Because of coronavirus all people works in remote and connects to the corporate network by VPN.
IT departments are facing a big problem that Microsoft patches chew up a lot of bandwidth when these clients can download the patches from on-premise DP by using the VPN tunnel causing bandwidth slowness and impact for business activity.
There are 2 solutions that I involve to to allow the VPN clients to get their updates directly from MU.
To set the stage, I am not going to be talking about configuration for split tunneling and proxy settings because each VPN/Proxy configuration is unique but you can find in the end of this blog a simple view for that.
Solution 1 :
First Scenario (existing ADR) :
If you would like to download the package from Microsoft update for existing deployment, please try the option "Prefer cloud based sources over on-promise sources" in the client's boundary group properties. As shown below:
The clients prefer to download the content from its DP. Only when no DP is available, the client will download the package from the Microsoft Update.
Also VPN Boundary Group should never fallback to another boundary group’s distribution point:
Also make sure the option "If software updates are not..., download content from Microsoft Updates" is checked on the properties of the deployment.
Deployment options should be : "Do not install updates" this will redirect the client to download from Microsoft updates.
Second Scenario (new Deployment package):
Select the "No deployment package" option in "Deployment Package" of the "Deploy Software Update Wizard", then the clients will download content from Microsoft cloud.
After the clients receive the policy, they will downloaded the packages directly from Microsoft rather than the DP. As shown below:
then do the same as I have shown in First scenario above.
Solution 2:
You can use cloud DP hosted as Platform-as-a-Service (PaaS) in Microsoft Azure. This service supports the following scenarios:
- Provide software content to internet-based clients without additional on-premises infrastructure
- Cloud-enable your content distribution system
- Reduce the need for traditional distribution point
You won't be able to create a traditional cloud distribution point in the future. The implementation for sharing content from Azure has changed. Use a content-enabled cloud management gateway by enabling the option to Allow CMG to function as a cloud distribution point and serve content from Azure storage.
- Cloud management gateway (CMG) provides a simple way to manage Configuration Manager clients on the internet.
for more information and how you can deploy CMG/CDP :
Then you can associate CMG with VPN Boundary group, if you are using SCCM 1902, you can associate a CMG with a boundary group. You can do this after you setup cloud management gateway. When you create or configure a boundary group, on the References tab, add a cloud management gateway.
Once you setup cloud management gateway and all the site system roles are running, clients get the location of the CMG service automatically on the next location request.
Most of all the clients must be on the intranet to receive the location of the CMG service. By default the polling cycle for location requests is every 24 hours. However to speed up the request, you can restart the SMS Agent Host service (ccmexec.exe) on the computer.
VPN : Split Tunnelling
You can work with your VPN team so that they configure split tunneling:
the goal is to have the clients over VPN which request content from MS cloud to be redirected over the split tunnel to internet.
- http://windowsupdate.microsoft.com
- http://*.windowsupdate.microsoft.com
- https://*.windowsupdate.microsoft.com
- http://*.update.microsoft.com
- https://*.update.microsoft.com
- http://*.windowsupdate.com
- http://download.windowsupdate.com
- https://download.microsoft.com
- http://*.download.windowsupdate.com
- http://wustat.windows.com
- http://ntservicepack.microsoft.com
- http://go.microsoft.com
- http://dl.delivery.mp.microsoft.com
- https://dl.delivery.mp.microsoft.com
