topic Re: Azure fabric IP's as application/category in General Topics

Azure fabric IP's as application/category

Chandhrasekar_S — Mon, 13 Nov 2017 17:27:54 GMT

Team,

We have IaaS configured in Azure public cloud. We need to bypass https inspection for Windows servers reaching Azure fabric. I am wondering how can I create that rule.

Thanks,

Chandru

Re: Azure fabric IP's as application/category

PhoneBoy — Mon, 13 Nov 2017 23:33:29 GMT

Moving this to General Product Topics since this not specific to vSEC.

Even if we had an Application Control category, you can't use Application Categories in the HTTPS Inspection rulebase.

For your specific use case, is it to reach ANYTHING in the Azure fabric or specific applications?

If just specific applications, then you can just put the specific IPs in as destinations in your HTTPS Inspection rulebase.

If you're talking about anything in Azure in general, we don't have a ready-made solution today.

That said there is functionality under development to support automatically updating dynamic objects for the purposes of using them in things like the HTTPS Inspection policy.

Right now this functionality is focused on Office 365, though I suppose it could be extended to Azure easily enough.

It's available as an Early Availability fix on top of R80.10.

If you're interested, I recommend reaching out to your local Check Point SE.

Re: Azure fabric IP's as application/category

Chandhrasekar_S — Tue, 14 Nov 2017 15:46:11 GMT

Thanks Dameon. My use case is to reach all of 'Azure' fabric not just specific applications

I will check with my SE to see if the office 365 object can be extended to whole of Azure as well.

Re: Azure fabric IP's as application/category

PhoneBoy — Tue, 14 Nov 2017 17:21:58 GMT

I checked with R&D, having the Azure IPs available as a dynamic object is part of the plans.

However, the current EA does not include it.

Re: Azure fabric IP's as application/category

Chandhrasekar_S — Tue, 14 Nov 2017 17:50:18 GMT

Thanks for the update Dameon