Origin Shield

Origin Shield is a security feature that provides a dynamic Network List, `Azion Origin Shield`, containing all IPv4 and IPv6 prefixes used by Azion's global network infrastructure.

View as Markdown

Origin Shield is a security feature that provides a dynamic Network List, Azion Origin Shield, containing all IPv4 and IPv6 prefixes used by Azion’s global network infrastructure.

This list serves as a data source for enforcing a strict IP Access Control List (ACL) on your origin servers. By configuring your origin’s firewall to permit inbound traffic exclusively from the addresses specified in this list, you establish a Layer 3/4 security perimeter, ensuring that only Azion’s servers can connect to your origin and blocking all direct access from external sources.

Clients are responsible for automating updates to their security policies to keep them aligned with the current Origin Shield addresses.

The Azion Origin Shield network list now includes IPv6 prefixes for all of Azion’s data centers. This expansion increases the total number of entries in the list. If you use this list in firewall rules or automations, review your filter configurations to ensure they handle the updated list size correctly.

Implementation

Scope	Resource
Secure an application	Secure an application
Retrieve IP ranges for origin allowlisting	How to retrieve Azion IP ranges
Connectors	Connectors
Applications first steps	First steps

Usage

To activate it, enable Origin IP ACL for at least one connector in your account.

List updates

Azion’s IP list may change frequently, but after updating it, the new servers will only be put into production for those using the Origin Shield add-on 7 days after the list is published. You can also track and trace the changes made to the list through the History in Azion Console. There, you can find which IPs have been added or deleted from the list.

Clients with Origin Shield receive an email every time the list is updated and have 7 days to update automations, when necessary, to retrieve the new list.

When the list is updated — including when new IPv6 prefixes are added — you’ll receive an email notification. Use the 7-day window to update your origin firewall rules and any automations that consume the list before new servers go into production.