Network Segments and SUS

Wouldn't that external range include all of your internal ranges?

@bog, No, thats not the way Network Segments work. You can define an "Internet" segment that encompasses all your internal smaller segments, but those smaller ones will still apply to any Macs that fall into them properly. That's essentially how we have things set up. As many Network Segments as we were able to identify were created in the JSS, and then we have a global "internet" one for any Macs that don't fall into any of those more specific ones.

@dyossi, as for how to get your Macs to point to Apple's SUS., I actually thought there was a built in "apple.com" one as part of the JSS, but looking again I only see "No Software Update server". I'm not sure if that actually reverts them back to apple.com or not though. I guess you can give it a try and see.

Edit: Ah, I know where the 'apple.com' address shows up now. In a policy within the Override default policy settings > Software Update Server list, but that may not actually help you in this case.

@bog, just to echo @mm2270 that's what we do & it works well.

@dyossi there is also the JAMF binary command:

sudo jamf removeSWUSettings

If using self service or a policy, you could scope it to the external network segment. Then run the above command before performing a software update.