Logon Settings: Allow/Restrict IPs

    SecureAI lets you control which IP addresses can communicate with the product. By defining an allowlist or a restrict list, you add a network-level security layer on top of authentication, ensuring that only known sources reach the console, the APIs, or specific product URLs. The Allow/Restrict IPs option lets you define the IP addresses, hostnames, or ranges of IP addresses that are permitted or blocked when communicating with SecureAI.

    You can choose one of two modes. With Allowed IPs, only the listed IP addresses and ranges can reach SecureAI, and all other addresses are blocked. With Restricted IPs, the listed IP addresses and ranges are blocked, and all other addresses are allowed. In Allowed IPs mode, you can also scope the rule so that it covers selected APIs or product URLs, which is useful when you want broad access to the console but tighter control over the REST APIs.

    Prerequisites

    • Delegated access to the Logon Settings tab in SecureAI.
    • A list of the IPv4 addresses or ranges you want to allow or block.
    • For API scoping, the path of each API or product URL you want to control, and the IPv4 addresses or ranges that should be allowed to reach them.

    How it works

    When the Allow/Restrict IPs feature is enabled, SecureAI checks the source IP address of every incoming request against the configured list before processing the request.

    • In Allowed IPs mode, the request proceeds only if its source IP matches an entry in the list. All other requests are rejected.
    • In Restricted IPs mode, the request is rejected if its source IP matches an entry in the list. All other requests proceed.
    • API and URL scoping is available only in Allowed IPs mode. When it is enabled, the IP range you define there applies to requests whose paths match the configured API or URL patterns.
    • Requests originating from the local machine are always allowed, regardless of the configuration.

    Steps to allow or restrict IP addresses

    Allow IP addresses for product access

    1. Log in to SecureAI.
    2. Go to Delegation > Configuration > Logon Settings.
    3. In the Logon Settings pane, click the Allow/Restrict IPs tab.
    4. Select Enable Allow/Restrict IPs.
    5. Select Allowed IPs. Only the addresses you list will be able to access SecureAI.
    6. Define the IP addresses to allow:
      • To add a range, enter the start and end addresses in the Allow IP Range fields. To add another range, click the plus icon + and enter the next range.
      • To add individual addresses, click Add Individual IPs/hostnames and enter the address or hostname. To add more than one, separate each entry with a comma.
    7. If specific APIs or product URLs must also be reachable from a different set of addresses, select Enable API/URL Access for specific IPs then enter those paths and the IP range permitted to call them, as described in Allow API and URL access for specific IP addresses below.
    8. Click Save.

    Restrict IP addresses from product access

    1. Go to Delegation > Configuration > Logon Settings.
    2. Click the Allow/Restrict IPs tab.
    3. Select Enable Allow/Restrict IPs.
    4. Select Restricted IPs. The addresses you list will be denied access to SecureAI, and all others will be allowed.
    5. Define the IP addresses to deny:
      • To add a range, enter the start and end addresses in the Restrict IP Range fields. To add another range, click the plus icon + and enter the next range.
      • To add individual addresses, click Add Individual IPs/hostnames and enter the address or hostname. To add more than one, separate each entry with a comma.
    6. Click Save.

    Note: You can use either the allow option or the restrict option at a time, not both.

    Allow API and URL access for specific IP addresses

    This option is available only when Allowed IPs is selected. Use it when you want a separate set of addresses to reach selected APIs or product URLs.

    1. On the Allow/Restrict IPs tab, with Allowed IPs selected, select Enable API/URL Access for specific IPs.
    2. In Enter API/URL Paths, enter the API paths or product URL paths you want to control. To add more than one, separate them with commas. Follow this path format:
      • Enter only the path portion, beginning with a forward slash. For example, if the full URL is https://testserver:8082/Admin.do, enter /Admin.do.
      • Use the asterisk as a wildcard to cover a broader set of paths. For example, /RestAPI/.* covers every API call that starts with /RestAPI/.
      • Only alphanumeric characters and the special characters of period, slash, and asterisk are allowed.
    3. In the Allow IP Range field below the paths, enter the IP range that should be permitted to call those paths. To add another range, click the plus icon + and enter the next range.
    4. Click Save.

    Note: Once API and URL scoping is enabled, only the IP addresses you list can reach the specified paths. Verify the paths and the IP ranges before saving to avoid locking out legitimate integrations.

    Limitations

    • Only IPv4 addresses are supported. IPv6 is not supported.
    • The wildcard character for IP addresses works only with individual IP entries, not with IP ranges. Use it to cover all addresses within a given network segment, for example, 192.168.1.*.