Internet Service combined with Geo-Blocking

[jokes54321]

Not too long ago, our cyber team asked us to implement geo-blocking to/from certain countries, which we obliged. Unfortunately, one of our locations can no longer reach a vendor portal they use because it's hosted in Microsoft's cloud in one of these countries with no fixed/static IP's.

In my lab, I was able to work around this by adding a policy allowing access to the Internet Service "Microsoft Azure", but our Cyber team isn't thrilled with how broad this Internet service is (over 50 million IP addresses). They now understand this will override all the other geo-blocking if Microsoft Azure is in the picture and they're not okay with this. 

I have no idea how to solve this. What I really need is a way to allow the vanity URL provided by the vendor, and have everything fed up from this URL to be allowed too. 

Looking for some suggestions on how to tackle this one?

Denny

[AEK · Accepted solution]

You might be looking for this:

https://docs.fortinet.com/document/fortigate/7.6.5/administration-guide/336471/allow-creation-of-isd...

[jokes54321]

I want to thank you for directing me to this feature. While it doesn't fully address our cyber teams concern, since it leaves Azure in this one country open, it closes the door on several others they're concerned about.  I feel it's an acceptable compromise, until a more robust solution can be implemented. 

Denny

[AEK]

Another solution would be to keep you geo-blocking rule as is, and simply add a new firewall rule on top of it to allow the vendor portal. I guess the vendor portal is reachable by FQDN, right? So you can create a FQDN object that will dynamically update the IP when it changes, and add this object as destination in the new firewall rule.

[jokes54321]

That was the very first thing we tried. Unfortunately, the vanity URL immediately redirects to a b2clogin.com URL, which resolves to numerous IP addresses depending on which DNS server is queried. 

Since I don't have a logon to the portal itself, it's been a bit of back and forth with the user spoon feeding partial screenshots. I don't know if after a successful logon it returns to the vanity URL or changes to something else. I am hoping to schedule a meeting with screenshare after the holidays to drill into it.  

I do appreciate the suggestions, 

Denny

[lithichok]

Hey, you've got it right. ISP proxies should handle geo-restrictions fine on their own since they use real ISP IPs that websites trust more. For just a month, ISP proxies alone are your best bet. I've had good results with decodo for bypassing geo-blocks – clean IPs and solid performance. Just make sure whatever provider you choose has fresh IPs that aren't already flagged.