• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 415
  • Last Modified:

Updating Antivirus and Windows on DMZ Servers

I curently have 3 servers that reside in the DMZ, an app. server, mail server, and web server. I use WSUS and CA Antivirus Console to manage updates to everything inside our secure network. I am looking for the best way to keep these servers up-to-date with antivirus and windows updates. I cannot use the same method used with the devices on the internal network because the DMZ servers are in a workgroup in Active Directory. Currently, the firewall is configured to block port 80 for added security, so these machines cannot get their own updates. I felt it was more secure to keep these machines from initiating any connections through port 80.
Is there any other way I can push updates to these servers from inside the secure network allowing them to be managed the same way the rest of our intranet is managed? I am of the opinion that opening port 80 is a last resort and there must be another means by which I can keep these servers up-to-date internally.
0
cford1973
Asked:
cford1973
  • 2
  • 2
1 Solution
 
Netman66Commented:
At some point, you are going to need port 80 open to get the updates from the Internet.  Unless you want to manually download them from the internal network then copy them to the DMZ.

You could setup WSUS in the DMZ and manually sync it on a fixed schedule.  During that time, you could open port 80 then close it again.  Honestly, creating an access rule for port 80 and 443 from the WSUS server to the 3 Microsoft sites should be fairly simple.  This would only let that one machine out and only to those sites.

Once this is configured you could let it manage itself.  You would need a registry mod to point all the DMZ equipment to the WSUS server, but that's simple enough.

0
 
cford1973Author Commented:
Netman66,

Other than setting the WSUS server up in the DMZ, is there a way to point those DMZ servers back to our secure network to get antivirus and windows updates? However, at this point, I am unsure of what ports would be used and subsequently, what firewall rules would need to be changed to make that work.

I can re-open port 80 on the firewall, and allow it to obtain Windows updates from the Internet; however, I was hoping to use WSUS to maintain consistency and a standardized audit trail in my network. I recently found out that CA Antiviurs does not use Port 80 to retrieve updates from the Internet, so I am not as concerned about those updates.
0
 
Netman66Commented:
Not really, unless they are domain members.  Downlevel WSUS servers need to be part of the domain also - and that's not a good thing in the DMZ.

Creating rules from the WSUS server to Microsoft wouldn't be difficult.

I understand the need to stay consistent with the internal LAN - a HIPPA thing (my guess), but if you document the internal update approvals then following that script for the DMZ server shouldn't be difficult.  It's just another process.

I'm finding out for sure whether it's possible to chain a non-domain WSUS server to a domain WSUS server.  I need to know absolutely.
0
 
cford1973Author Commented:
Thanks for your response. I appreciate it. I have since opened Port 80; however, it is only to initiate an outbound connection, not to accept. Other than the options you mentioned, the only other solution I could come up with was a redistribution sever, and that was not a viable alternative for me.
Thanks again.
0

Featured Post

Who's Defending Your Organization from Threats?

Protecting against advanced threats requires an IT dream team – a well-oiled machine of people and solutions working together to defend your organization. Download our resource kit today to learn more about the tools you need to build you IT Dream Team!

  • 2
  • 2
Tackle projects and never again get stuck behind a technical roadblock.
Join Now