# External firewall setup to enable online updates **URL:** \ **Category:** SLES Updates\ **Created:** [January 30, 2017, 4:42pm UTC](https://forums.suse.com/t/external-firewall-setup-to-enable-online-updates/29300 "2017-01-30T16:42:37Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![marcinstec](https://avatars.discourse-cdn.com/v4/letter/m/8c91f0/32.png) [@marcinstec](https://forums.suse.com/u/marcinstec)\ **Post date:** [January 30, 2017, 4:42pm UTC](https://forums.suse.com/t/external-firewall-setup-to-enable-online-updates/29300/1 "2017-01-30T16:42:37Z")
Hi, I’m suse-rookie so pointing me to the right documentation is more than enough 🙂 Which ip’s/ports I should open in my corpo firewall to enable online updates ? I have totally isolated SLES 11 SP4 for SAP systems, however I can enable some limited communication for specific external IP’s/ports. Is there any reference which addresses is suse\_register and zypper using to get registered and updates ? I considering setting up SMT , but still the same limitations applly. regards marcin ---
**Author:** ![ab1](https://avatars.discourse-cdn.com/v4/letter/a/d2c977/32.png) [@ab1](https://forums.suse.com/u/ab1)\ **Post date:** [January 30, 2017, 6:03pm UTC](https://forums.suse.com/t/external-firewall-setup-to-enable-online-updates/29300/2 "2017-01-30T18:03:37Z")
This thread from last year may help: [https://forums.suse.com/showthread.php?8107-Firewall-Rules-for-updates-and-patches](https://forums.suse.com/showthread.php?8107-Firewall-Rules-for-updates-and-patches) The SUSE Manager documentation has changed since then, but I presume the same information is in there. If you really are completely locked down you’d also need DNS to work, probably, in addition to HTTPS over TCP 443. – Good luck. If you find this post helpful and are logged into the web interface, show your appreciation and click on the star below… ---
**Author:** ![Jens-U](https://avatars.discourse-cdn.com/v4/letter/j/d78d45/32.png) [@Jens-U](https://forums.suse.com/u/Jens-U)\ **Post date:** [January 31, 2017, 7:30pm UTC](https://forums.suse.com/t/external-firewall-setup-to-enable-online-updates/29300/3 "2017-01-31T19:30:12Z")
Hi marcin, [QUOTE=marcinstec;36319]Hi, I’m suse-rookie so pointing me to the right documentation is more than enough 🙂 Which ip’s/ports I should open in my corpo firewall to enable online updates ? I have totally isolated SLES 11 SP4 for SAP systems, however I can enable some limited communication for specific external IP’s/ports. Is there any reference which addresses is suse\_register and zypper using to get registered and updates ? I considering setting up SMT , but still the same limitations applly.[/QUOTE] since this is a corporate firewall, another answer might be “probably no additional ones - just make sure your system(s) can access the HTTPS proxy.” 😉 Regards, J ---
**Author:** ![marcinstec](https://avatars.discourse-cdn.com/v4/letter/m/8c91f0/32.png) [@marcinstec](https://forums.suse.com/u/marcinstec)\ **Post date:** [January 31, 2017, 9:39pm UTC](https://forums.suse.com/t/external-firewall-setup-to-enable-online-updates/29300/4 "2017-01-31T21:39:28Z")
Hi, ab & jmozdzen, Thanks for the advices. I did what you told me to - it works. Unfortunately I local security guys are a little too strict about it so I’m gonna have to run netstat -anp or nethogs to find out exact IPs :-\ I’ll post my findings later. Thanks for your help! marcin ---
**Author:** ![marcinstec](https://avatars.discourse-cdn.com/v4/letter/m/8c91f0/32.png) [@marcinstec](https://forums.suse.com/u/marcinstec)\ **Post date:** [February 1, 2017, 10:59pm UTC](https://forums.suse.com/t/external-firewall-setup-to-enable-online-updates/29300/5 "2017-02-01T22:59:00Z")
I had to enable http communication to [secure-www.novell.com](http://secure-www.novell.com). It looks registration script needs to be redirected by the website to https. Now I’m facing some more common problem: I get this message “Online Repositories do not need to be changed.” while I’m configuring online updates via yast. System has appeared on my SCC account after I issued this command: suse\_register -a [email=myself@my-company.com](mailto:email=myself@my-company.com) -a regcode-sles=XXXXXXXXXXX -a addressid=ZZZZZZZ -a moniker=tsm1lz -L suse\_register.log Then I’m runing “Configure on-line updates” in yast. It tells me that on-line repos are not set, and enables me to go through registration again. It is successfull but tells me “Online Repositories do not need to be changed.” Now I’ stuck. I have seen these threads: [https://forums.suse.com/showthread.php?5389-Software-repositories-did-not-need-to-be-changed](https://forums.suse.com/showthread.php?5389-Software-repositories-did-not-need-to-be-changed) and [https://forums.suse.com/archive/index.php/t-603.html](https://forums.suse.com/archive/index.php/t-603.html) But the solutions over there didn’t worked for me. ---
**Author:** ![Jens-U](https://avatars.discourse-cdn.com/v4/letter/j/d78d45/32.png) [@Jens-U](https://forums.suse.com/u/Jens-U)\ **Post date:** [February 7, 2017, 6:54pm UTC](https://forums.suse.com/t/external-firewall-setup-to-enable-online-updates/29300/6 "2017-02-07T18:54:23Z")
Hi, > It tells me that on-line repos are not set, and enables me to go through registration again. It is successfull but tells me “Online Repositories do not need to be changed.” You might want to take acloser look into suse\_register.log, where the XML responses from the registration server ought to report the required repositories, and where errors would be logged. I take it that the system’s registration details in SCC report the correct license association? Regards, J ---
**Author:** ![marcinstec](https://avatars.discourse-cdn.com/v4/letter/m/8c91f0/32.png) [@marcinstec](https://forums.suse.com/u/marcinstec)\ **Post date:** [May 2, 2017, 1:32pm UTC](https://forums.suse.com/t/external-firewall-setup-to-enable-online-updates/29300/7 "2017-05-02T13:32:35Z")
I’ve just found my thread looking for other answers… Just for an update: It just needed some time. I left the system for couple of days, and late I accidentially ran zypper refresh, lr, patch and everything worked fine. It seems SCC needed some time to process the registrations.