topic Re: Dynamic Objects in R80.10 in Firewall and Security Management

Dynamic Objects in R80.10

Gaurav_Pandya — Thu, 26 Oct 2017 09:55:33 GMT

Hi All,

I came to know the feature of R80.10 that we can make the dynamic objects for Microsoft services and others.

Prerequisite for both Mgmt and Gateway : R80.10 with Take 24 HFA.

Configuration

In SmartConsole, go to the Objects Explorer (in the upper right corner).
Click on the .. button - go to the More menu - go to the Network Object menu - go to the Dynamic Objects menu - click on the Dynamic Object...:

Name the dynamic object with the specific Office365 service name as specified in the table below (Important Note: The names are case sensitive).

Description of Office 365 service	Name of Check Point Dynamic Object	Name in Microsoft feed
All Office 365 services	CP_MS_Office365	-
Exchange Federation	CP_MS_EX-Fed	EX-Fed
Exchange Online	CP_MS_EXO	EXO
Exchange Online Protection	CP_MS_EOP	EOP
Microsoft Digital Note	CP_MS_OneNote	OneNote
Microsoft Teams	CP_MS_Teams	Teams
Office for iPad	CP_MS_OfficeiPad	OfficeiPad
Office Mobile	CP_MS_OfficeMobile	OfficeMobile
Office Online	CP_MS_WAC	WAC
Office 365 Authentication and Identity	CP_MS_Identity	Identity
Office 365 Certificate Revocation Lists	CP_MS_CRLs	CRLs
Office 365 Portal and shared	CP_MS_o365	o365
Office 365 ProPlus	CP_MS_ProPlus	ProPlus
Office 365 Video and Microsoft Streams	CP_MS_Office365Video	Office365Video
Office 365 Yammer	CP_MS_Yammer	Yammer
Office 365 Sway	CP_MS_Sway	Sway
Remote Connectivity Analyzer	CP_MS_RCA	RCA
SharePoint Online and OneDrive for Business	CP_MS_SPO	SPO
Skype for Business Online	CP_MS_LYO	LYO
Task Management for Teams	CP_MS_Planner	Planner

Create the relevant access policy rule.

Publish the session and install the policy.

Re: Dynamic Objects in R80.10

Mike_Buglass — Fri, 27 Oct 2017 11:42:49 GMT

Are these really defined automatically? Values for dynamic objects are defined on gateways, and while this could be done with a script I can't find any documentation or announcement about it being provided by Checkpoint (and I would expect to find something in the release notes). Has someone at your site written a script to create these objects?

I don't have access to an R80.10 gateway to check

Re: Dynamic Objects in R80.10

PhoneBoy — Fri, 27 Oct 2017 23:22:06 GMT

On my gateways, these objects are not defined yet (I'm running a later JHF).

I know that there is a plan to make something like this available soon, as has been discussed in several threads on CheckMates.

I will see if I can get an update on the current status of this.

Re: Dynamic Objects in R80.10

Gaurav_Pandya — Mon, 30 Oct 2017 14:04:44 GMT

Hi,

Actually We have asked Checkpoint for this type of scenarios as one of customer is looking. We got the above answer. Still sk is in internal and not published yet. Below is the information about sk.

Solution ID	sk119562
Product	Security Gateway
Version	R80.10
OS	Gaia
Platform / Model	All
Access Level	Internal

Re: Dynamic Objects in R80.10

PhoneBoy — Mon, 30 Oct 2017 15:13:47 GMT

That's because it is currently in private EA.

If you're interested, please contact your local Check Point SE.

Re: Dynamic Objects in R80.10

Lars_Gosebrink — Thu, 22 Feb 2018 17:47:33 GMT

very usefull feature. Is this working in R80.10?

Re: Dynamic Objects in R80.10

PhoneBoy — Thu, 22 Feb 2018 20:05:31 GMT

Yes, but it requires a special fix that's not generally available.

As noted above, please contact your local Check Point SE.

Re: Dynamic Objects in R80.10

2e15242e-6b6a-4 — Thu, 08 Nov 2018 14:42:30 GMT

hi All.

Is this URL Forwarding?

Re: Dynamic Objects in R80.10

PhoneBoy — Thu, 08 Nov 2018 15:11:18 GMT

What do you mean by URL Forwarding?

Re: Dynamic Objects in R80.10

Phil_Haddy — Thu, 22 Nov 2018 01:12:58 GMT

Have found out the following recently when attempting to use dynamic objects for Office 365

Currently dynamic objects are only supported in R80.10 JHF Take 121 with an additional hot-fix that adds support for the Check Point feed.

The hot-fix is available for the current JHF (Take 154), but needs a RFE to be raised so R&D will test and support - which is absolute rubbish given the vulnerabilities/features that have been fixed addressed from Take 121 to 154

TAC advise that you upgrade to R80.20 (again - a rubbish response)

Re: Dynamic Objects in R80.10

PhoneBoy — Thu, 22 Nov 2018 02:17:57 GMT

The internal SK that discusses this hotfix says you should be able to get it for R80.10 JHF 154 as of a few days ago.

Please PM me the SR you opened with TAC on this.

Re: Dynamic Objects in R80.10

Phil_Haddy — Thu, 22 Nov 2018 02:38:41 GMT

Hi Damon

The SR is 3-0633516431, but I think I may have to go back and edit my post (again). It may be the case that we requested the hotfix for Take 154 to enable the dynamic object feeds and that is why it was released a few days ago, but we are running an R80.10 VSX environment. So our issue is that it can be installed but it hasn’t been tested with VSX so there is no support.

Any help is appreciated.

Re: Dynamic Objects in R80.10

PhoneBoy — Thu, 22 Nov 2018 02:52:06 GMT

Be careful when you use email to reply as it included your email signature with your full contact details.

The SK seems to indicate different information, and I'll have to investigate further.

Re: Dynamic Objects in R80.10

PhoneBoy — Sun, 25 Nov 2018 06:08:36 GMT

Just to clarify, there are two functions provided by this hotfix:

Dynamic Objects for Office 365 in the Access Policy, which is provided natively in R80.20 (see: Microsoft Office 365 objects as Network Objects in R80.20).
Dynamic Objects for Office 365 in the HTTPS Inspection policy, which is NOT in R80.20 and requires a special hotfix to achieve in R80.10. We do plan to provide this in the product natively (post R80.20) thru allowing use of Updatable Objects in the HTTPS Inspection policy, but the timelines for this have not been finalized.

To further clarify, this particular hotfix is also a customer-release, meaning it was built and tested for a specific customer environment.

We do make these available to other customers through your local Check Point office only if they meet the same requirements.

Re: Dynamic Objects in R80.10

Tomer_Sole — Sun, 25 Nov 2018 06:12:57 GMT

TAC advise that you upgrade to R80.20 (again - a rubbish response)

To add to Dameon's point, in this case, TAC had a valid point!

In R80.20 there's a solution that is easier to use, reduces time maintaining it by end users, and in maintrain - therefore you will receive all future stability fixes unlike the special dynamic object release of R80.10.

Even if you don't have plans to migrate to R80.20 right now, I recommend that you at least prepare and experiment with a lab environment or the Cloud Demo Mode.

See more benefits of R80.20 here: Check Point R80.20 Demo TechTalk and Q&A

Re: Dynamic Objects in R80.10

ADM_DB — Sat, 01 Dec 2018 19:13:23 GMT

Thank you for clarification
can we use this as an object in "vpn domain" networks group in order to route all O365 traffic through the vpn tunnel ( split tunnel )?

Re: Dynamic Objects in R80.10

PhoneBoy — Sun, 02 Dec 2018 08:03:24 GMT

Neither of these solutions provide this functionality.

That said, I believe you can leverage route-based VPNs for this.

Re: Dynamic Objects in R80.10

David_Brodin — Wed, 06 Mar 2019 21:08:44 GMT

Is there a reason our updatable object list does not include that specific list of o365 services/servers?

Afaik they are published on MS' page of domains/IP-addresses.

Running r80.20 mgmt with take 33 jumbo.

Re: Dynamic Objects in R80.10

PhoneBoy — Thu, 07 Mar 2019 02:52:24 GMT

As the list comes from the cloud, everyone should see the same thing.

What do you see?

Re: Dynamic Objects in R80.10

David_Brodin — Thu, 07 Mar 2019 07:32:17 GMT

I agree, I should be seeing the same list. We would like to use "Microsoft Teams Servers" from Tomers list for instance. Although a lot can change in 3months, since Teams exist in MS' feed I'm surprised it's not in CP's list (anymore):