Security policy that permits traffic to any *.office365.com ?

[Shuttermed]

I see there is an FQDN option for Destination Address when I create a security policy.

I want to permit port 993 to any host in office365.com. Will it work if I just put office.com

in the FQDN destination? Trying to put the * wildcard causes the widget to gray out the

OK button. Thanks!

[jvalentine]

MineMeld has the capability of downloading (from Microsoft) a comprehensive list of IP addressess used as part of their office365 platform.  MineMeld would then publish that list of IP addressess in a format that can be consumed by the firewall as part of an External Dynamic List (EDL) / Dynamic Address Group (DAG).  You would then use this dynamic group as the destination address in your security policy.

Here's the discussion forum for MineMeld:

 - https://live.paloaltonetworks.com/t5/MineMeld/ct-p/MineMeld

[Remo · Accepted solution]

Hi @Shuttermed

Besides this MineMeld has also a lot more use cases.

But just for this one in this topic, you could also create a custom url category for *.office365.com and reference this category directly in the security policy (not in the security profiles of the rule). This should work also as the firewall sees the hostname in the TLS handshake.

And to answer your initial question: it is not possible to create wildcard FQDN objects.

Regards,

Remo