topic Microsoft Global Services Updateable Objects in General Topics

Microsoft Global Services Updateable Objects

Tony_Graham — Fri, 02 Jul 2021 18:55:38 GMT

Recently our firewall has blocked a number of connections to our mail servers from countries outside of the US. Normally these seem to be Microsoft servers based out of UK/Ireland and recently Norway. I am curious what is the best way to configure a policy rule for these services. As a short term workaround I have updateable objects for those nations to allow SMTP connections but that is a bit of overkill. Is there an updateable object for MS Services that would accomplish the same thing? I have browsed the objects but I'm not sure if a hosted Exchange service or 0365 may be involved or if both of those services would be needed.

Any help appreciated.

Re: Microsoft Global Services Updateable Objects

PhoneBoy — Sat, 03 Jul 2021 04:11:08 GMT

Possibly, but we'd have to see what hosts are connecting to you and compare it to what's in the Updatable Objects.
This SK might help: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk161632&partition=Advanced&product=Quantum

Re: Microsoft Global Services Updateable Objects

Tony_Graham — Tue, 06 Jul 2021 15:49:25 GMT

Thanks Dameon. The problem child seems to be originating at 40.92.55.X.

DNS resolves to mail-ol1nor01olkn2068.outbound.protection.outlook.com

Presently they are getting dropped due to First paket isn't SYN. RST-ACK.

also some DNS resolutions to

mail-sv0nor01olkn2024.outbound.protection.outlook.com (same ip range).

Basically nothing out of MS datacenter in Norway is being delivered.