×
×
×
×

Patch Management for Closed Networks

Last Updated On: 28 Aug 2026|
20 minutes read |

This page explains how to configure Endpoint Central for environments where the server has no direct Internet access — covering proxy settings, patch database configuration, vulnerability database synchronization, and manual patch download and deployment. The standard workflow uses the lightweight Closed Network Tool, while Red Hat and SUSE systems require a separate Internet-connected Endpoint Central server because access to their patch repositories must be authenticated.

Note
In this document, the term Closed Network describes any environment where the Endpoint Central server does not have direct Internet access. This includes secured internal networks, DMZ environments, and fully air-gapped environments. The workflow described here is determined by Internet connectivity restrictions, not by network placement or topology.
Diagram showing the closed network patching workflow in Patch Manager Plus — an Internet-connected machine downloads patches and vulnerability data, which are then transferred manually to the isolated Patch Manager Plus server
Overview of the closed network patching workflow — patches and vulnerability data are downloaded on an Internet-connected machine and transferred manually to the isolated server.

Overview

When Endpoint Central is deployed in an environment without direct Internet access, core patching functions — such as vulnerability database synchronization, automatic patch downloads, and vendor update retrieval — cannot be performed online.

This limitation applies to closed networks where outbound Internet connectivity is intentionally blocked, regardless of where the server is placed. A Demilitarized Zone (DMZ) is one such placement scenario — a segmented network zone positioned between an internal network and external or untrusted networks, designed to host systems that require strict access control and isolation. While DMZs can allow tightly controlled Internet access, they are frequently configured without outbound connectivity in high-security environments, effectively operating as closed networks.

In more restrictive setups, such as air-gapped networks, the server is fully isolated with no physical or logical connectivity to external networks. Although these environments differ in topology and isolation level, they share a common constraint: the server cannot communicate directly with external update sources. As a result, patching and vulnerability remediation must be performed using offline or manual workflows.

The following steps explain how to complete this process end-to-end:

  1. Configure Proxy Settings
  2. Configure Patch Database Settings
  3. Download and set up the Closed Network Tool
  4. Configure closed network patching for Red Hat and SUSE
  5. Update the Vulnerability Database
  6. Download and deploy the required patches

Configure Proxy Settings

Configure the proxy settings in the Endpoint Central console to indicate that the server has no direct Internet connection.

  1. Open the Endpoint Central console and navigate to Admin → Server Settings → Proxy Server.
  2. Click Edit under the Proxy Server icon.
  3. Select No connection to Internet.
  4. Click OK to save changes.
Patch Manager Plus Proxy Server Settings screen showing the No connection to Internet option selected
Proxy Server Settings — selecting No connection to Internet for closed network environments.

Configure Patch Database Settings

Disable the automatic vulnerability database sync schedule to prevent failed sync attempts before the required data has been placed in the server directory.

  1. Open the Endpoint Central console and navigate to Admin → Patch Settings → Patch Database Settings.
  2. Under Schedule Vulnerability Database Update, disable the Schedule toggle.
Patch Manager Plus Patch Database Settings screen showing the Schedule Vulnerability Database Update toggle in the disabled state
Patch Database Settings — disabling the Schedule Vulnerability Database Update toggle for closed network environments.
Note
Disabling the schedule prevents the DB sync from being triggered before the required data is placed in the <InstallDirectory>/conf/CRSData directory. The updatedb folder in that directory is erased after a successful sync, so a subsequent sync will fail if the folder has not been repopulated with fresh data.

Download and Set Up the Closed Network Tool

The Closed Network Tool is used on an Internet-connected machine to download vulnerability data and patch files for manual transfer to the isolated server. This setup is a one-time operation.

