Updating DMZ server environment

[albertwt]

Hi All,

 

I've got several DMZ Windows server that I'd like to know how to update them, it is serving as terminal server and the webserver with only port 443 and 80 & 8080 opened to the internet with port 1521 for database connection.

 

I do have WSUS in place and already working fine in the internal domain, how do people usually do their patching for the DMZ servers ?

 

Any idea would be greatly appreciated.

 

Thanks,

[SYNACK]

You could poke a single port 443 hole in the firewall for the specific IPs of the DMZ servers to access the internal WSUS server, you would need to configure the DMZ servers in local policy to implement this though unless they are domain joined.

[Firefox]

If they are domain joined you could create a one way trust from the DMZ to the internal domain. This is what we do to allow out KMS server to license our DMZ machines