Hi,

I have made the following ConfigMgr 2012 R2 SP1 configuration:

Primary Site Server
 - MP, DP, SUP, EP, Reporting, DB

Site server (DMZ VLAN)
 - DP, SUP

We only have two sites in sites and services, one for inside and one DMZ. I use these as boundaries for the two site servers.
I use port 8530 for wsus and 80/445 for COnfigMgr.

I notice that the clients randomly pick one of the two WSUS servers. Is that by design or? I thougt that my boundaries would make sure that the clients in DMZ would be assigned the WSUS in DMZ and so on... Any ideas how to handle this? I have already tried to use IP subnets as boundaries instead of AD sites.
I can add their is actually open for port 80 from the dmz network to both the ConfigMgr Site server in DMZ and the primary site server.

Br

Thanks, very usefull information! I will then request to have port 8530 open from DMZ to Primary site server and consider to remove the SUP role from the DMZ Site Server again.

Br,
Thomas