Windows Clients not connecting to WSUS server.

I have a fresh install of WSUS on a fresh install of Windows Server 2012R2.  I have edited group policy to have our desktops use our internal WSUS server for updates.  The only client showing in the WSUS console is the WSUS server itself.  I tried reinstalling WSUS on Windows Server 2016 and I get identical behavior.  I ran the Solarwinds Diagnostic Tool for the WSUS and the first two sections are fine. The last section, WSUS Server Connectivity, fails with "Cannot Connect - caused by a network infrastructure fault making the Windows Update unavailable ..."

Any assistance would be appreciated.
PhilshAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

ITguy565Commented:
Check that port 8530 is not firewalled on your WSUS server as well as make sure you can telnet to it from a workstation on your LAN. It is quite possibly a windows firewall issue. in addition to this you can see what port you are utilizing from your Windows Server Update Services mmc panel Click on your WSUS server container under Update Services and look at Connection settings.


If you are still having issues make sure that the port is listening on your server.  netstat -ano from your command line
ITguy565Commented:
in addition to the information above, if you are not familiar with WSUS and the optimizations you soon will need the following:

WSUS base install will be extremely unreliable without the proper optimizations :

https://mivilisnet.wordpress.com/2017/09/28/increase-memory-for-a-stable-wsus-work/
PhilshAuthor Commented:
I disabled the Firewall, same problem.  I get no response if I telnet to WSUS port 8530.

This is what I see with netstat:

Netstat
Exploring SharePoint 2016

Explore SharePoint 2016, the web-based, collaborative platform that integrates with Microsoft Office to provide intranets, secure document management, and collaboration so you can develop your online and offline capabilities.

PhilshAuthor Commented:
I also see the following with netstat.
Netstat2.PNG
PhilshAuthor Commented:
If I try to navigate to http://wsus:8530/Selfupdate/iuident.cab , I do not get any response. So, I am assuming that the problem is with the WSUS server ?
Seth SimmonsSr. Systems AdministratorCommented:
is there a hardware firewall in between?
can you access that URL on the wsus server itself?
anything in the application log?
PhilshAuthor Commented:
There is no hardware firewall.  The URL does work on the WSUS server.  I don't see anything obvious in the application log.
PhilshAuthor Commented:
Update:  It looks like I can get to port 8530 on the WSUS server from itself and from the HYPER-V host on which WSUS is running. No other clients/servers can access this port.  I cannot see what is blocking this port.
ITguy565Commented:
@philsh,

Sounds like you need to create a firewall Rule to allow access to that port for your LAN workstations.
ITguy565Commented:
Try running this on your WSUS server in an admin PowerShell window:  
New-NetFirewallRule -DisplayName "Allow Wsus Traffic Port 8530 Out" -Direction Outbound -LocalPort 8530 -Protocol TCP -Action Allow
New-NetFirewallRule -DisplayName "Allow Wsus Traffic Port 8530 IN" -Direction Inbound -LocalPort 8530 -Protocol TCP -Action Allow

Open in new window

ITguy565Commented:
After you create those rules attempt to telnet to port 8530 from one of your clients to the WSUS server.
PhilshAuthor Commented:
I had already created those rules and it did not work. Thanks.
PhilshAuthor Commented:
It looks like the issue is Symantec Endpoint Protection. It was installed on the Hyper-V host machine.   Even when you disable it, it blocks that traffic.  When I removed it, I could get to port 8530.

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Installation

From novice to tech pro — start learning today.