Make dynamic IPs work in a firewall?

[dlots]

I have always wanted to know if anyone has a better solution for this:  Say you have an e-mail server you want to be able to reach gmail.  Is there a better way to do that than collect every single IP address that gmail has and make an object-group out of it?  Or windows update servers, netflix, etc.  I can't imagine there not being a better way to do that kinda thing, but I have no idea what it might be.

[icecream-guy]

I have always wanted to know if anyone has a better solution for this:  Say you have an e-mail server you want to be able to reach gmail.  Is there a better way to do that than collect every single IP address that gmail has and make an object-group out of it?  Or windows update servers, netflix, etc.  I can't imagine there not being a better way to do that kinda thing, but I have no idea what it might be.

That mean you are blocking outbound SMTP traffic from your mail server ?   That sounds silly.

Inbound I can see, stops the baddies from using the mail server.

outbound traffic should be generally allowed, inbound traffic, sniffed, scanned, and inspected before being allowed in.

[deanwebb]

Allow SMTP from any/all in both directions. In front of the firewall or immediately behind it, you can set up an SMTP proxy that will require validation and authorization from all connecting boxes - that's what keeps you from being an open relay. But firms will get email from *everywhere*, so there's no real call to block SMTP that way.

[wintermute000]

Palo alto appid.

[dlots]

we don't run e-mail servers, we have a server that sends e-mail alerts out to a particualr set of servers, so far I haven't gotten a request for gmail, but I figure it's only a matter of time.  We are also overly high security and don't like to let anything go anywhere if we can help it.

[wintermute000]

some other vendors will/can do URL based firewall rulesets, that gives you the bare minimum though may fail occasionally if google brings a new IP online before the URL list updates

[deanwebb]

Then in that case, deny the request when it arrives due to security concerns, or set up a relay outside the firewall that will accept connections ONLY from your email server.

[Reggle]

A mailserver can be allowed to do SMTP to any I believe. Especially if it uses MX records. Whitelisting Gmail is going to be a pain... You'll need IP ranges of CDNs and so on... The minor increased risk isn't worth it.

[dlots]

Yeah that's what I figured, but there is never any harm in asking. 

Thank you