Access from dynamic Office 365 URLs to internal ressources

cysec_wdr — Mon, 20 Jan 2020 15:40:13 GMT

Hello,

Im using minemeld to get the dynamic address (URLs, IPs) from office 365.

If there are IP addresses, this works without problems via the EDL. In this case the EDL replace the source object.

What about addresses that have a wildcard in the URL? These EDLs cannot be selected from the source object and must be saved using the URL pattern filter. In order to allow an access from the Internet from any "*.mircosoft.com" or just "microsoft.com" do I have to set the source ip-address to "Any" and set all categories except the EDL to block?

How do you allow access from the Internet via URLs?

Re: Access from dynamic Office 365 URLs to internal ressources

OtakarKlier — Tue, 21 Jan 2020 19:23:04 GMT

Hello,

So yes, you should have two policies. One for destination IP's and one for URL filtering. The firewall reads policies top to bottom and left to right. Meaning everything in the policy has to match before the firewall will use that policy.

i.e. if you have a policy that has a destination ip of 1.1.1.1 and a url filter to only allow google.com, the firewall will not use it since not all values are matched in the policy.

Hope that helps.

topic Access from dynamic Office 365 URLs to internal ressources in General Topics

Access from dynamic Office 365 URLs to internal ressources

Re: Access from dynamic Office 365 URLs to internal ressources