Is there no way to import FQDN's or IP addresses to an XG?

Hi Adam Ricket 

Import via CSV or TXT for IP or FQDN is as of now feature request. 

https://ideas.sophos.com/forums/330219-xg-firewall/suggestions/33035827-import-fqdn-s-cidr-lists-from-csv-or-txt

Alternatively you may try with API to make it automate.

https://community.sophos.com/kb/en-us/132560

Right so... Continue with the tedious process of manually adding each FQDN and IP/Network...

Pushing it via the API is pretty much a no go as all the lists I have available to me are in either JSON, CSV or TXT.... I'd prefer not to go through and change it all back to XML just so I can upload it to the FW...

I can see that this also has had little to no progress. https://ideas.sophos.com/forums/330219-xg-firewall/suggestions/15991441-implement-support-for-dynamic-public-ip-url-blackl...

Depending on your current data, there are plenty tools to do this in no time. 

For example notepad++ can actually convert a list of IPs into a XML. 

PS: this is general IT knowledge and very useful for all kinds of daily business work.

https://www.launch2success.com/guide/advanced-find-and-replace-in-notepad/

For example you can simply use the current XML format, which you need for XG. 

Then you take your List, what ever format it is, paste it into Notepad++.

You open the Search and replace function, look for every entry and replace it with the XML format and the current value in it. 

Afterwards put it into a .tar File, upload it to the GUI. 

Oh yeah it can be done... It's also a huge time sink reformatting it... 

Take the 365 URL's and IP's list... https://docs.microsoft.com/en-us/microsoft-365/enterprise/urls-and-ip-address-ranges?view=o365-worldwide 

Hi Adam,

if you are using 365 as an example I would suggest you look at the pages already loaded into XG FQDN and FQDN groups. You  might need to add a couple of new ones, but the lists are quite long.

Ian

Office365 is native integrated into V18 for Decryption exclusion. 

What do you want to do with this List? 

In your Link, there are plenty different hosts. Do you want to have all those hosts (IP / FQDN) into a big object and allow this via Firewall rule? 

There are already such import scripts for O365.

https://community.sophos.com/kb/en-us/132291

So basically what we're doing is we have a fairly straightforward QoS Rule for LAN/WiFi to WAN for HTTP and HTTPS with the hosts listed in that 365 doc.

We're finding that the catch all rule is causing issues with Office installation and updates. Sharepoint Online Sync and Exchange Online sync. The catch all rule has Intrusion Prevention set to "generalpolicy", Web Policy set as "Default Workplace Policy" and Application control set to "Block very high risk".

For the QoS Rule, we only have Traffic Shaping set to "High Guarantee Rule" and DSCP marking set to 46.

So yes... Ideally I want to be able to import all of those hosts for one rule.

Hi Adam,

besides QOS are you trying to provide access to al users to the O365 etc updates or do you an update server?

If allowing all users, then try the following

1/. create your won IPS rule, eg remove unwanted items

2/. create a firewall rule with

a) source LAN

b) any

c) destination WAN

d) the FDQN group, you might like to build your own

e) services specify the MS services used as the updates

f) WEB - none

g) Application - NONE

h) your IPS policy

i0 your QOS policy

Put the rule at the top of your rule list.

Ian

Hi Adam,

besides QOS are you trying to provide access to al users to the O365 etc updates or do you an update server?

If allowing all users, then try the following

1/. create your won IPS rule, eg remove unwanted items

2/. create a firewall rule with

a) source LAN

b) any

c) destination WAN

d) the FDQN group, you might like to build your own

e) services specify the MS services used as the updates

f) WEB - none

g) Application - NONE

h) your IPS policy

i0 your QOS policy

Put the rule at the top of your rule list.

Ian