| Solution | - SSL Exemption for Windows Update: Ensure that Windows Update servers are exempt from the Deep SSL inspection profile. This is necessary because Microsoft uses certificate pinning, and FortiGate's SSL inspection can interfere with this process. To exempt domains from deep inspection, see Technical Tip: Exempting applications/domains/websites from Deep SSL Inspection.
- Authentication Configuration: If there is a denial of access to the Internet due to failed authentication, ensure that the device or user is authenticated before accessing the Internet.
-
Firewall Policy Configuration: Configure a specific firewall policy for the Microsoft update service. You can use the Internet Service Database (ISDB) "Microsoft-Microsoft.Update" or Microsoft domains as FQDN-type objects. Below are some examples: *.windowsupdate.com.
*.update.microsoft.com.
*.delivery.mp.microsoft.com.
*.microsoft.com. This policy should be placed above user browsing policies. - SD-WAN Configuration: If SD-WAN is in use, configure an SD-WAN rule using the Microsoft ISDB or FQDNs as the destination. If possible, use the Lowest Latency or Best Quality strategy.
- Web Filter and application control: If security profiles are applied to the policy, ensure that the 'Information Technology' category (Web Filter) and 'MS.Windows.Update' (Application Control) are allowed.
- Firewall Configuration: Refer to Microsoft's guidelines on configuring a firewall for software updates to ensure that the firewall settings correctly allow Windows Update traffic.
These steps resolve issues where a Windows Update does not function correctly due to SSL inspection or authentication requirements on FortiGates. Related documents:
Technical Tip: Exempting applications/domains/websites from Deep SSL Inspection Using Internet Service in a policy Best quality strategy Lowest cost (SLA) strategy |
