Solved

WSUS server in DMZ?

Posted on 2011-03-08
9
2,016 Views
Last Modified: 2012-05-11
My firewall is currently configured such that there are no inbound connections from the DMZ to my internal network. I am looking at adding a WSUS server in the DMZ. Is there any way to configure WSUS such that the configuration is pushed from the internal to the DMZ server? Everything I've seen so far requires opening 80 and 443 to my internal network. I'm just looking for the meta data on my server and the updates themselves provided by MS.
0
Comment
Question by:timbrigham
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
9 Comments
 
LVL 10

Expert Comment

by:NetExpert-Warszawa
ID: 35074071
Why do you want to put WSUS into DMZ? DMZ is for services available for outside. Put WSUS into your internal network. It is the place for it. You will not have problems with a firewall either.
0
 
LVL 13

Expert Comment

by:kdearing
ID: 35074223
Agreed. WSUS belongs in the internel network, not the DMZ where it's publicly available.
0
 
LVL 1

Author Comment

by:timbrigham
ID: 35086633
I don't want to place my internal WSUS server into the DMZ, but I would like to control what updates my users receive while in the field. There have been too many cases where an update from MS has broken one of our systems and we're not able to address it when the user is half way around the world. I'm not aware of a way to do this without a WSUS server; if there is a way to do please enlighten me.

I would like to have a secondary WSUS server located in the DMZ strictly for these remote users I want to do so without opening any ports from the DMZ into my internal network.
0
Technology Partners: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

 
LVL 1

Author Comment

by:timbrigham
ID: 35087072
More specifically I'm looking for a way to synchronize the approvals from the internal to the external server.  
0
 
LVL 10

Accepted Solution

by:
NetExpert-Warszawa earned 500 total points
ID: 35087178
You do not need to use ports 80 or 443. However since you do not want to open any ports, consider http://technet.microsoft.com/en-us/library/cc720486%28WS.10%29.aspx
0
 
LVL 23

Expert Comment

by:Suliman Abu Kharroub
ID: 35087840
You need to deploy WSUS on Replica mode:

http://technet.microsoft.com/en-us/library/cc720448(WS.10).aspx

downstream and upstream server.
depends on you config; allow https(s) from DMZ to internal..
0
 
LVL 1

Author Comment

by:timbrigham
ID: 35087968
Many thanks gentlemen. The disconnected network configuration looks appealing. Is there a way to use that configuration with the meta data only?
0
 
LVL 10

Expert Comment

by:NetExpert-Warszawa
ID: 35088078
Just skip step 2 :)

Why don't you want to copy updates? Do you want to download them twice from the Internet?
0
 
LVL 1

Author Comment

by:timbrigham
ID: 35109195
I want my clients to connect to the MS site for retrieving the windows updates, not the local WSUS server in the DMZ. My bandwidth is provided by a co location facility and we pay for overages - I'd rather our users not be retrieving publicly available files on our dime.
0

Featured Post

Free Tool: IP Lookup

Get more info about an IP address or domain name, such as organization, abuse contacts and geolocation.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
L2 to EIGRP slow migration? 27 118
MS Project 2013 - notes documentation 8 87
Some help with Network Design 4 53
IPSec Site to Site VPN Topology 6 66
As with any other System Center product, the installation for the Authoring Tool can be quite a pain sometimes. This article serves to help you avoid making these mistakes and hopefully save you a ton of time on troubleshooting :)  Step 1: Make sur…
AWS has developed and created its highly available global infrastructure allowing users to deploy and manage their estates all across the world through the use of the following geographical components   RegionsAvailability ZonesEdge Locations  Wh…
The view will learn how to download and install SIMTOOLS and FORMLIST into Excel, how to use SIMTOOLS to generate a Monte Carlo simulation of 30 sales calls, and how to calculate the conditional probability based on the results of the Monte Carlo …
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…

749 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question