O365 URL rewrite

[ckemp]

I'm using minemeld to pull the O365 urls into my PAN. I get a list that has entries like
*.domain.com
sub.domain1.com

I need to import those entries and rewrite them so they look like
*.domain.com/
domain.com/
*.sub.domain1.com/
sub.domain1.com/

Any pointers would be appreciated.

[lmori · Accepted solution]

Hi @ckemp,

are you adding ?v=panosurl at the end of your feed URL?

The link in the EDL config should have the form:

https://<minemeld>/feeds/<feedname>?v=panosurl

[lmori]

Hi @ckemp,

could you tell us more about this rewrite? Why is that needed?

[ckemp]

We use an External Dynamic List from minemeld to ingest Office 365 URLs and IPs into PAN. Microsoft presents the urls as *.skype.com. If I go to www.skype.com, I get access. If I go to skype.com, I am blocked. I understand the “*” is a token and PAN expects to find something there, such as “www”, not for to be empty or null. This is a problem. I’m not sure how to manage this other than parse the list again for every *.domain.com entry create a domain.com entry.

[lmori]

Hi @ckemp,

what version of PAN-OS are you running on? I think the matching behavior was changed to let *.skype.com match also skype.com at some point. 

Thanks,

luigi

[ckemp]

I’m running 8.1.4.

[eyunghans]

I've confirmed this is the behavior on v8.1.5 as well, a specific entry for the root domain is required as a wildcare does not function.

@lmori what would be the best way to file this?

[lmori]

@eyunghans thanks for testing this. I am working on it. The plan is to enhance panosurl modifier to translate *.domain.com into domain.com and *.domain.com in the generated feed.

[ckemp]

Any ETA on when this would be available? 

[lmori]

Just merged the PR to the develop branch on github:

https://github.com/PaloAltoNetworks/minemeld-core/pull/307

This will be in the next release. You can test it now if you use the Ansible playbook.

[ckemp]

We do not use Ansible playbook. Do you know when the next release will be available?