Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
Hiep_Bui
Participant

Policy based routing for O365

Hello,

We have a cluster of 2 SG5900, with 2 internet links. we want to use the 2 links as below:

- link 1: primary link for O365 traffic and secondary for other traffic.

- link 2: secondary link for O365 and primary for other traffic.

My understanding is we will need to configured Policy Based Routing (Gaia OS) for this requirement.

However, O365 has a lot of IP addresses, which means we need to configure a lot of routes and policies in Gaia OS. Besides, O365 has some URLs (from the list provided by Microsoft Office 365 URLs and IP address ranges | Microsoft Docs), and their IP addresses/URLs may be changed anytime.

So could anyone suggest a smarter way to fulfill this requirement?

Thanks,

Hiep.

3 Replies
Chris_Atkinson
Employee Employee
Employee

Hello,

Rather than asking numerous questions about your environment / routing / use of proxies etc, I would recommend contacting your local Check Point SE to discuss this requirement further and how we can help. Specifically they will have visibility of possible RFE that may be relevant to your cause. 

Thanks,

Chris

CCSM R77/R80/ELITE
0 Kudos
PhoneBoy
Admin
Admin

Though it's always good to consult with your local office Chris Atkinson I never want to discourage people from posting questions here when appropriate. Smiley Happy

For this question we do have an SK: How to split traffic between local breakout and Site to Site VPN based on applications (Office365) 

This talks about it in the context of using a VPN but the same basic principles apply if you're not.

If you're using an ExpressRoute with Microsoft, I think you can get the necessary information about IPs directly from Microsoft via BGP.

In any case, Microsoft makes the relevant IPs available thru a web service that you can call/parse the data from to mame the appropriate changes.

You'd have to script these changes but it's certainly feasible,

Hiep_Bui
Participant

Hi Dameon,

Thanks for your suggestion. However, the step 4 in How to split traffic between local breakout and Site to Site VPN based on applications (Office365) is still what we have to do now (i.e adding a lot of routes for O365 IP addresses).

We heard from a Checkpoint engineer that this requirement of O365 routing is being tested and should be available in 1st half 2019 (currently O365 object is only available for firewall rules), so we are not doing PBR for O365 for now and wait for new release.

Thanks,

Hiep.

Leaderboard

Epsum factorial non deposit quid pro quo hic escorol.

Upcoming Events

    CheckMates Events