SCUP patches not working on internet-based management point

[wilbywilson]

Scenario: I've recently installed an SCCM 2012 R2 management point/distribution point/software update point into the company DMZ. Internet-based clients can communicate with this MP/DP/SUP. Hardware inventory, software inventory, and (Microsoft) security updates appear to be working. When I look at the SCCM logs, the client machines are downloading the security updates directly from Microsoft, which I believe is the expected behavior for an internet client.

 

The issue that I'm running into is that we also intend to use SCUP to publish security updates, and that part does not appear to be working through the internet-based SUP. For instance, I've got an Adobe Flash patch that is already published/approved, and internally, this update installs fine on SCCM client machines. But on an internet-based SCCM client, it's failing to find/download the source files. (An Adobe update wouldn't be hosted on the public Microsoft update website, so perhaps that's the root of the problem.) My DataTransferService.log file shows:

 

Downloading from http://INTERNAL_MP.DOMAIN.COM:80/Content/C8 without proxy encountered error: BITS error: 'The requested name is valid, but no data of the requested type was found.

' Context: 'The error occurred while the remote file was being processed.

' Retrying 1 times

CDTSJob::JobError: DTS Job ID='{"Random Job Number"}' BITS Job ID='{"Random Job Number"}' ErrorCode=0x80072AFC

CDTSJob::JobError: DTS Job ID='{"Random Job Number"}' URL='http://INTERNAL_MP.DOMAIN.COM:80/Content/C8' ProtType=1

Failed to set proxy to bits job for url 'http://INTERNAL_MP.DOMAIN.COM:80/Content/C8'. Error 0x87d00215

All proxy types and no proxy have been tried but failed. Loop the types again for the 1 time

 

This sequence of failures goes on endlessly, since an internet-based client would never be able to reach the internal MP. So, is there some kind of workaround for this? Are other people that use SCUP facing this issue with internet-based clients?

 

Thanks for any guidance.

[wilbywilson]

I think I figured it out. It looks like the reason that the SCCM client couldn't find the SCUP patch was because the internet DP wasn't configured for "allow fallback source location for content." Shortly after checking that box, the client "switched" itself to the DP that was sitting in the DMZ, and successfully downloaded/installed the patch.

 

Thanks.