# Origin Shield

import DocButton from '~/components/webkit/DocButton.vue';

**Origin Shield** is a security feature that provides a dynamic Network List, `Azion Origin Shield`, containing all IPv4 and IPv6 prefixes used by Azion's global network infrastructure.

This list serves as a data source for enforcing a strict IP Access Control List (ACL) on your origin servers. By configuring your origin's firewall to permit inbound traffic exclusively from the addresses specified in this list, you establish a Layer 3/4 security perimeter, ensuring that only Azion's servers can connect to your origin and blocking all direct access from external sources.

Clients are responsible for automating updates to their security policies to keep them aligned with the current **Origin Shield** addresses.

:::note
The **Azion Origin Shield** network list now includes IPv6 prefixes for all of Azion's data centers. This expansion increases the total number of entries in the list. If you use this list in firewall rules or automations, review your filter configurations to ensure they handle the updated list size correctly.
:::

## Implementation

| Scope | Resource |
| --- | --- |
| Secure an application | [Secure an application](/en/documentation/products/secure/secure-infrastructure/) |
| Retrieve IP ranges for origin allowlisting | [How to retrieve Azion IP ranges](/en/documentation/products/guides/retrieve-azion-ip-ranges/) |
| Connectors | [Connectors](/en/documentation/products/secure/connectors/) |
| Applications first steps | [First steps](/en/documentation/products/build/applications/first-steps/) |

---

### Usage

To activate it, enable Origin IP ACL for at least one [connector](/en/documentation/products/secure/connectors/) in your account.

### List updates

Azion's IP list may change frequently, but after updating it, the new servers will only be put into production for those using the Origin Shield add-on 7 days after the list is published. You can also track and trace the changes made to the list through the *History* in **Azion Console**. There, you can find which IPs have been added or deleted from the list.

Clients with Origin Shield receive an email every time the list is updated and have 7 days to update automations, when necessary, to retrieve the new list.

:::tip
When the list is updated — including when new IPv6 prefixes are added — you'll receive an email notification. Use the 7-day window to update your origin firewall rules and any automations that consume the list before new servers go into production.
:::

---