Dear all,
we are currently moving our roughly 700 users from Office 2010 & Exchange 2010 to Office 365 and Exchange Online and so far everything works quite well. Regarding handling of Office 365 network traffic we have read the Office 365 Network Principles from Microsoft:
https://docs.microsoft.com/en-us/office365/enterprise/office-365-network-connectivity-principles
Usually all our clients can only access the Internet using a proxy server that is explicitely configured in the OS by GPO. Traffic that not traverses the proxy server is usually blocked and needs to be explicitly allowed on our outbound router.
Following the guidlines to seperate traffic destined for Office 365 we have deployed GPO settings that excludes traffic for all Office 365 destinations from the "Optimized Category" (i.e. *.sharepoint.com; outlook.office365.com etc.) from the proxy so that traffic for those targets is routed directly. Traffic to those endpoints is allowed as per Office 365 URLs and IP address ranges:
https://docs.microsoft.com/en-us/office365/enterprise/urls-and-ip-address-ranges
We are using a script that reads the corresponding IP addresses from the Office 365 IP Address and URL web service to update the firewall rules on the outbound router.
So basically the concept is:
1. Traffic to Office 365 endpoints from the Optimize category is routed directly
2. All other http/https traffic is traversing the explicitly configured proxy server
We now have experienced connectivity issues with Outlook and found that some of the IP addresses that Outlook is connecting to are not listed in the Office 365 URLs and IP address ranges. For example, when resolving outlook.office365.com the DNS returns the following addresses that are not included in the list but Outlook is connecting to:
2603:1026:100:16::2
2603:1026:101:14::2
I have posted this along with a more detailed description on the Github site as feedback for the Office 365 URLs and IP address ranges website:
https://github.com/MicrosoftDocs/OfficeDocs-Enterprise/issues/543
Others have posted about similar issues as well. As we obviously cannot rely on the Office 365 URLs and IP address ranges (since not all addresses are included) we have now allowed all outbound https traffic on our outbound router. The Outlook connectivity issues are solved now.
My question is: How do you handle the traffic separation recommended for Office 365? One could argue that allowing direct outbound https access to the whole Internet could pose a security risk if no filtering rules are applied to this traffic (which is okay for Office 365 traffic but might be a problem if a user removes the GPO configured proxy and uses the direct outbound access for other traffic as well).
My personal opinion is that filtering traffic on the application layer actually never is quite a good idea since it can break things (like TLS) that should not be broken. And one could also argue that in a time where the Internet is becoming increasingly dynamic (CDNs, IPv6, more and more cloud services) AND network traffic is becoming increasingly encrypted, security needs to be shifted to other layers like for example the end users device and the application itself.
Any thoughts on this or examples about you handle this are highly appreciated!
Best Regards
Michael
