Update Management through OMS Gateway ?

[Ahmed Atef]

Hi Guys,

A pretty confusing topic for me. 

Now i have a lot of VMs in Azure, they dont have internet access but they are configured to connect to log analytics through the OMS gateway which is basically acts like a proxy for them, it works perfectly i can collect all the logs needed and perf counters no problem here.

i enabled update management on these servers as well. so then i have to allow hosts in the OMS gateway using Add-OMSGatewayAllowedHost powershell command. which i did as per the documentation here 

https://docs.microsoft.com/en-us/azure/log-analytics/log-analytics-oms-gateway#configure-for-automat...

i believed that it should use the OMS GatewayProxy to access the Update repository and get the assessment and can push the updates now, but i checked and the VMs seems to not be working like this and might need actually another proxy settings to get to the update service from Microsoft.

My questions are:

- should i add the update service URLs to the allowed hosts in oms gateway ? and then would the VMs connect to the Update services through just the OMS proxy.

Update catalogue URLs 

• microsoft.com
• *.update.microsoft.com
• windowsupdate.com
• *.download.windowsupdate.com
• microsoft.com
• *.download.microsoft.com
• com
• *.windowsupdate.com
• microsoft.com
• windows.com
• live.com (this is required if you have connected a Microsoft Account)
• microsoft.com
• *.mp.microsoft.com

- Or does the VMs still need to set up a proxy that have access to the internet?! 

if anyone have experience with this would be great to share.

Thanks

Ahmed Atef
 

[#2]

Ideally, update services should just connect through the OMS proxy. However, for testing purposes, you can the update service URLs to the allowed hosts in OMS gateway.

As a secondary measure, you could also try using the WSUS pass through gateway app published on the Azure marketplace.  

[#3]

i have now 2 VMs that are not connected to the internet directly or through internet proxy.. but connected to log analytics through the OMS proxy but they show up as not assessed on the Update management solution. 

so thats mean that the OMS gateway doesnt serve the update management as proxy i assume ? but it would make more logic that if your VM is connected through OMS gateway proxy then Update management should work too. 

i will add the URLs as allowed hosts in the oms gateway and see what comes up. 

[#4]

I have a similar question about OMS Gateway. Did you manage to find out more? I would like to configure the OMS Gateway in such a way that updates are downloaded on it and sent to agents.

[#5]

Hi Tomek,

what we ended up doing is installing WSUS on the OMS Gateway,  it acts as repository for updates, all updates are downloaded to it, all servers are configured to have the wsus as their update source through GPO, but all orchestration and schedules of updates are managed through the Update Management Solution. 

[#6]

This is something that I wanted to avoid.

So you are sure that there is no way that OMS Gateway server can connect to update.microsoft.com and download the update? 

How does managing the updates look like in this case?

You must do "approve" in WSUS for a specific KB and create Scheduled Update Deployment in Azure side? Something more?

[#7]

the Gateway itself can connect to microsoft update as it have internet access, but that doesnt mean that the agents can pull the missing updates from the gateway.

I opened a case with MS support to investigate this before going to the WSUS solution as i wanted to avoid the management of WSUS as well, and i thought that the agent can use the oms gateway to act as a proxy and connect to update.microsoft.com and pull the updates from there, MS Support told me that this is not possible the agents must bound to an update repository, either WSUS or Microsoft Update, and of course VMs don't have direct internet connectivity. so there are 2 ways, setting a system proxy on the VMs where you can only allow internet access to certain URLs (was not applicable in my case) , the other way is WSUS, and yes i do automatic approvals for security and critical updates on WSUS, then the assessment and the scheduling of the updates are all from the portal. 

the WSUS Config is done only 1 time, then everything else i manage from the portal. 

this setup was back in April, and as things changes alot within the log analytics and Azure Monitor space, i hope that the oms gateway can actually work as proxy for updates on the agents as well. 

[#8]

Thanks Ahmed for quick answer.

Could you tell me how you configure a WSUS GPO policy in such a scenario with Azure Update Management?