16.3.3 via http, added protocol allow rule between servers, , sure enough changed established, , see allow through tmg. gives error when click on check updates...

there has way me dang server updates our wsus server on other side of tmg firewall.. how?! doing wrong?!

*note* port specified in local gpo of 8530, can access http://wsus/selfupdate/wuident.cab fine. ran wuauclt /detectnow , no errors reported in windowsupdate.log file

*note* wsus server setup cache update local dir, attempted see files in there contained random string .cab files, wish contain kbnumber , msu files easier verification of updates available in cache.


the last topic created grab superseeded updates wsus, stil

a link post helpful absolutely clueless post about.

allowed rule through tmg allow directional traffic of tcp 8530 between server lan (172.16.8.x <-> 172.16.3.3)

the correct implementation tmg create web publishing rule wsus server , allow passthru of client identity.

when click check updates can see established connection using netstat on port 8530.
click download updates, tries grab internet based servers... can see syn_sent right away , can see blocked http traffic on tmg.

so went ahead , set gpo setting , removed port allocation behind (http://172.16.3.3) doing netstat after clicking check updates showed connection attempt 172.16.3.3 via http, added protocol allow rule between servers, , sure enough changed established, , see allow through tmg. gives error when click on check updates...

i see that you've specified private ip address target of wsus server (172.16.3.3), first set of questions revolves around why there's tmg server involved in first place, "wsus client" located respect tmg interfaces, , wsus server located respect tmg interfaces. maybe of in original post... wherever might be. i'm going assume you're *routing* traffic through tmg 1 private network private network, dmz wsus server in internal lan. (just educated guess.)

the second set of questions... 172.16.3.3 ip address of wsus server on internal lan, or address of dmz interface on tmg. configured correctly, should former.

third set of questions.... question ask because invariably sheds amazing insights other network issues.... why configuring policy ip address, rather hostname of wsus server?

there has way me dang server updates our wsus server on other side of tmg firewall.. how?!

properly configure web publishing rule. it's simple. have wsus server "published" dmz can patch dmz servers , works perfectly.

lawrence garvin, m.s., mcsa, mcitp:ea, mcdba
solarwinds head geek
microsoft mvp - software packaging, deployment & servicing (2005-2014)
mvp profile: http://mvp.microsoft.com/en-us/mvp/lawrence%20r%20garvin-32101
http://www.solarwinds.com/gotmicrosoft
the views expressed on post mine , not reflect views of solarwinds.



Windows Server  >  WSUS



Comments

Post a Comment

Popular posts from this blog

CRL Revocation always failed

-
hi all, i try configure radius server nps, somehow certificate authentication client failed with reason: reason = revocation function unable check revocation because revocation server offline. then check certificate client, certutil -f -urlfetch -verify client7.cer, result follow: issuer:     cn=entca     dc=intra     dc=domain     dc=co     dc=sg subject:     cn=computer.intra.domain.co.sg cert serial number: 1c5b00de000000000041 dwflags = ca_verify_flags_allow_untrusted_root (0x1) dwflags = ca_verify_flags_ignore_offline (0x2) dwflags = ca_verify_flags_full_chain_revocation (0x8) dwflags = ca_verify_flags_console_trace (0x20000000) dwflags = ca_verify_flags_dump_chain (0x40000000) chainflags = cert_chain_revocation_check_chain (0x20000000) hcce_local_machine cert_chain_policy_base -------- cert_chain_context -------- chaincontext.dwinfostatus = ce...
Read more

0x300000d errors in Microsoft Remote Desktop client

-
we use rd connect home users office. @ server side remote desktop gateway configured on 2008r2 server. experience following:   for years worked fine, starting last year users apple macbook experienced connection errors after new version of microsoft remote desktop in app store , automatic update. after couple of weeks error disappaered when new updates released. since 6 8 weeks problem again. because don’t have macbook cannot reproduce problem.   starting couple of weeks samsung s6 experiencing problems, here version 8.1.37.135 installed, error displayed is: can’t connect tot remote pc because remote desktop gateway server temporaraily unavailable. try connecting later or contact network administrator assistance. error code  0x300000d   because has worked fine years expect issues on client can configuration error on gateway server.   who pin point real cause?   however, testing other rd gateway server works ok settings identically....
Read more

Failed to query the results of bpa xpath

-
Image
i have new server installed hyper v, iis , domain services roles on it.  i checking event log , see warning multiple times, idea how rid of it?? failed query results of bpa xpath: microsoft/windows/fileservices:$reports$\*\result.xml:/resultdatabase/result. error: device attached system not functioning., last error: system cannot find path specified.. follow me on twitter <<< levalencia blog <<< hi, similar issue discussed in forum: to rid of warnings: 1. go dashboard 2. click on add roles , features 3. click next "before begin step" 4. select "role based or feature based installation" , click next 5. select given server server pool , click next 6. in server roles step make sure following checked:   file , storage services > file , iscsi services > file server, click next 7.click next through rest of steps , install server role 8. rerun bpa scan described earlier for more information please refer foll...
Read more