topic EDL Category Explanation - Teams in Next-Generation Firewall Discussions

EDL Category Explanation - Teams

NGJ1 — Tue, 16 Jan 2024 17:13:44 GMT

Can someone explain the difference between the EDL categories published as part of the EDL Hosting Service

I.e. looking at the Teams worldwide IPv4 EDLs, there are 4 categories (Base, Allow, Optimise & Required).

The EDL Hosting page doesn't state the difference between each.

EDL Hosting Service (paloaltonetworks.com)

Once all duplicates are removed, the Base, Allow & Required lists have the exact same 16 entries (as of 16th Jan 2024). Therefore, why are there separate lists, was there ever an intended difference that has been lost over time?

Also the differences for the URL EDLs. i.e. the Teams URL EDLs, do have differences. What is the reason, is there a recommended one to use.

Any help to clear this up appreciated.

Thanks

Re: EDL Category Explanation - Teams

reaper — Wed, 17 Jan 2024 12:18:29 GMT

that's actually how microsoft lists them:

https://learn.microsoft.com/en-us/microsoft-365/enterprise/urls-and-ip-address-ranges?view=o365-worldwide

optimize are the ones they recommend you not decrypt and where possible split tunnel for direct access versus via tunnel)

required are the minimum ones you need to get teams to work

allow and default somewhat overlap and some of both are in the "required"

the leftovers i assume are for certain functionality/accessibility (MS lists contact pictures retrieval and conference room systems)

Re: EDL Category Explanation - Teams

NGJ1 — Wed, 17 Jan 2024 16:59:17 GMT

Thanks for the information. Didn't realise it's how Microsoft classes them, just assumed it was a Palo Alto classification. I have now found Microsoft guidelines on this also. i.e.

Office 365 URLs and IP address ranges - Microsoft 365 Enterprise | Microsoft Learn