Which Port Does the SUS Client Use to Connect When Set to Use the Microsoft Windows Update Server?

Does anyone know which port the SUS client tries to connect to when it's set to use Microsoft Windows Update server (not the local SUS)? Is it TCP 80? We have two groups of machines in the office: ones that are getting updates via SUS and others that are set not to use SUS but rather download and notify updates directly from the Microsoft Windows Update site and prompt for installation.

Hosts in the first group get updated just fine, hosts in the second get:

"Unable to connect: Windows is unable to connect to the Automatic Updates service and therefore cannot download and install updates according to the set schedule. Windows will continue to try to establish a connection."

Since we're blocking some outbound traffic (TCP 80 included, since HTTP traffic is routed via a Proxy), I suspect that's what's causing the problem.

From the microsoft.public.softwareupdatesvcs newsgroup
The Automatic Update client uses port 80 and 443 when connecting to the external site. Port 80 is used to download 'IUIDENT.CAB', Port 443 is used to do detection over SSL, and then Port 80 is used again to download the actual updates through BITS.

Both AU and BITS are capable of using Proxies, but only if the Proxy information either exists explicitly in the localsystem hive of the registry, or autoproxy is enabled (this is an operating system default) and you are using WAPD files to define the proxies.