Internet Service combined with Geo-Blocking

[jokes54321]

Not too long ago, our cyber team asked us to implement geo-blocking to/from certain countries, which we obliged. Unfortunately, one of our locations can no longer reach a vendor portal they use because it's hosted in Microsoft's cloud in one of these countries with no fixed/static IP's.

In my lab, I was able to work around this by adding a policy allowing access to the Internet Service "Microsoft Azure", but our Cyber team isn't thrilled with how broad this Internet service is (over 50 million IP addresses). They now understand this will override all the other geo-blocking if Microsoft Azure is in the picture and they're not okay with this. 

I have no idea how to solve this. What I really need is a way to allow the vanity URL provided by the vendor, and have everything fed up from this URL to be allowed too. 

Looking for some suggestions on how to tackle this one?

Denny

[AEK]

You might be looking for this:

https://docs.fortinet.com/document/fortigate/7.6.5/administration-guide/336471/allow-creation-of-isd...

[lithichok]

Hey, you've got it right. ISP proxies should handle geo-restrictions fine on their own since they use real ISP IPs that websites trust more. For just a month, ISP proxies alone are your best bet. I've had good results with decodo for bypassing geo-blocks – clean IPs and solid performance. Just make sure whatever provider you choose has fresh IPs that aren't already flagged.