Updating Antivirus and Windows on DMZ Servers

Posted on 2008-06-17
Last Modified: 2013-11-22
I curently have 3 servers that reside in the DMZ, an app. server, mail server, and web server. I use WSUS and CA Antivirus Console to manage updates to everything inside our secure network. I am looking for the best way to keep these servers up-to-date with antivirus and windows updates. I cannot use the same method used with the devices on the internal network because the DMZ servers are in a workgroup in Active Directory. Currently, the firewall is configured to block port 80 for added security, so these machines cannot get their own updates. I felt it was more secure to keep these machines from initiating any connections through port 80.
Is there any other way I can push updates to these servers from inside the secure network allowing them to be managed the same way the rest of our intranet is managed? I am of the opinion that opening port 80 is a last resort and there must be another means by which I can keep these servers up-to-date internally.
Question by:cford1973
  • 2
  • 2
LVL 51

Accepted Solution

Netman66 earned 500 total points
ID: 21818559
At some point, you are going to need port 80 open to get the updates from the Internet.  Unless you want to manually download them from the internal network then copy them to the DMZ.

You could setup WSUS in the DMZ and manually sync it on a fixed schedule.  During that time, you could open port 80 then close it again.  Honestly, creating an access rule for port 80 and 443 from the WSUS server to the 3 Microsoft sites should be fairly simple.  This would only let that one machine out and only to those sites.

Once this is configured you could let it manage itself.  You would need a registry mod to point all the DMZ equipment to the WSUS server, but that's simple enough.


Author Comment

ID: 21821728

Other than setting the WSUS server up in the DMZ, is there a way to point those DMZ servers back to our secure network to get antivirus and windows updates? However, at this point, I am unsure of what ports would be used and subsequently, what firewall rules would need to be changed to make that work.

I can re-open port 80 on the firewall, and allow it to obtain Windows updates from the Internet; however, I was hoping to use WSUS to maintain consistency and a standardized audit trail in my network. I recently found out that CA Antiviurs does not use Port 80 to retrieve updates from the Internet, so I am not as concerned about those updates.
LVL 51

Expert Comment

ID: 21822840
Not really, unless they are domain members.  Downlevel WSUS servers need to be part of the domain also - and that's not a good thing in the DMZ.

Creating rules from the WSUS server to Microsoft wouldn't be difficult.

I understand the need to stay consistent with the internal LAN - a HIPPA thing (my guess), but if you document the internal update approvals then following that script for the DMZ server shouldn't be difficult.  It's just another process.

I'm finding out for sure whether it's possible to chain a non-domain WSUS server to a domain WSUS server.  I need to know absolutely.

Author Closing Comment

ID: 31468032
Thanks for your response. I appreciate it. I have since opened Port 80; however, it is only to initiate an outbound connection, not to accept. Other than the options you mentioned, the only other solution I could come up with was a redistribution sever, and that was not a viable alternative for me.
Thanks again.

Featured Post

What is SQL Server and how does it work?

The purpose of this paper is to provide you background on SQL Server. It’s your self-study guide for learning fundamentals. It includes both the history of SQL and its technical basics. Concepts and definitions will form the solid foundation of your future DBA expertise.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
Turning off updates in Ubuntu 8 32
SMTP connect() failed - WordPress 6 50
Report to police 8 45
Password recovery or reset Windows 10 home Premium 8 49
Do you know what to look for when considering cloud computing? Should you hire someone or try to do it yourself? I'll be covering these questions and looking at the best options for you and your business.
No single Antivirus application (despite claims by manufacturers) will catch or protect you from all Virus / Malware or Spyware threats. That doesn't stop you from further protecting yourself however - and this article is to show you how.
Sending a Secure fax is easy with eFax Corporate ( First, Just open a new email message.  In the To field, type your recipient's fax number You can even send a secure international fax — just include t…
Nobody understands Phishing better than an anti-spam company. That’s why we are providing Phishing Awareness Training to our customers. According to a report by Verizon, only 3% of targeted users report malicious emails to management. With compan…

685 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question