Define allowed ServiceNow internal IP addresses [Updated in Security Center 1.3 and 1.5]
Summarize
Summary of Define allowed ServiceNow internal IP addresses [Updated in Security Center 1.3 and 1.5]
This feature allows ServiceNow customers to control and restrict the IP addresses that can make inbound and outbound connections to their instances by configuring theglide.ip.authenticate.strictsystem property. It enhances security by limiting access to only essential internal ServiceNow IP ranges, reducing the risk of unauthorized or unnecessary access by internal staff such as support or sales personnel.
Show less
Key Features
- glide.ip.authenticate.strict (Boolean): When set to true, the instance uses a strict and more restrictive IP allow list for inbound and outbound connections, replacing the default broader allow list.
- For self-hosted instances, the strict IP list is replaced by the glide.ip.authenticate.allow.secured.selfhostedlist property, and the default list by glide.ip.authenticate.allow.selfhostedlist if glide.ip.authenticate.strict is false.
- Custom IP addresses can be included via system properties glide.custom.ip.authenticate.allow and glide.custom.ip.outbound.authenticate.allow, regardless of strict mode.
- IP ranges can be specified in multiple formats including single IP, IP ranges with hyphens, or CIDR notation.
- At runtime, additional IP addresses can be added or denied using the IP Address Access Controls [ipaccess] table for granular access control.
Key Outcomes
- Enhanced security: Limiting the IP allow list reduces exposure to insider threats and misconfiguration by restricting access to essential ServiceNow infrastructure only.
- Controlled internal access: Prevents non-essential ServiceNow personnel from accessing instances, improving privileged access management.
- No functional disruption: Setting the strict property should not impact normal functionality, as non-essential users typically do not require instance access.
- Flexible exceptions: Access can be granted on a case-by-case basis via the IP Address Access Controls table if needed.
Important Notes
- This property is a no-DB override, meaning it cannot be altered or overridden in the database once set.
- The IP allow list may be updated over time as the ServiceNow internal network changes.
- There are no dependencies or prerequisites for enabling this property.
- To add or modify system properties, customers can refer to the standard process for adding system properties in ServiceNow.
Use the glide.ip.authenticate.strict property to specify IP ranges that can make inbound connections on an instance.
Use the glide.ip.authenticate.strict property to reduce the scope of the IP allow list of an instance and restrict the IP addresses that ServiceNow personnel can use to make inbound/outbound connections to an instance. The exact IP ranges removed from the IP allow list by this property may be adjusted over time as the ServiceNow internal network changes. When set to true, glide.ip.authenticate.strict always guarantees an IP allow list that is equal to or more restrictive than the default.
- When glide.ip.authenticate.strict is set to true:
- A strict list of ServiceNow IP ranges replaces the default IP allow lists for inbound and outbound requests. This IP allow list, which starts with a more restrictive predefined set of allowed IP ranges, is replaced by the property glide.ip.authenticate.allow.secured.self_hosted_list if the instance is self-hosted.
- When glide.ip.authenticate.strict is set to false:
- The default IP allow list is used which contains a wider set of ServiceNow IP ranges. The default IP allow list is replaced by the contents of glide.ip.authenticate.allow.self_hosted_list if the instance is self-hosted.
All IP list properties share the same format, which is a comma separated range of IP addresses in IPv4 or IPv6 format. IP ranges are specified using a hyphen (10.0.10.14-10.0.10.19), using CIDR notation (10.0.10.0/24), or consist of a single IP address (10.0.10.5). At runtime, you can make additions to the IP allow list by adding entries to the IP Address Access Controls [ip_access] table. This table can also be used to explicitly deny IP ranges access to an instance.
More information
| Attribute | Description |
|---|---|
| Configuration name |
|
| Configuration type | System Properties (/sys_properties_list.do) |
| Data type |
|
| Recommended value |
|
| Default value |
|
| Fallback value |
|
| Category | Architecture, design, and threat modeling |
| Security risk |
|
| Functional impact | This should have no functional impact. It may restrict non-essential ServiceNow personal from accessing an instance. However, these are individuals that do not generally require access to such instances. If access is required, you can grant it on a case by case basis using the IP Address Access Controls [ip_access] table. |
| Dependencies and prerequisites | None |
To learn more about adding or creating a system property, see Add a system property.