SCCM 2012 List of Websites required for Software Update(SUP) Sync: Below sites are required to be allowed from Firewall to Sync with Microsoft Update.
If your organization does not allow the ports and protocols to be open to all addresses on the firewall between the active software update point and the Internet, you can restrict access to the following domains, so that WSUS and Automatic Updates can communicate with Microsoft Update: