topic Re: R80.20 Updatable Objects - Intune + Autopilot in Firewall and Security Management

R80.20 Updatable Objects - Intune + Autopilot

Shahar_Grober — Tue, 16 Apr 2019 11:06:42 GMT

Hi,

Are there updateable objects in R80.20 for Microsoft Intunes and Autopilot?

Intune:https://docs.microsoft.com/en-us/intune/network-bandwidth-use

Autopilot:https://docs.microsoft.com/en-us/windows/deployment/windows-autopilot/windows-autopilot-requirements-network

also, It would be nice if there could be a way to import/upload IP address xml, csv directly to the policy in R80.20 and not only via mgmt API. Or maybe there is something like this which I am not aware of

Re: R80.20 Updatable Objects - Intune + Autopilot

PhoneBoy — Fri, 19 Apr 2019 00:50:14 GMT

I believe we'll have some way to specify your Updatable Objects feed (or maybe upload one) in a later release.
As for Intune/Autopilot, I have not seen these listed in the services for Updatable Objects.
Doesn't mean it can't be added in the future.

Re: R80.20 Updatable Objects - Intune + Autopilot

Shahar_Grober — Sun, 21 Apr 2019 10:27:48 GMT

Thanks PB,

Is it possible to share it with R&D. I believe it is not a lot of effort to add Intune/Autopilot as Updatable Objects

Re: R80.20 Updatable Objects - Intune + Autopilot

Dima_M — Mon, 22 Apr 2019 11:50:18 GMT

Hi Shahar and all,

We're here and listening 🙂 More use cases and vendor suggestions are always welcome.

I'll be glad to discuss the use case further on, please drop me an email...

Thanks,

Dima

Re: R80.20 Updatable Objects - Intune + Autopilot

Luke_Pattison — Fri, 26 Apr 2019 11:47:56 GMT

Has anyone got this working for unattended out-of-the-box Autopilot deployments?

According to this link Intune is required for Autopilot:

https://docs.microsoft.com/en-us/windows/deployment/windows-autopilot/windows-autopilot-requirements-network

There is an AppControl object for Intune, but look into the detail and HTTPS inspection is required. How do you get a cert on to the device for HTTPS inspection when the whole point of Autopilot is to do a zero touch deployment on a fresh machine?

I've tried allowing the updatable objects for Azure Services and Office365 Services, but still get a whole heap of dropped packets to something.deploy.static.akamaitechnologies.com that aren't recognised as any particular app or URL.

I'm starting to think that the only option is to provision a separate build network to each building and just blacklist a few categories for inappropriate or high risk apps and URLs rather than try and make white-listing work. Any other ideas?

Re: R80.20 Updatable Objects - Intune + Autopilot

sajin — Thu, 02 Jan 2020 12:13:50 GMT

Hi, Updatable Object for INTUNE is now available and still am getting blocked by deploy.static.akamaitechnologies.com. Do we need to allow Azure Cloud object along with INTUNE to work correctly.

Re: R80.20 Updatable Objects - Intune + Autopilot

Martin_Webster — Mon, 13 Jan 2020 12:00:10 GMT

Hi,

I'm getting very similar issues. The following appear in my logs:

a104-75-172-68.deploy.static.akamaitechnologies.com (104.75.172.68)

a23-209-84-4.deploy.static.akamaitechnologies.com (23.209.84.4)

a23-216-100-183.deploy.static.akamaitechnologies.com (23.216.100.183)

a95-100-144-120.deploy.static.akamaitechnologies.com (95.100.144.120)

Intune has made a lot of noise go away.

When will Autopilot be available as an Updatable Object?

Re: R80.20 Updatable Objects - Intune + Autopilot

PhoneBoy — Mon, 20 Jan 2020 21:34:20 GMT

Probably best to get the TAC involved if you haven't already.

Re: R80.20 Updatable Objects - Intune + Autopilot

Shahar_Grober — Wed, 05 Feb 2020 05:53:52 GMT

the problem with intune and autopilot is that it uses many URLs that are not listed anywhere and unfortunately, you have to allow them manually

TAC will not able to assist in this case

a Tip from CPX: Try to contact Check Point overlay team via your local office, they might be able to assist

Re: R80.20 Updatable Objects - Intune + Autopilot

Shahar_Grober — Wed, 26 Feb 2020 17:06:33 GMT

Quick update, I can see in SDB that Intune was added as an Updatable object.

There is a relatively new SK about it

https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk163994&partition=Advanced&product=Security

I am testing to see if it is solving intune/autopilot issues. Will update as soon ...

Re: R80.20 Updatable Objects - Intune + Autopilot

upmitnetworksec — Wed, 13 May 2020 11:49:25 GMT

Hello,

can anyone suggest if we allow Microsoft Intune + azure + office 365 updatable object then is it completing the requirement of Windows autopilot and is below URL;'s working when we allow those.

if not then how we can complete the project requirement in checkpoint(Allow Windows Autopilot )

Need urgent help on this.

a104-75-172-68.deploy.static.akamaitechnologies.com.

https://docs.microsoft.com/en-us/windows/deployment/windows-autopilot/windows-autopilot-requirements

Re: R80.20 Updatable Objects - Intune + Autopilot

Shahar_Grober — Wed, 13 May 2020 11:52:09 GMT

Intune updatable object should do the Job
and also remove https inspection if possible

Re: R80.20 Updatable Objects - Intune + Autopilot

upmitnetworksec — Wed, 13 May 2020 11:54:29 GMT

is a104-75-172-68.deploy.static.akamaitechnologies.com.workign in Intune Updatebale objects because i can see above users' reply it is not working.

Re: R80.20 Updatable Objects - Intune + Autopilot

upmitnetworksec — Wed, 13 May 2020 11:58:21 GMT

is a104-75-172-68.deploy.static.akamaitechnologies.com.working in Intune Updatebale objects because I can see above users' reply it is not working.

Re: R80.20 Updatable Objects - Intune + Autopilot

Shahar_Grober — Wed, 13 May 2020 14:42:02 GMT

depends on your policy
This eventually should point you to Microsoft service

Re: R80.20 Updatable Objects - Intune + Autopilot

upmitnetworksec — Wed, 13 May 2020 16:30:32 GMT

Hello,

Thanks for reply,But i didn’t get your point what is the policy means ?

if i allow microsoft intune + azure + Office 365 updatebale objects so deploy.static.akami url work or not.

Because i can see when autopilot runs first request goes for Akami url’s.

If this will not allow Akami url,s the window autopilot won’t work.

Have you tested in your environment while allowing updateable objects.

Re: R80.20 Updatable Objects - Intune + Autopilot

Shahar_Grober — Wed, 13 May 2020 16:38:58 GMT

on my environment it is working when we added intune updatable objects but we don't block access to Akamai. eventually akamai will resolve to a Microsoft/FQDN IP so the question if you block access to Akamai in your policy.
if you want to know if under the hood the updatable object contains this url, you will have to ask Check Point support.
I can tell you that we had some issues with https inspection and we had to exclude it from the networks that used for autopilot

Re: R80.20 Updatable Objects - Intune + Autopilot

upmitnetworksec — Wed, 13 May 2020 16:53:21 GMT

Hello,

we only allow the networks in firewall so could you please tell me how i can allow the Akami in our firewall and as of now Url filtering is not enabled.

Also,we have any any drop in our firewall.(Clean up rule)

so not getting any idea how i can allow Akami in My firewall.

Thanks,

Re: R80.20 Updatable Objects - Intune + Autopilot

Netadmin2020 — Thu, 25 Mar 2021 18:23:41 GMT

It s been almost 2 years from the first post. Is there a solution? I have all microst, azure,I tune updatable objects attached but still there are some destinations that are dropped. Thank you

Re: R80.20 Updatable Objects - Intune + Autopilot

Giorgio_Giustoz — Wed, 27 Oct 2021 06:29:30 GMT

Hi, I don't think this is the best solution after 2 years from (R80.20 to R81). There is some news or updates about this issue?

Thank you!