Setting Ip filters to grant only windows update

Hi all,
one of my servers host Windows System Update Service + Windows Sharepoint
Services + symantec server. I want to reject all IP conections except my
local IP subnet + windows update servers + symantec update servers.
It seems that windows update servers IP are not stables (dynamic A class
change between two pings for Downloads.windowsupdate.com). How can I solve
that problem ?

I did not investigate yet Symantec liveUpdate servers but if anyone has
already do it )

thanks

Eddie,
You can close off all incoming network traffic except your local subnets as
windows and Symantec update services use HTTP established by your server. Out
going connections only.

"Eddie Iannuccelli" wrote:

> Hi all,
> one of my servers host Windows System Update Service + Windows Sharepoint
> Services + symantec server. I want to reject all IP conections except my
> local IP subnet + windows update servers + symantec update servers.
> It seems that windows update servers IP are not stables (dynamic A class
> change between two pings for Downloads.windowsupdate.com). How can I solve
> that problem ?
>
> I did not investigate yet Symantec liveUpdate servers but if anyone has
> already do it )
>
> thanks

I am trying to do that using local IP policy (not a firewall) and I currently :
-reject all traffic (incoming and outgoing) by setting default filter to
reject action
-accept my subnet traffic with mirroring

This work fine but server cant reach windows update by example, so I add a
rule that :
-accept all traffic from myIP to anyIP with no mirroring
but my server still cannot reach windowsupdate throug IE.

What's wrong ?


"Wendel Hamilton" wrote:

> Eddie,
> You can close off all incoming network traffic except your local subnets as
> windows and Symantec update services use HTTP established by your server. Out
> going connections only.
>
> "Eddie Iannuccelli" wrote:
>
> > Hi all,
> > one of my servers host Windows System Update Service + Windows Sharepoint
> > Services + symantec server. I want to reject all IP conections except my
> > local IP subnet + windows update servers + symantec update servers.
> > It seems that windows update servers IP are not stables (dynamic A class
> > change between two pings for Downloads.windowsupdate.com). How can I solve
> > that problem ?
> >
> > I did not investigate yet Symantec liveUpdate servers but if anyone has
> > already do it )
> >
> > thanks