SSL VPN Split Tunneling and Office 365

Great job Regan - I have translated this into an iApp which installs the script and creates an iCall to update daily at https://devcentral.f5.com/s/articles/SSL-VPN-Tunnel-and-Office-365

Hiya,

I am looking for a similar functionality (retrieve MS IP and subnet list), but instead of updating the APM network access list, I want it to automatically update an LTM IP data-group. Any idea where I might find such a thing?

Thanks,

  you can find that here: https://github.com/f5devcentral/f5-office365-ip-url-automation

Very useful and really well done.

Was wondering if there was​ something similar for Microsoft windows Updates along the same lines?

​

Cheer and thanks for the share

 I'm not aware of a published list of IPs used for Windows Update but Microsoft has published a list of Windows Update URLs here: https://docs.microsoft.com/en-us/windows/deployment/update/windows-update-troubleshooting#device-cannot-access-update-files

You would have to verify with Microsoft whether these URLs are subject to change but assuming it is fairly static list you could simply add these addresses to the "additional_urls" list in the script.

  Thanks very much I have been playing around on my testbed. One thing I have noticed is I need to apply the Access policy after the update is working. maybe I have missed something(probably 😉 ) but is there another step I need to take o make sure this is applied to the Network Access List automatically ?

Cheers and thanks again

 The Access policies/profiles defined in the "access_profiles" list (line 40) should be applied (on or around line 386) when the script is executed. If you have them defined but they aren't applying, make sure you don't have a typo in the name.

The access policy and NA​ is being updated ok but I still need to "Apply" the access policy so it won't take effect until this is done is all.. Just needs my manual intervention.

​

Also​, adding the URLs to the script includes them in the DNS exclusion. Which is fine as this is the intended functionality of the script but in my case this would likely mean the routing table on the client could potentially be very long as a result.. I believe each entry from the DNS Exclusion list is resolved and then added in as a host route.

​

I'm not actually sure Microsoft has an endpoint specifically of windows update like it seems they do for O365.

​

Thanks very much for your replies too. This script in any event is great and much appreciated.

​

Cheers​

Great solution !

Any plan to extend it to other collaboration services like Webex and Zoom ?