- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Wildcard FQDN objects
GoodMorning.
I'm trying to build a filter to allow access to MIcrosoft Office365 online services (Mail, above all) for a not-internet-allowed network.
The users on this network have to be able to use Office365 only.
The Microsoft documentation is a pain.
There are lots of IPs and, if you want to use FQDNs, they require the use of wildcard such as *.office365.com
I can create wildcard fqdn object, but I canont use them in a policy.
Is there a way to use wildcard FQDN objects with fortigate?
Is there an alternative way to build such a filter?
version v5.4.5,build1138 (GA)
Many thanks for your kind help
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello NetJo,
there is a KB-article regarding this topic: http://kb.fortinet.com/kb/documentLink.do?externalID=FD35297
The suggested solution is to use the webfilter feature as mentioned before.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Great idea.
I'm giving it a try.
Maybe you can help me a little further
I created the new WebFilter blocking all categories except "Local Categories".
I want to create a local category named, let's say, "allowed URLs" where I can put my wildcarded URLs, I think.
I'm not able to find the option to create the new Local Category and then configure it.
Could you kindly help me?
many thanks
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You can use FQDN objects they just don't work that great. You will want to shorten the cache of dns queries on the box to as big services like O365 use the same domain but it hits a ton of other IPs.
Mike Pruett
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Office365 uses a ton of IPs, but also a ton of FQDNs.
I download the current xml https://support.content.office.net/en-us/static/O365IPAddresses.xml
I'll try to "summarize" someway wildcarding a little.
Maybe I'm on the right way.
I did the following.
1)
I created a webprofile tha deny all categories but a local category called "Office365"
2)
I populated the "Office365" category with some URLs.
To wildcard i simply omitted the firs part of the URL
For example, I used microsoft.com for *.microsoft.com
3)
I created an IPv4 policy that allows all traffic on http/https with the webfilter applied
It seems it's working.
The test clients are allowed to surf only the allowed FQDNs
What I'm not able to do is deep nesting some custom categories
I mean...
Office365 has many services (Exchange, Skype...) and URLs for each product.Now I can select Category "Custom Categories" -> subcategory "Office365" where I add all the FQDNs
I'd like to be able to create a sub-subcategory of "Office365", for example called "Exchange", where to add only the URLs needed for Exchange service.
Is this someway possibile?
many thanks