Skip to main content
Ian_Harrison
Ian_Harrison
New Member
April 6, 2018
Question

Internet Service Database and IP addresses

  • April 6, 2018
  • 2 replies
  • 25807 views

Hi

 

With v5.6 I can now create policy rules that allow access for users based upon 'Internet Service Database' objects. Currently, I get notified from Microsoft about changes to the IP addresses they use for Office 365 etc.

 

Question: How up to date are the ISD objects and do they keep up to date with IP changes from Microsoft? This also applies to other providers such as Apple, Adobe etc.

 

More info from Microsoft: https://techcommunity.microsoft.com/t5/Office-365-Blog/Announcing-Office-365-endpoint-categories-and-Office-365-IP/ba-p/177638

 

Thanks

 

Ian

2 replies

romanr
romanr
New Member
April 6, 2018

Hey,

 

using ISDB rules was one of the main reasons for us to upgrade several installations to 5.6 for some of our customers - as we had to maintain the MS adresses regularily.

 

We did not see any troubles using ISDB adress objects for O365 and Skype4Business. For us this seems completely accurate.

 

Br,

Roman

daac
daac
New Member
May 3, 2018

Hello Could you point me out exactly what you created, policy routes with fqdn? or wilcard? Thank you

saneeshpv_FTNT
Staff
saneeshpv_FTNT
Staff
May 6, 2018

Hi

 

This rarely happens, but you have an option to write to ISDB Team so that the new IP's can be added to the list and available in the next updates.

 

https://fortiguard.com/faq/isdb-contact

 

Regards, Saneesh

daac
daac
New Member
May 11, 2018

Hello Thanks for your help, however I have a concern about the use of isdb in 5.6.3, I only see that it is possible to use it in static routes BUT if I have a static route created towards a ip xxxx with gateway yyyy that belongs to microsoft ( distance 10 priority 0) and create a static route with isb that includes microsoft (in the list is xxxx) and zzzz gateway by which route would it go? and how the election would be made if both would be static. This is because I have not managed to find much information and I have understood that the routing process (without dynamic protocols) would be something like policy route static route defined static route by default Thank you

boneyard
boneyard
Valued Contributor
May 19, 2018

after some trouble shooting and debugging i found out the ISDB routes act like policy routes, so while you configure them as static route they don't show up anywhere expect in the policy routing monitor (FortiOS 5.6+). this also means they have the same priority over regular routes as "normal" policy routes have.

 

might have been smarter if Fortinet would have added them as an option to the policy routes, then it would be clearer to understand how they work. now it suggests like they act like static routers which they clearly don't on several levels.

Terms & ConditionsAccessibility statement