Note
The Closed Network Tool supports the standard closed network workflow for other operating systems. It cannot be used to download Red Hat or SUSE patch data. To manage these systems, set up a separate Internet-connected Endpoint Central server as described in Configure Closed Network Patching for Red Hat and SUSE.
  1. Download the UpdateManager.zip file and extract it on a computer that has Internet access.
  2. The tool is ready to use. Proxy and tool configuration are one-time operations. Updating the vulnerability database and downloading patches must be repeated each time you want to scan for vulnerabilities and deploy the latest missing patches.
Note
  • If the Internet-connected computer itself uses a proxy, open the downloadMgr.prop file in the extracted directory and provide the proxy server address, port, and authentication details.
  • If you are running a TAA-compliant Patch Manager Plus Server, download the Closed Network Tool from this link instead.

Configure Closed Network Patching for Red Hat and SUSE

Red Hat and SUSE systems use a different closed network workflow. Instead of the lightweight Closed Network Tool, they require a second Endpoint Central server with Internet access. This Internet-connected server works alongside the closed network server and must run the same product build version.

Architecture diagram showing how an Internet-connected Patch Manager Plus server downloads authenticated Red Hat and SUSE patch data and transfers it to the closed network server
Red Hat and SUSE closed network patching architecture — the Internet-connected server downloads authenticated patch data, which is manually transferred to the closed network server.

Why an Internet-Connected Server Is Required

Red Hat and SUSE require authenticated access to download both the offline metadata used to identify missing patches and the patch and dependency packages required for deployment:

  • Red Hat: Upload a valid Red Hat certificate to the Internet-connected server.
  • SUSE: Provide a valid SUSE registration token on the Internet-connected server.

The Closed Network Tool is designed for one-time data export and does not maintain the credentials or authenticated connection required by these vendors. Therefore, a full Internet-connected server is required for Red Hat and SUSE patch downloads.

Add Matching Red Hat and SUSE Systems

Add a matching registered system to the Internet-connected server for every Red Hat edition or SUSE flavor managed in the closed network:

  • For Red Hat, install the agent on a registered system for each edition in use, such as Server, Workstation, or Desktop. To know detailed steps of Red Hat patching refer to this page.
  • For SUSE, add a registered SUSE system for each flavor being managed. To know detailed steps of SUSE patching refer to this page.

You only need to add the editions and flavors present in the closed network. Without a matching system, the Internet-connected server cannot download the corresponding offline metadata and dependency packages.

Synchronize Red Hat and SUSE Patch Data

After configuring the required credentials and adding the matching systems, synchronize the patch data between the two servers:

  1. On the Internet-connected Endpoint Central server, initiate DB Sync.
  2. Initiate Package Manager File Download. This authenticated operation downloads the offline metadata and required dependency packages from Red Hat or SUSE.
  3. After the download is complete, locate the UpdateDB folder in the Internet-connected server's home directory.
  4. Manually copy the UpdateDB folder to <Server Home>/conf/CRSData on the closed network server.
  5. On the closed network server, initiate DB Sync and Package Manager File Download. These operations process the transferred files locally and do not require Internet access.
  6. Scan the Red Hat and SUSE systems to identify missing patches, and then deploy the required updates.
Note
Whenever new patch data is required, repeat the synchronization and manual transfer process. Ensure that both servers continue to run the same Endpoint Central build version.

Update the Vulnerability Database

Run the Closed Network Tool on the Internet-connected machine to download the latest vulnerability data, then transfer it to the Endpoint Central server and trigger a database update.

