On Wednesday, April 3, 2013, Scott Voll wrote: > I went down that road too. the "policy-map type inspect http" does NOT > have a permit or allow. thus it won't work in this setup. > > other options?
It also won't address the https resources in office 365. For that you either use destination ip addresses as published by MS ( and cross your fingers they don't change too rapidly or what is published is a complete enumeration), a smarter firewall or a proxy. An explicit proxy will give you the ability to filter on domain even for https as the CONNECT method specifies the destination host. A transparent proxy/ngfw may be able to filter on distinguished name in the certificate exchange for TLS handshake protocol but YMMV depending on vendor. You could also use tls intercept on a product that supports it and then http filter. Some other firewalls can create policy based on wildcard domains by dynamically resolving PTR records on the fly but that requires that PTR records are created in the first place and match the domain (not always the case) Or you could always open outbound 443 to any destination !!!! ( If you like supplying easy to use C2 channels that is) -- jac _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
