martin.kirkley

Hi Thorsten, this probably doesn't help but: that is up to you. Using the diagram on the link you can get the firewall ports open from all DMZ Clients to your Software Update Point, etc. Or, if you want to cut down on the amount of clients you have talking through your firewall, then you can put in a Secondary Site and then have ports open between the Secondary Site server and your Primary Site, then have the Secondary Site configured as a Downstream WSUS server and have the Software Update Point role installed. I would still suggest that you open the firewall between the Primary Site and all clients (outlined in Section 17 on the link) because clients will by-pass the Secondary Site and want to talk to the Management Point directly when you try to run deployment jobs. If you only want to use the WSUS capabilities of SCCM, then ports open outlined in section 3 & 6. Hope that helps! Martin *** EDIT *** Apologies, you wouldn't need to have it as a downstream server, just a DP would do the you would advertise Software Update Deployment Packages and add the DMZ DP to the list of Distribution Points on the Deployment Package.