topic Re: Updatable Objects R80.20 in Firewall and Security Management

Updatable Objects R80.20

Geomix7 — Thu, 20 Aug 2020 07:30:52 GMT

Hello Guys ,

We are going to use Updatable Objects for Office 365. Some questions that arises and i would like to hear some suggestions from people that tested it.

Those services is a combination of IP addresses & domains .How an IP address (mechanism) is checked to verify if match for a domain which is included in Office 365?
How this Mechanism works?
Where to position this rule in rule base and why?
Any performance impact?
Known issues ?
Any impact in DNS server?

Thanks in advanced!

Re: Updatable Objects R80.20

G_W_Albrecht — Thu, 20 Aug 2020 08:07:09 GMT

Please consult the following:

sk131852: Updatable Objects in R80.20 and above

sk135572: Microsoft Office 365 objects as Network Objects in R80.20 and above

sk122636: How to troubleshoot Updatable Objects in R80.20 and higher

Re: Updatable Objects R80.20

Geomix7 — Thu, 20 Aug 2020 08:14:36 GMT

Hello Albrecht ,

I already read those SKs and still my questions not answered.

Thanks

Re: Updatable Objects R80.20

_Val_ — Thu, 20 Aug 2020 08:36:35 GMT

Hi @Geomix7 , I tend to agree with @G_W_Albrecht that most of your questions are actually answered in the quoted solutions. Nevertheless, let me answer to those questions directly:

Q: Those services is a combination of IP addresses & domains .How an IP address (mechanism) is checked to verify if match for a domain which is included in Office 365? How this Mechanism works?

A: List of IPs and domains is pulled from the source. Domain objects are also resolved into IP addresses.

Q: Where to position this rule in rule base and why?

A: Updatable objects can be used in the rulebase at will. As they are SXL-friendly, position does not matter.

Q: Any performance impact?

A: Practically no impact.

Q: Known issues ?

A: Specifically for O365, sometimes resolution of MS wild card objects can be incomplete, for certain sub-domains. These occurrences are very rare, but if you experience one, feel free to address it with a support ticket.

Q: Any impact in DNS server?

A: Some unfrequent periodical DNS requests are being sent by FW, but the amount of those is not high at all, and will not affect DNS servers much.

I hope this helps.

Re: Updatable Objects R80.20

Cyber_Serge — Fri, 21 Aug 2020 18:29:06 GMT

Anyone experience issue with updatable objects? I notice in the management dashboard under Validation tab it's showing several objects "is no longer supported". I've seen Microsoft Dynamic CRM Service, Amazon Web Services, Webex Services....even location object United States and Canada.

Is it trying to tell us to upgrade from R80.20 to R80.40?

Re: Updatable Objects R80.20

Fadi_Moussa — Mon, 24 Aug 2020 07:45:49 GMT

Hi Frank-Yao1

This is a known issue that was solved in newer releases, and we are currently working on porting the fix To JHF of other versions.

Meanwhile please use the following Workaround on your management server:

cloudguard stop
cloudguard start

can you please verify if this solves your issue?

Thanks

Fadi

Re: Updatable Objects R80.20

sajin — Fri, 09 Oct 2020 17:38:05 GMT

Hi,

In the Updatable Object rule for O365 we are receiving logs accepted to Yahoo domain and crosschecked those IP. Those IP are mapped to Yahoo domain.

But the ports are SMTP, TCP 587, IMAP, POP3.

I had attached the screenshot of the logs. Please verify.

Regards,

sajin

Re: Updatable Objects R80.20

Micky_Michaeli — Mon, 12 Oct 2020 09:14:26 GMT

Hi,

Updatable Objects can be used in Source and Destination columns only, so it matched only according to IPs (and domains which resolved to IPs).

Updatable Objects are not including ports information.

As part of Office365 Services we have an object called "Office365 Third Party Domains" which includes domains as Yahoo which are derived from MS feed.

Customers would like to avoid getting matches on 3^rd party domains, should use the child object called “O365 worldwide services” and not the parent object.

Thanks,

Micky