topic Re: How to filter Office 365 in source NAT? in General Topics

How to filter Office 365 in source NAT?

chaminda.kiriwattuduwa — Tue, 06 Sep 2016 01:56:44 GMT

Hello,

We have a specific requriement to map Office 365 traffic to a specific source NAT to ensure we don't exceed the port limitation. The only way we can think of doing this is to include all the Office 365 IP address ranges in the destination of the source NAT configuration.

Has anyone accomplished this in a more elegant way? It is less than ideal to have a manual process to check an update Microsoft IP ranges as they change.

There is no application or URL match under the source NAT configuration, which would have been ideal. We are running 7.0.9,

Any ideas are welcome..

Thanks!

Re: How to filter Office 365 in source NAT?

reaper — Tue, 06 Sep 2016 08:32:03 GMT

a bit of a longshot: how about setting up a Policy Based Forwarding policy for the office365 application so it goes out of a different interface (you could use a different physical interface or a subinterface). you can then create a NAT rule that matches the destination interface of the PBF allowing you full control over the rest of the NAT features

Re: How to filter Office 365 in source NAT?

Brandon_Wertz — Tue, 06 Sep 2016 13:47:42 GMT

@chaminda.kiriwattuduwa Not sure if this fits for you guys, but a a portion of our O365 deployment we have EOP.

https://technet.microsoft.com/en-us/library/dn163583(v=exchg.150).aspx

Supposedly it's a pretty static list:

" Changes to the list of IP addresses are rare, and are communicated in advance"

Looks like there have been 3 changes each year - https://technet.microsoft.com/en-us/library/dn163581(v=exchg.150).aspx

Re: How to filter Office 365 in source NAT?

chaminda.kiriwattuduwa — Wed, 07 Sep 2016 04:53:12 GMT

We did think about this option. There is a bit more complexity involved as the new interface/subnet needs to be provisioned on the other end and then redistributed into dynamic routing protocols, so this will eb a last resort.

Re: How to filter Office 365 in source NAT?

chaminda.kiriwattuduwa — Wed, 07 Sep 2016 04:53:42 GMT

Thanks, looks like we have to go down this path as well.