firewall policies blocking internet but allowing windows and other updates

[reckless1]

hello all, i have a fortigate 50b, and i have a bunch of stations with specific IP addresses that i have blocked internet access to by using a restrictive policy. however i need to know how i can block internet access but allow windows updates and other software updates like java...

[rwpatterson]

Do you have a valid Fortiguard subscription?

[reckless1]

yes i do have a valid and active subscription

[rwpatterson]

Create a new Local Catergory (UTM > Web Filter > ' Local Category' tab). I called mine " Windows Update" .

Create a new Local Rating for each of the following domains: update.microsoft.com, windowsupdate.com and windowsupdate.microsoft.com.

In all the protection profiles, allow ' Windows Updates' category. That should do it. Works fine here. I also added Mozilla updates, Java updates, etc. to this category ;)

[simonpt]

Hi Bob I' ve tried a similar method to yours but with mixed results. Our standard firewall policy for users blocks executables (with some exceptions like ocget.dll), so I created a policy before it that allows the users to go to the Windows Update URLs and also does a bit of traffic shaping to prevent the updates from killing the network. The problem I' ve found, and you might be finding this too, is that the actual downloads are hosted at various content delivery networks like Akamai, Limelight and Microsoft' s own msecn.net. So the users are falling through the Windows Update firewall policy, hitting the standard policy and having their Windows Update downloads blocked. Our FAZ antivirus log is full of blocked executables with random names like 55f6c9e51ad360b2adee1f74049.exe. There doesn' t appear to be an easy fix. I don' t want to whitelist all the CDNs (and probably can' t anyway), nor do I want to whitelist all 27-character executables. Do you have any suggestions? Thanks - Simon

[rwpatterson]

Although Akamai is where Windoze update come from, the DNS name is also one of the four that I pointed out above. We have no problem using those names in the ratings. We also disable automatic updates here so we don' t get hammered on Patch Tuesday. Besides, we have many applications that depend on certain levels of IE, and automatic updates may break that, causing more pain than it' s worth...

[simonpt]

We' re " down under" and we seem to have a different experience from yours. If I look at web filter log entries for clients requesting Windows updates, the " hostname" is au.download.windowsupdate.com (which resolves to 203.77.186.21 and 203.77.186.22) but the " destination" is a random CDN IP address like 70.37.129.26, 117.121.254.232 or 203.77.186.201. If I understand correctly, when you specify a URL as part of a local rating or firewall policy, the FGT resolves the URL to the IP address(es) and compares this to the destination address being requested. In the example above, the requested IP address and the actual destination IP address don' t match. Hence I can' t get a policy to match Windows Update activity. If you' ve disabled Windows Updates, perhaps you' re not noticing this issue?

[rwpatterson]

Our IS staff runs Windows Updates regularly, and even on machines that are blocked Internet access, they can update without issue using those 4 URLs. Works for me....

[reckless1]

i need to block internet access to these users, however i still need the machines to get automatic updates.... no games, no messenger services....

[reckless1]

thanks for the reply RWPATTERSON, i have created the local category and local ratings (what is the url for the java updates). now thats done what do i do next???. right now all the machines have a policy that blocks all access to all services in a policy where i have specified there ip addresses. do i need to undo this???... robin