Run the Tool on Windows

  1. On the Internet-connected machine, open a command prompt and navigate to the directory where you extracted UpdateManager.zip.
  2. Execute the appropriate command for the operating systems you manage:
    • Windows and Mac only:
Windows/Mac — update vulnerability database
patchsync.bat -c updatedb -b <BUILD_NUMBER>
  • Windows, Mac, and Linux:
Windows/Mac/Linux — update vulnerability database
patchsync.bat -c updatedb -i linux -b <BUILD_NUMBER>
Note
Replace <BUILD_NUMBER> with the build number of your installed Endpoint Central server. Ensure the format is correct — for example, 11.3.2400.1 or 113240001. You can find the build number by clicking your profile icon in the top-right corner of the console.
Patch Manager Plus console top-right profile menu showing the build number location
Build number location — click the profile icon in the top-right corner of the Patch Manager Plus console.
  1. The command downloads the latest vulnerability information from the Central Vulnerability Database to the local machine. After the download completes, the data is saved to the updatedb directory in the extracted tool location.
  2. Copy the updatedb directory to the Endpoint Central server at <Installation Directory>/conf/CRSData.
Warning
Before copying, if an updatedb folder already exists in <Installation Directory>/conf/CRSData, delete it first, then replace it with the latest version. Do not delete or modify any other contents of the CRSData folder — doing so may disrupt patch management in closed networks.
  1. In the Endpoint Central web console, navigate to Threats & Patches → Update Now and click the Update Now button under Update Vulnerability DB. This copies the data from the updatedb directory into the local database, giving the server the latest patch information.
  2. Scan the computers in the network to identify missing patches.
Note
You will not be able to view all missing patches until scanning is completed for all computers. Ensure that every computer has been scanned before proceeding to the patch download step.

Download and Deploy the Required Patches

Export the missing patch details from the console, use the Closed Network Tool to download the patch files on the Internet-connected machine, transfer them to the server, and then deploy from the Downloaded Patches view.

  1. In the Endpoint Central console, navigate to the Missing Patches view, select the patches to be downloaded, and click the Export Missing Patches button. This exports the details of all missing patches, including dependent patches, as a file named downloadUrlJson.txt.
Patch Manager Plus Missing Patches view showing selected patches and the Export Missing Patches button highlighted
Missing Patches view — select the required patches and click Export Missing Patches to generate the downloadUrlJson.txt file.
  1. Copy downloadUrlJson.txt to the directory on the Internet-connected machine where you extracted UpdateManager.zip.
  2. Open a command prompt on that machine and run:
Download missing patches
patchsync.bat -c dwnpatch -f downloadUrlJson.txt
  1. After all files have downloaded, copy the contents of the store directory to the Endpoint Central server at <Installation_Dir>/webapps/DesktopCentral/Store. This is the default location. If the store path has been changed, copy the files to the configured location.
  2. In the console, open the Downloaded Patches view and click Update Downloaded Patches to register the copied patches in the server database.
Patch Manager Plus Downloaded Patches view showing the Update Downloaded Patches button
Downloaded Patches view — click Update Downloaded Patches to register manually transferred patch files in the server database.
  1. All manually downloaded patches will now appear in the Downloaded Patches view and can be deployed to the required computers.

Patch management has now been successfully configured for the closed network environment.

Running the Tool in a Linux Environment

Use the shell script equivalents of the Windows commands when the Closed Network Tool is run on a Linux machine.

Linux Commands

Update the vulnerability database for Windows and Mac:

Linux — update vulnerability database for Windows and Mac
./patchsync.sh -c updatedb -b <BUILD_NUMBER>

Update the vulnerability database for Windows, Mac, and Linux:

Linux — update vulnerability database for Windows, Mac, and Linux
./patchsync.sh -c updatedb -i linux -b <BUILD_NUMBER>

Download missing patches:

Linux — download missing patches
./patchsync.sh -c dwnpatch -f downloadUrlJson.txt

Prerequisites — Java Version

Before running the tool on Linux, ensure the correct Java version is installed and JAVA_HOME is set accordingly.

Java 8 Builds

Ensure jre_1_8_0_192 is installed and set JAVA_HOME as:

JAVA_HOME — Java 8
/usr/lib/jvm/jre_1_8_0_192

Java 11 Builds

Install java-11-openjdk-amd64 and set JAVA_HOME as:

JAVA_HOME — Java 11
/usr/lib/jvm/java-11-openjdk-amd64
Note
Office patches will not be downloaded in a Linux environment.

After completing the Java prerequisites, follow the steps in Download and Set Up the Closed Network Tool to proceed.

Related