Can office 365 dynamic object from app detector of firepower be used as network object group in extended access list?

[asmithg]

Apologies for the lengthy question here. 

I'm in the process of migrating ASA with some PBR policy to FTD.

Current setup:

ASA has the following rule in the extended access list specified in PBR policy

Line 1: Source: PBR_source IPs  Destination: Office 365 object group     Service: http/https  Action: Deny

Line 2: Source: PBR_source IPs  Destination: any  Service: http/https       Action: permit

So the above ACEs basically performing routing decisions and Line1 excludes the office 365 traffic in PBR and taking the default route then the rest of the traffic will take its specified route as per the route map. 

I want to achieve the same function in FTD leveraging the office 365 dynamic object that the app detector provides.

So the requirement is to use the dynamic office 365 object in the extended access list in FMC to exclude office 365 traffic which can be configured in Flexi config. 

Question: Can the office 365 dynamic object be used as a network object group to configure in extended ACL in FMC? 

I'm aware that there are scripts you can use to import office 365 URLs/IPs with FMC API/MS API
Is this the only way?

[Marvin Rhoads]

There is a new feature in 7.0 called dynamic objects which, when combined with the Cisco Secure Dynamic Attributes Connector, should allow you to do this.

I have been meaning to try it out in the lab but haven't had a chance yet.

https://www.youtube.com/watch?v=TghSLH0FJUs

[asmithg]

Thanks Marvin, Interesting! please let me know if you try this.

[rschlayer]

The Dynamic Attributes Connector might soon support Office365 so it might be worth it to wait for 1.1

[Marvin Rhoads]

Right @rschlayer - that was mentioned in the video Veronika posted on Youtube.

https://www.youtube.com/watch?v=TghSLH0FJUs&t=3s

As of now the CSDAC only supports tenant-based Azure, AWS and vCenter connectors:

https://www.cisco.com/c/en/us/td/docs/security/secure-firewall/integrations/dynamic-attributes-connector/1-0/cisco-secure-dynamic-attributes-connector/configure-dynamic-attributes-collector.html#Cisco_Reference.dita_e4697fda-50a2-441f-98ea-35a54f90fc...

[skalyana]

https://galaxy.ansible.com/cisco/csdac (CSDAC 1.1 supports additional connectors (office365 and Azure Service Tags) that is compatible with FMC 7.0 and 7.1)

found this video https://youtu.be/-fon72TFw0I to be very illustrative as well!

[Marvin Rhoads]

I found a SecureX orchestration that is supposed to work with FMC 7.0 to do exactly this. I've not tried it personally yet but here's a link to it:

https://ciscosecurity.github.io/sxo-05-security-workflows/workflows/secure-firewall/0031-microsoft-online-object-update