topic Re: block all https traffic, only allow *.microsoft.com and any url in in Network Security

block all https traffic, only allow *.microsoft.com and any url inside

ivan.yeung — Tue, 26 Oct 2021 01:34:08 GMT

hi all

is there any cisco products are able to do that?

Re: block all https traffic, only allow *.microsoft.com and any url in

MrBeginner — Tue, 26 Oct 2021 03:35:35 GMT

Hi ,

You should explain more what is your use case. eg .do you need routers or firewalls and your traffic flow?

Re: block all https traffic, only allow *.microsoft.com and any url in

Marvin Rhoads — Tue, 26 Oct 2021 04:23:46 GMT

Yes, at least 3 products can do that: Cisco Secure Firewall (formerly known as Firepower Threat Defense), Umbrella SIG and Cisco Secure Web Appliance (formerly known as WSA).

Which one is right for you (if any of them are) depends on a lot of things, as @MrBeginner alluded to.

Re: block all https traffic, only allow *.microsoft.com and any url in

ivan.yeung — Tue, 26 Oct 2021 06:25:00 GMT

hi MrBeginner,

let say an enterprise dont allow their employees access internet by default, they access to specific web site only they requested.

let say employee A requested access O365, but how the network admin takes to get this job done in firewall level?

O365 contains different URL, so it wont work if using URL as a security object?

Re: block all https traffic, only allow *.microsoft.com and any url in

Marvin Rhoads — Tue, 26 Oct 2021 07:27:31 GMT

Microsoft publishes a listing of the IP addresses its service map to. You can use that listing to create an object which can then be used in an ACL.

See this example:

https://github.com/chrivand/Firepower_O365_Feed_Parser

Cisco has also developed the Cisco Secure Dynamic Attributes Connector (CSDAC) which allows you to automate the process using newer versions of Cisco Secure Firewall (7.0+).

https://www.cisco.com/c/en/us/td/docs/security/secure-firewall/integrations/dynamic-attributes-connector/1-0/cisco-secure-dynamic-attributes-connector/about-dynamic-attributes-collector.html

Re: block all https traffic, only allow *.microsoft.com and any url in

ivan.yeung — Tue, 26 Oct 2021 09:35:34 GMT

Hi Marvin Rhoads,
Thanks for your suggestions, is there any scalable ways apply to non-famous web site?

Re: block all https traffic, only allow *.microsoft.com and any url in

Marvin Rhoads — Tue, 26 Oct 2021 12:44:27 GMT

If it's just a web site and not a collection of services then you can simply use an FQDN in your ACL.

Re: block all https traffic, only allow *.microsoft.com and any url in

ivan.yeung — Wed, 27 Oct 2021 00:50:57 GMT

if that web site have tons of FQDN inside? so i can only input those tons of FQDN one by one on firewall ACL?

Re: block all https traffic, only allow *.microsoft.com and any url in

Marvin Rhoads — Fri, 29 Oct 2021 01:33:24 GMT

Correct. Doing whitelisting (vs. blacklisting) can be a very tedious process. That's one reason why very few organizations use that approach.