Best practise for Firepower and M365

[Marco87]

Hello,

we've a Cisco Firepower 2110 Threat Defense and we're going to move to M365.

There's a large set of applications which I can setup in the firewall rules.

Is there a best practise guide to setup our Firepower for the inbound and outbound rules? 

Our it service provider told me, that the applications can only apply to outbound rules? 

Many thanks in advance!

[Rob Ingram]

@Marco87 yes, there are extensive Cisco guielines in regard to best practices for Access Control rules.

Rules with conditions for Layers 3/4 should be ordered first in your access control rules, conditions for URL/applications should be ordered later in your access control rules, followed by the more resource-intensive rules that require the traffic to be processed further by Intrusion and/or file policies.

Refer to the relevant guides - https://www.cisco.com/c/en/us/td/docs/security/firepower/70/configuration/guide/fpmc-config-guide-v70/best_practices_for_access_control.html

https://secure.cisco.com/secure-firewall/docs/access-control-policy

[Marco87]

Thanks for your replay!

But are there best practices or rule sets espacially for M365?

[MHM Cisco World]

https://community.cisco.com/t5/network-security/looking-for-suggestion-on-dealing-with-microsoft-o365-bypass/td-p/4738036

MHM