IP range based authentication
Summarize
Summary of IP Range Based Authentication
IP range based authentication enhances security for web-based applications by allowing access restrictions based on IP addresses. This feature helps in blocking access from specific addresses or ranges that may be associated with malicious activity, thereby protecting your ServiceNow instance.
Show less
Key Features
- Control access by IP addresses, with the ability to enforce rules through Adaptive Authentication (AA).
- The system prevents accidental self-lockout by warning users when their current IP address would be blocked.
- Access rules will not override existing access controls, such as those for VPN connections.
- Allow rules take precedence over deny rules, ensuring that if an address is both allowed and denied, it is permitted.
- Forwarded proxy addresses are evaluated in a chain, applying allow rules first, followed by deny rules if no allow rules match.
- IP range based authentication can impact the transfer of update sets; ensure to add all application node IPs as exceptions if access control is enabled.
Key Outcomes
By implementing IP range based authentication, ServiceNow customers can effectively manage access to their instances, reducing the risk of unauthorized access. Users who are restricted due to access rules will receive a 403 error, and their sessions will not affect server resource counts. For optimal results, it is important to coordinate with network teams to understand the actual outbound IP addresses, especially in corporate environments.
One way to secure a web-based application is to restrict access based on the IP address.
You can block access to a specific address or range of addresses that you suspect belong to malicious individuals. The instance allows you to control access by IP address.
Notes and Limitations:
- The system won't let you lock yourself out, so if you try to add a rule such that your current address would be locked out, the system warns you and refuses your insert.
- If you're inside of a corporate intranet, be very careful about setting up your IP rules. The IP address you see on your own computer (like 10.10.10.25) generally bears no relationship to the IP address you will actually appear as out on the internet. Your company likely proxies and/or NATs your address into a predictable set of outbound addresses which you will likely need to ask your network team about.
- A user whose access is restricted based on an access rule gets a 403 error on their browser.
- Restricted users do not use transactions, semaphores, or count towards any server resource counts.
- This feature does not supersede or override your existing access control rules if, for example, you're running a VPN to our data center. It's an additional check that must be met in addition to any access controls we may have set up on your PIX.
- Allow rules always supersede deny rules. So if an address is both allowed (by one rule) and denied (by a second rule) it is, in fact, allowed.
- Asterisks and CIDR blocks are not currently supported.
- Regarding forwarded proxy addresses, the allow rules are applied to each address in the chain and then the deny rules are applied to each address in the chain if none of the allow rules matched.
- IP range based authentication can effect the transfer of update sets. If IP address access control is enabled on the source instance, add the IP addresses of all application nodes supporting your instance as
exceptions.Note:To find your instance IP information, Log in to ServiceNow - NOW Support, and Search for the My IP Information service catalog item.