Who Me Too'd this topic

In a distributed ISE deployment, which node actually goes out to Cisco.com for the updates?  The PAN's in this deployment are firewalled off, but the PSN's are not, so do I need to modify my FW rules to allow the PAN's to get out?

Dan