Import of Office365 URLs and IPs into FMC/FTD2130 ACL(s)

[brian.emil.harris]

I need to create an ACL (or multiple ACLs) on my FTD2130 to allow hosts to the huge list of IPs and URLs required for Office365 (located here: https://support.content.office.net/en-us/static/O365IPAddresses.xml )

How can I do this automatically/scriptomatically? I would really prefer not manually entering each IP/range or URL into the ACL(s).

[MarcHop]

I opened a case with TAC on this, and with my VAR. (This very list, actually.) There was no way they could find to script this and have it become a feed into the ACL.

[MarcHop]

I am LOVING the fact that the community just proved me wrong! THANK YOU!

[bart.raat · Accepted solution]

You can use this: https://github.com/chrivand/Firepower_O365_Feed_Parser

This will fill object groups with the Office 365 URL's and IP's.

[brian.emil.harris]

Good timing!  I was just forwarded this same link earlier in the week, and just yesterday implemented it.  I had planned to post the URL, but you beat me to it! :)

A caveat for anyone seeking to use this script:  Check the pull requests, as the original script imports the URLs with asterisks/wildcards, which don't work in the FMC.  The pull update cleans up some of the parsing, and strips the asterisks quite nicely.

The package contains two scripts - one authenticates to the FMC's REST API, the second does the download, parsing and update of the URL and IP objects you create as part of the package.  I'm setting up a scheduled task on a management system I have to run this at least once a week.

The pull update also adds in a requirements file so you can update your Python installation to the specific package/module versions required for the script to work.

[ckleopa]

Just curious,

Is there a reason you chose to use an external script vs what we currently have now with all our Office 365 applications or even the "Dynamic Attributes Connector" with the Dynamic Objects that processes and updates all those IP's dynamically?

[brian.emil.harris]

When did this become available?  I set up this script something like 6 years ago.  The firewall(s) that use it are getting decom'd soon, but I'd be interested in learning about what you're talking about.

[ckleopa]

See our details on the Dynamic Attributes Connector here.

There is also a table with all the connectors and respective versions for them.

https://secure.cisco.com/secure-firewall/docs/cisco-secure-dynamic-attribute-connector

For the Applications based Office 365 controls they have been there for years. It's one of our tags that lists all applications under O365 we support.