Has anyone spotted any issues with internet service database (ISD) in 6.2.2

[James_G]

As title - not working for me in firewall policies

I have a ticket open, but wonder if anyone seen the same?

[boneyard]

didnt see an issue, how is it exactly not working?

[James_G · Accepted solution]

Logged support call, they pointed out behaviour changes in 6.2.2 (in release notes) where ISD is used for source addresses. I had to change the previous working config to a different ISD entry to get service back. The rule in question was for source addresses from Office 365 mail, had to change to a new entry called Office365.published.

[tanr]

@James_G, can you give more detail on why you had to change?  Did you have a source port specified?  Or was something else going on?

From the release notes: Only IP and Protocol are matched and source port is ignored when ISDB is applied as source in policy.  But it seems like this wouldn't usually cause issues.

[James_G]

Cut / paste from Fortinet support:

The root cause is that ISDB uses 3 parameters (protocol, port and IP address) to identify a service. In most cases, it is correct. Unfortunately, it is not true for the Office365 case as a source. As TCP traffic usually selects a random port as source port. So, we just ignore the port when identifying an Internet service as source. As an example, the traffic is simplified to <6, 0, 104.47.12.50> from <6, 38045, 104.47.12.50>. In the ISDB, this <6, 104.47.12.50> matches another internet service 327880. So, the traffic is getting recognized as 327880. Therefore, we are having an unmatched case.

[boneyard]

when would you use Office365 as a source?

[James_G]

Office 365 hybrid setup, the cloud based components need access to the on prem exchange ews virtual directory, but I want to prevent access to this resource from anywhere else on the net.

[boneyard]

ah interesting way to use it. would think that many of the IPs are just for incoming traffic towards Office.365, but i assume enough of them did work for this setup?

[James_G]

It's not perfect, the source could be from one of 40,000 IP address, but at lease them 40,000 IP address are from a trusted source (ish) and we prevent the other 4 billion address from getting access. No way to narrow this down further as the source totally changes time to time, as o365 tennents get moved around data centers.