Allow WSUS updates to your ISA Server via HTTPS

[LEFT][CODE]http://www.isaserver.bm/isa_articles/wsus_https.html[/CODE]


As WSUS seems to be getting installed on most networks, I have created this article to make configuring a rule to allow your ISA Server to update itself via HTTPS.
For this tutorial, WSUS was configured to use HTTPS, on port 8531, (HTTP port 8530).
First of all you need to create the SSL tunnel by using ISAtpre, (available from Jim Harrison’s website, [url]http://www.isatools.org/ISAtrpe.zip[/url]),
Use 8531 in both the LowPort and HighPort fields, and call it WSUSSSL, then click add tunnel range.
[IMG]http://www.isaserver.bm/isa_articles/WSUS_HTTPS_files/image001.jpg[/IMG]

Now we can create the new protocols for the new access rule.
1. The WSUS Protocol
[IMG]http://www.isaserver.bm/isa_articles/WSUS_HTTPS_files/image002.jpg[/IMG]
2. Add the new Protocol port
[IMG]http://www.isaserver.bm/isa_articles/WSUS_HTTPS_files/image003.jpg[/IMG]
3. No secondary connections.
4. Click finish
Follow steps 1 thru 4 to create the WSUSSSL protocol using the tunneled port created with ISAtpre, in this case 8531.
If you do not have done so already, create a computer object for your ISA Server and one for your WSUS Server.
[IMG]http://www.isaserver.bm/isa_articles/WSUS_HTTPS_files/image004.jpg[/IMG]

We need to apply the protocols to the access rule, Kerberos – Sec (UDP), and the 2 protocols we created, WSUS and WSUSSSL.
Right click on Firewall Policy, select new Access rule.
[IMG]http://www.isaserver.bm/isa_articles/WSUS_HTTPS_files/image005.jpg[/IMG]

Select Allow.
[IMG]http://www.isaserver.bm/isa_articles/WSUS_HTTPS_files/image006.jpg[/IMG]

Select the needed protocols
[IMG]http://www.isaserver.bm/isa_articles/WSUS_HTTPS_files/image007.jpg[/IMG]
Click Next.

Add the ISA Server computer object
[IMG]http://www.isaserver.bm/isa_articles/WSUS_HTTPS_files/image008.jpg[/IMG]
Click next.

Add the WSUS Server object.
[IMG]http://www.isaserver.bm/isa_articles/WSUS_HTTPS_files/image009.jpg[/IMG]
Click next.

Leave all users in user sets
[IMG]http://www.isaserver.bm/isa_articles/WSUS_HTTPS_files/image010.jpg[/IMG]
Click next, then click finish.
[B][COLOR=red]The new access rule should be higher in the Policy list than any deny rule that explicitly blocks the ports that we have just used.[/COLOR][/B]
If you now update the WSUS autoupdate client,
[B][COLOR=red][IMG]http://www.isaserver.bm/isa_articles/WSUS_HTTPS_files/image011.jpg[/IMG][/COLOR][/B]
You will see a successful connection to the WSUS Server and it will receive it’s updates in due course.
[B][COLOR=red][IMG]http://www.isaserver.bm/isa_articles/WSUS_HTTPS_files/image012.jpg[/IMG][/COLOR][/B]
[B][COLOR=red]Although you are only seeing the HTTP connection, the WSUS reporting and agent functions are carried out on the WSUSSSL port.[/COLOR][/B]

[/LEFT]

[LEFT][CODE]http://araihan.wordpress.com/2009/08/13/install-and-configure-wsus-3-0-sp2-step-by-step/
[/CODE]

If you have ISA 2004/2006, you have to set WSUS policy in ISA firewall access rule. so that ISA doesn’t block communication between server and client. You don’t need to do it if nothing blocking between Client and Server communication.
To publish WSUS policy, Go to ISA management console
Go to Network Object and expand WEB listener, right click on web listener click new. Name should be netbios name of WSUS server. Follow the screen shot.
[URL="http://araihan.files.wordpress.com/2009/08/image20.png"][IMG]http://araihan.files.wordpress.com/2009/08/image_thumb20.png?w=519&h=500[/IMG][/URL]
[URL="http://araihan.files.wordpress.com/2009/08/image25.png"][IMG]http://araihan.files.wordpress.com/2009/08/image_thumb25.png?w=521&h=484[/IMG][/URL]
[URL="http://araihan.files.wordpress.com/2009/08/image26.png"][IMG]http://araihan.files.wordpress.com/2009/08/image_thumb26.png?w=487&h=484[/IMG][/URL]
Click next, click finish.
On firewall publishing tasks, click on the publish a web server, follow the screen shot
[URL="http://araihan.files.wordpress.com/2009/08/222.jpg"][IMG]http://araihan.files.wordpress.com/2009/08/22_thumb2.jpg?w=202&h=431[/IMG][/URL]
[URL="http://araihan.files.wordpress.com/2009/08/231.jpg"][IMG]http://araihan.files.wordpress.com/2009/08/23_thumb1.jpg?w=498&h=484[/IMG][/URL]
[URL="http://araihan.files.wordpress.com/2009/08/241.jpg"][IMG]http://araihan.files.wordpress.com/2009/08/24_thumb1.jpg?w=476&h=484[/IMG][/URL]
[URL="http://araihan.files.wordpress.com/2009/08/251.jpg"][IMG]http://araihan.files.wordpress.com/2009/08/25_thumb1.jpg?w=495&h=484[/IMG][/URL]
[URL="http://araihan.files.wordpress.com/2009/08/261.jpg"][IMG]http://araihan.files.wordpress.com/2009/08/26_thumb1.jpg?w=501&h=484[/IMG][/URL]
[URL="http://araihan.files.wordpress.com/2009/08/272.jpg"][IMG]http://araihan.files.wordpress.com/2009/08/27_thumb2.jpg?w=491&h=484[/IMG][/URL]
[URL="http://araihan.files.wordpress.com/2009/08/281.jpg"][IMG]http://araihan.files.wordpress.com/2009/08/28_thumb1.jpg?w=497&h=484[/IMG][/URL]
[URL="http://araihan.files.wordpress.com/2009/08/291.jpg"][IMG]http://araihan.files.wordpress.com/2009/08/29_thumb1.jpg?w=488&h=484[/IMG][/URL]
Right click WSUS Publishing policy, go to property and check web server and port
[URL="http://araihan.files.wordpress.com/2009/08/301.jpg"][IMG]http://araihan.files.wordpress.com/2009/08/30_thumb1.jpg?w=416&h=484[/IMG][/URL]
On the paths add these path if not existing already
[URL="http://araihan.files.wordpress.com/2009/08/312.jpg"][IMG]http://araihan.files.wordpress.com/2009/08/31_thumb2.jpg?w=418&h=484[/IMG][/URL]
[URL="http://araihan.files.wordpress.com/2009/08/322.jpg"][IMG]http://araihan.files.wordpress.com/2009/08/32_thumb2.jpg?w=420&h=484[/IMG][/URL]
uncheck verify and block option.
All done. You are ready to go now.
[B]Troubleshooting [/B]
Go to client machine, run gpupdate /force if client not showing on WSUS
Run wuauclt /resetauthorization /detectnow command from client machine.
Check Registry of client.
[URL="http://araihan.files.wordpress.com/2009/08/image27.png"][IMG]http://araihan.files.wordpress.com/2009/08/image_thumb27.png?w=478&h=471[/IMG][/URL]

[/LEFT]