block all https traffic, only allow *.microsoft.com and any url inside

[ivan.yeung]

hi all

is there any cisco products are able to do that?

[MrBeginner]

Hi ,

You should explain more what is your use case. eg .do you need routers or firewalls and your traffic flow?

[ivan.yeung]

hi MrBeginner,

let say an enterprise dont allow their employees access internet by default,  they access to specific web site only they requested.

let say employee A requested access O365, but how the network admin takes to get this job done in firewall level?

O365 contains different URL, so it wont work if using URL as a security object?

[Marvin Rhoads · Accepted solution]

Microsoft publishes a listing of the IP addresses its service map to. You can use that listing to create an object which can then be used in an ACL.

See this example:

https://github.com/chrivand/Firepower_O365_Feed_Parser

Cisco has also developed the Cisco Secure Dynamic Attributes Connector (CSDAC) which allows you to automate the process using newer versions of Cisco Secure Firewall (7.0+).

https://www.cisco.com/c/en/us/td/docs/security/secure-firewall/integrations/dynamic-attributes-connector/1-0/cisco-secure-dynamic-attributes-connector/about-dynamic-attributes-collector.html

[ivan.yeung]

Hi Marvin Rhoads,
Thanks for your suggestions, is there any scalable ways apply to non-famous web site?

[Marvin Rhoads]

If it's just a web site and not a collection of services then you can simply use an FQDN in your ACL.

[ivan.yeung]

if that web site have tons of FQDN inside? so i can only input those tons of FQDN one by one on firewall ACL?

[Marvin Rhoads]

Correct. Doing whitelisting (vs. blacklisting) can be a very tedious process. That's one reason why very few organizations use that approach.

[Marvin Rhoads]

Yes, at least 3 products can do that: Cisco Secure Firewall (formerly known as Firepower Threat Defense), Umbrella SIG and Cisco Secure Web Appliance (formerly known as WSA).

Which one is right for you (if any of them are) depends on a lot of things, as @MrBeginner alluded to.