Step 3: Configure the Network Connection for WSUS 3.0

  • Article

Applies To: Windows Server 2003, Windows Server 2003 R2, Windows Server 2003 with SP1, Windows Server 2003 with SP2, Windows Server 2008, Windows Server Update Services

After installing WSUS 3.0, the configuration wizard will launch automatically. You can also run it later through the Options page of the WSUS 3.0 console.

Before beginning the configuration process, be sure you know the answers to the following questions:

1. Is the server's firewall configured to allow clients to access the server?

2. Can this computer connect to the upstream server (such as Microsoft Update)?

3. Do you have the name of the proxy server and the user credentials for the proxy server, if needed?

By default, WSUS is configured to use Microsoft Update as the location from which to obtain updates. If you have a proxy server on your network, you can configure WSUS to use the proxy server. If there is a corporate firewall between WSUS and the Internet, you might need to configure the firewall to ensure that WSUS can obtain updates.

Note

Although you must have Internet connectivity to download updates from Microsoft Update, WSUS offers you the ability to import updates onto networks not connected to the Internet.

Step 3 contains the following procedures:

  • Configure your firewall.

  • Specify the way this server will obtain updates (either from Microsoft Update or from another WSUS server).

  • Configure proxy server settings, so WSUS can obtain updates.

To configure your firewall

  • If there is a corporate firewall between WSUS and the Internet, you might need to configure that firewall to ensure WSUS can obtain updates. To obtain updates from Microsoft Update, the WSUS server uses port 80 for HTTP protocol and port 443 for HTTPS protocol. This is not configurable.

  • If your organization does not allow port 80 or port 443 to be open to all addresses, you can restrict access to only the following domains, so WSUS and Automatic Updates can communicate with Microsoft Update:

Note

These instructions for configuring the firewall are meant for a corporate firewall positioned between WSUS and the Internet. Because WSUS initiates all its network traffic, there is no need to configure Windows Firewall on the WSUS server.

Although the connection between Microsoft Update and WSUS requires ports 80 and 443 to be open, you can configure multiple WSUS servers to synchronize with a custom port.

The next two procedures assume that you are using the configuration wizard. In a later section in this step, you will learn how to start the WSUS Administration snap-in and configure the server through the Options page.

To specify the way this server will obtain updates

  1. From the configuration wizard, after joining the Microsoft Improvement Program, click Next to choose the upstream server.

  2. If you choose to synchronize from Microsoft Update, you are finished with this page. Click Next, or select Specify Proxy Server from the left pane.

  3. If you choose to synchronize from another WSUS server, specify the server name and the port on which this server will communicate with the upstream server.

  4. To use SSL, check the Use SSL when synchronizing update information check box. In that case the servers will use port 443 for synchronization. (You should make sure that both this server and the upstream server support SSL.)

  5. If this is a replica server, check the This is a replica of the upstream server check box.

  6. At this point you are finished with upstream server configuration. Click Next, or select Specify proxy server from the left panel.

To configure proxy server settings

  1. On the Specify Proxy Server page of the configuration wizard, select the Use a proxy server when synchronizing check box, and then type the proxy server name and port number (port 80 by default) in the corresponding boxes.

  2. If you want to connect to the proxy server by using specific user credentials, select the Use user credentials to connect to the proxy server check box, and then type the user name, domain, and password of the user in the corresponding boxes. If you want to enable basic authentication for the user connecting to the proxy server, select the Allow basic authentication (password is sent in cleartext) check box.

  3. At this point you are finished with proxy server configuration. Click Next to go to the next page, where you can start setting up the synchronization process.

The following two procedures assume that you are using the WSUS Administration snap-in for configuration. These two procedures show you how to start the WSUS Administration snap-in and configure the server from the Options page.

To start the WSUS Administration console

  • To start the WSUS Administration console, click Start, point to All Programs, point to Administrative Tools, and then click Microsoft Windows Server Update Services 3.0.

Note

In order to use all the features of the WSUS console, you must be a member of either the WSUS Administrators or the local Administrators security groups on the server on which WSUS is installed. However, members of the WSUS Reporters security group have read-only access to the administration console.

To specify an update source and proxy server

  1. On the WSUS console, click Options in the left panel under the name of this server and then click Update Source and Proxy Server in the middle panel.

  2. A dialog box will be displayed with Update Source and Proxy Server tabs.

  3. In the Update Source tab, select the location from which this server will obtain updates. If you choose to synchronize from Microsoft Update (the default), you are finished with this wizard page.

  4. If you choose to synchronize from another WSUS server, you need to specify the port on which the servers will communicate (the default is port 80). If you choose a different port, you should ensure that both servers are able to use that port.

  5. You may also specify whether to use SSL when synchronizing from the upstream WSUS server. In that case, the servers will use port 443 to synchronize from the upstream server.

  6. If this server is a replica of the second WSUS server, select the This is a replica of the upstream server check box. In this case all updates must be approved on the upstream WSUS server only.

  7. In the Proxy server tab, select the Use a proxy server when synchronizing check box, and then type the proxy server name and port number (port 80 by default) in the corresponding boxes.

  8. If you want to connect to the proxy server by using specific user credentials, select the Use user credentials to connect to the proxy server check box, and then type the user name, domain, and password of the user in the corresponding boxes. If you want to enable basic authentication for the user connecting to the proxy server, select the Allow basic authentication (password in cleartext) check box.

  9. Click OK to save these settings.