# Secure an infrastructure

import DocButton from '~/components/webkit/DocButton.vue';
import Tabs from '~/components/tabs/Tabs'
import Code from '~/components/Code/Code.astro'

Once you've [created an firewall and secured your application](/en/documentation/products/secure/secure-application/), you can use **Origin Shield** to secure your infrastructure by blocking threats.

Origin Shield provides a list of IPv4 and IPv6 prefixes used exclusively by Azion in its global infrastructure, ensuring that only trusted Azion IPs are allowed access. The list is maintained by Azion and made available via Azion Console and API. Clients are responsible for automating updates to their security policies to keep them aligned with the current Origin Shield addresses.

:::tip
If you need Azion's IP ranges to configure an allowlist on your origin server, Nginx `set_real_ip_from`, or a cloud firewall such as AWS ELB, see [How to retrieve Azion IP ranges for origin server allowlisting](/en/documentation/products/guides/retrieve-azion-ip-ranges/).
:::

:::note
The **Azion Origin Shield** network list now includes IPv6 prefixes for all of Azion's data centers. If you use this list in firewall rules or automations, review your filter configurations to ensure they handle the updated list size correctly.
:::

---

## Step 1. Enable Origin Shield

To access the Origin Shield list, you must have:

- The [Network Shield module](/en/documentation/products/guides/secure/firewall-configure-main-settings/#modules) enabled.
- Be subscribed to the Origin Shield add-on.
  - Contact the [sales team](https://www.azion.com/en/contact/) to subscribe to this feature.

---

## Step 2. Access the list of addresses

<Tabs client:visible>
    <Fragment slot="tab.console">Console</Fragment>
    <Fragment slot="tab.api">API</Fragment>

<Fragment slot="panel.console">
1. Access [Azion Console](/en/documentation/products/guides/how-to-access-azion-console/) > select **Network Lists**.
2. Select **Azion Origin Shield**.
3. On the **List** field, you can copy the IP addresses list.
</Fragment>

<Fragment slot="panel.api">
1. Run the following `GET` request in your terminal, replacing `[TOKEN VALUE]` with your [personal token](/en/documentation/products/guides/personal-tokens/)

<Code lang="bash" code={`
curl --request GET \
  --url https://api.azion.com/v4/workspace/network_lists \
  --header 'Accept: application/json' \
  --header 'Authorization: Token [TOKEN VALUE]'
`} />

2. You'll receive a response similar to this:

<Code lang="json" code={`
{
  "count": 4,
  "total_pages": 1,
  "schema_version": 3,
  "links": {
    "previous": null,
    "next": null
  },
  "results": [
    {
      "id": 2345,
      "last_editor": "last.editor@azion.com",
      "last_modified": "2023-03-27T21:19:27.996870Z",
      "list_type": "ip_cidr",
      "name": "Azion Origin Shield",
      "country_list": [],
      "ip_list": [
        "192.168.0.5",
        "2001:db8::/32"
      ]
    }
  ]
}
`} />

3. On the `ip_list` field, you'll receive all IPs added by Azion. You can copy the IP addresses list.
</Fragment>

</Tabs>

:::note
Clients with Origin Shield receive an email every time the list is updated and have *7 days* to update automations, when necessary, to retrieve the new list.
:::

---

## Step 3. Automate new address additions

After having access and checking the list of IP addresses provided by Origin Shield, you can create an automation with Rules Engine, ensuring your infrastructure is always protected with the most recent version of safe IPs.