What's the best way to poke a firewall hole in a border firewall to allow windows updates?
As far as I can tell, the windows update sites are hosted on a content distribution network that can potentially change IP addresses every 30 seconds.
If I "poison" our campus DNS with a static assignment for the sites, eventually I'll be pointing to sites that don't actually host the content anymore.
Are there any IP addresses that host the update content that are guaranteed to never change?
In a more generic sense, how do people configure firewalls to allow access to resources hosted on CDNs where the IPs are going to change constantly? The firewall just sees to/from packets and doesn't necessarily know what url (if https) the request is going to, so the firewall doesn't have a direct way to see that this packet is going to the symantec virus definitions update site while that one is looking at a world-cup stream.
And, in my situation, I don't have the ability to just mandate a specific configuration on the systems on the network. Ah, the joys of working at a university...