Software Update doesn't work behind a firewall

All of the computers in my department are being moved behind a firewall. All of the computers running Mac OS X (either 10.3 or 10.4) cannot successfully run Software Update after being moved behind the firewall. Web pages load fine. SMB and AFP networking both work great. But when I try to check for new updates, I get the following message:

Networking errr has occurred: timed out (-1001). Make sure you can connect to the Internet, then try again.
Software update can't check for updates because of a network problem.

Strangely enough, it does appear that the computer is establishing a connection to an Apple server. I ran NETSTAT from a terminal window while Software Update was timing out, and it showed an ESTABLISHED connection to swscan.apple.com.

My understanding of our firewall's rule set is that all unsolicited incoming traffic is blocked, however all outgoing traffic is allowed. So, computer X can only talk to my computer if my computer contacts computer X first. Seems like this is a fairly standard firewall configuration.

I'm baffled as is the network guy I've been troubleshooting this problem with. Any ideas?

Posted on Sep 20, 2005 3:20 PM

Reply
9 replies

Sep 22, 2005 7:28 AM in response to scapesuiter

Well, it's not a matter of turning the firewall off or on. It requires the computer to be unplugged from the network, plugged into a different network port, and then reconfigure the network settings with a different IP address and subnet mask. The only feasible solution that will suit the entire department is to allow Software Update to work through the firewall, which is why I posted to this forum.

I'm kind of surprised that this isn't a more common problem, considering it seems to me that our firewall set up is fairly standard as far as I can tell.

Sep 22, 2005 2:55 PM in response to Michael Tennes

I'm not sure what type of firewall it is. Our networking people set it up on the router level that's outside of my jurisdiction. I just tell them I need such and such a port moved behind the firewall, they do their thing, and I plug in a new IP address for the machine. There's no authentication happening to my understanding.

By the way, it's happening with 10.3 and 10.4. And although I don't have a 10.2 machine around to test it, I suspect it would also not work with 10.2.

Sep 23, 2005 10:04 AM in response to Michael Tennes

It looks like with the help of network security and their firewall logs, we've been able to narrow down the problem. I'm not sure I understand the technical details, since this isn't my area of expertise, but they said it's a problem with the timestamp on the TCP packets. Apparently the firewall by default had strict rules in place that caused it to closely monitor timestamps of outgoing TCP packets, and for some reason the packets coming out of the OS X machines had something wonky going on with their timestamps. They eased this rule for outgoing packets, and it seems to have fixed the problem.

This thread has been closed by the system or the community team. You may vote for any posts you find helpful, or search the Community for additional answers.

Software Update doesn't work behind a firewall

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple Account.