Wildcard FQDN objects

[NetJO]

GoodMorning.

I'm trying to build a filter to allow access to MIcrosoft Office365 online services (Mail, above all) for a not-internet-allowed network.

The users on this network have to be able to use Office365 only.

The Microsoft documentation is a pain.

There are lots of IPs and, if you want to use FQDNs, they require the use of wildcard such as *.office365.com

I can create wildcard fqdn object, but I canont use them in a policy.

Is there a way to use wildcard FQDN objects with fortigate?

Is there an alternative way to build such a filter?

version v5.4.5,build1138 (GA)

Many thanks for your kind help

[EMES]

Your better off creating a one off Web filtering profile that's blocks all categories and then use the static filter to allow office365. You can then add an application senor to lock it down even further.

[acuity]

Hello NetJo,

there is a KB-article regarding this topic: http://kb.fortinet.com/kb/documentLink.do?externalID=FD35297

The suggested solution is to use the webfilter feature as mentioned before.

[NetJO]

Great idea.

I'm giving it a try.

Maybe you can help me a little further

I created the new WebFilter blocking all categories except "Local Categories".

I want to create a local category named, let's say, "allowed URLs" where I can put my wildcarded URLs, I think.

I'm not able to find the option to create the new Local Category and then configure it.

Could you kindly help me?

many thanks

[MikePruett]

You can use FQDN objects they just don't work that great. You will want to shorten the cache of dns queries on the box to as big services like O365 use the same domain but it hits a ton of other IPs.

[NetJO]

Office365 uses a ton of IPs, but also a ton of FQDNs.

I download the current xml https://support.content.office.net/en-us/static/O365IPAddresses.xml

I'll try to "summarize" someway wildcarding a little.

Maybe I'm on the right way.

I did the following.

1)

I created a webprofile tha deny all categories but a local category called "Office365"

2)

I populated the "Office365" category with some URLs.

To wildcard i simply omitted the firs part of the URL

For example, I used microsoft.com for *.microsoft.com

3)

I created an IPv4 policy that allows all traffic on http/https with the webfilter applied

It seems it's working.

The test clients are allowed to surf only  the allowed FQDNs

What I'm not able to do is deep nesting some custom categories

I mean...

Office365 has many services (Exchange, Skype...) and URLs for each product.Now I can select Category "Custom Categories" -> subcategory "Office365" where I add all the FQDNs

I'd like to be able to create a sub-subcategory of "Office365", for example called "Exchange", where to add only the URLs needed for Exchange service.

Is this someway possibile?

many thanks