Windows 10 download fails to BITS range requests being blocked by the firewall.

Question

I just deployed a new Sophos XG firewall and discovered that Windows 10 upgrade requests are failing with the error code 80200013. This it seems is tied to the act that BITS range requests are being blocked. How can this be allowed to endpoints? 
 The download works from the same PCs if the XG is bypassed.

IbrahimFofana · Answer

You can temporarily disable the AV scanning in your firewall policies since the device sees the extended range packets coming in as possible malware due to the fact that they are out of sequence. 
 That's how I got it to work. Hopefully with future releases of the XG, an enable range request option will be provided. 
 Thanks.

PaesslerAG · Answer

Hi jsybhdu, 
 What ended up finally working to allow Windows 10 machines to update Office 2016 was putting the following domain names into the Exceptions List: 
 officecdn.microsoft.com.edgekey.net officecdn.microsoft.com.edgesuite.net officecdn.microsoft.com 
 I did this by going to Web Protection ->Filtering Options ->Exceptions 
 There I created a new Exception List with only the Antivirus under Skip these checks checked and added the domains exactly how you see the above to the target domains with the option matching these URLS selected . Once I did that, Office 2016 was able to update without further issues.

JacobRodriguez · Answer

Adding the exceptions microsoft.com and windowsupdate.com in Web Content Filter policy worked for me. 
 I was having trouble with windows updates, installing Office and downloading Windows ISO with Windows Media Creation Tool but those exceptions fixed all of those.

GeraldBossert-Stumvoll · Answer

That helped in my case with firmware SFOS 16.01.1: 
 
 Protect - Web - Exceptions 
 Enable the preset "Microsoft Windows Update"