Policy based routing for O365

[Hiep_Bui]

Hello,

We have a cluster of 2 SG5900, with 2 internet links. we want to use the 2 links as below:

- link 1: primary link for O365 traffic and secondary for other traffic.

- link 2: secondary link for O365 and primary for other traffic.

My understanding is we will need to configured Policy Based Routing (Gaia OS) for this requirement.

However, O365 has a lot of IP addresses, which means we need to configure a lot of routes and policies in Gaia OS. Besides, O365 has some URLs (from the list provided by Microsoft Office 365 URLs and IP address ranges | Microsoft Docs), and their IP addresses/URLs may be changed anytime.

So could anyone suggest a smarter way to fulfill this requirement?

Thanks,

Hiep.

[Chris_Atkinson]

Hello,

Rather than asking numerous questions about your environment / routing / use of proxies etc, I would recommend contacting your local Check Point SE to discuss this requirement further and how we can help. Specifically they will have visibility of possible RFE that may be relevant to your cause. 

Thanks,

Chris

[PhoneBoy]

Though it's always good to consult with your local office Chris Atkinson I never want to discourage people from posting questions here when appropriate. 

For this question we do have an SK: How to split traffic between local breakout and Site to Site VPN based on applications (Office365) 

This talks about it in the context of using a VPN but the same basic principles apply if you're not.

If you're using an ExpressRoute with Microsoft, I think you can get the necessary information about IPs directly from Microsoft via BGP.

In any case, Microsoft makes the relevant IPs available thru a web service that you can call/parse the data from to mame the appropriate changes.

You'd have to script these changes but it's certainly feasible,

[Hiep_Bui]

Hi Dameon,

Thanks for your suggestion. However, the step 4 in How to split traffic between local breakout and Site to Site VPN based on applications (Office365) is still what we have to do now (i.e adding a lot of routes for O365 IP addresses).

We heard from a Checkpoint engineer that this requirement of O365 routing is being tested and should be available in 1st half 2019 (currently O365 object is only available for firewall rules), so we are not doing PBR for O365 for now and wait for new release.

Thanks,

Hiep.