topic Re: Fortinet Migration - Internet Services Database objects conversion to Palo Alto in Expedition Discussions

Fortinet Migration - Internet Services Database objects conversion to Palo Alto

Gordan — Thu, 22 Dec 2022 11:03:16 GMT

A Fortigate firewall uses Fortinet 'Internet Services' objects. There are many of them, they are predefined and some of them contain several tens of thousands of IP addresses (Amazon-AWS object, for example currently contains 75114 objects, there are various objects for Microsoft services, Adobe services, etc).

Expedition tool converts those multiple (destination) objects as 'all', therefore creating an 'allow all' rule (from the defined source to all objects in the destination zone (Internet) allowing all services and with all applications.
This does not seem right because it essentially nullifies all other, tight, rules from the source address.
Is there any way to avoid this and create tight rules for these services?

Re: Fortinet Migration - Internet Services Database objects conversion to Palo Alto

Metgatz — Fri, 30 Dec 2022 20:00:30 GMT

Hello @Gordan

In Palo Alto there is no such thing as an internet service database.

It has for Microsoft services example EDL that you can generate for this.
https://docs.paloaltonetworks.com/resources/edl-hosting-service

EDLs are dynamic lists containing the IP URL domains of certain Microsoft 365, Azure, AWS, Salesforce, GCP services for example provided by Palo Alto but you can also generate your own.

Here although it sounds like a bit more effort, I recommend the following:

That you identify in Fortinet those policies with Internet Service Database and rule by rule, filter in fortinet the destinations either URLs, IPs, domains, subdomains, and based on that information that you collect you close the any rules in Palo Alto, only with the destinations that you need and thus avoid those any.

Cheers