Secure an infrastructure

Use Origin Shield to secure your infrastructure.

Once you’ve created an firewall and secured your application, you can use Origin Shield to secure your infrastructure by blocking threats.

Origin Shield provides a list of IPv4 and IPv6 prefixes used exclusively by Azion in its global infrastructure, ensuring that only trusted Azion IPs are allowed access. The list is maintained by Azion and made available via Azion Console and API. Clients are responsible for automating updates to their security policies to keep them aligned with the current Origin Shield addresses.

If you need Azion’s IP ranges to configure an allowlist on your origin server, Nginx set_real_ip_from, or a cloud firewall such as AWS ELB, see How to retrieve Azion IP ranges for origin server allowlisting.

The Azion Origin Shield network list now includes IPv6 prefixes for all of Azion’s data centers. If you use this list in firewall rules or automations, review your filter configurations to ensure they handle the updated list size correctly.

Step 1. Enable Origin Shield

To access the Origin Shield list, you must have:

The Network Shield module enabled.
Be subscribed to the Origin Shield add-on.
- Contact the sales team to subscribe to this feature.

Step 2. Access the list of addresses

Access Azion Console > select Network Lists.
Select Azion Origin Shield.
On the List field, you can copy the IP addresses list.

Run the following GET request in your terminal, replacing [TOKEN VALUE] with your personal token

curl --request GET --url https://api.azion.com/v4/workspace/network_lists --header 'Accept: application/json' --header 'Authorization: Token [TOKEN VALUE]'

You’ll receive a response similar to this:

{

"count": 4,

"total_pages": 1,

"schema_version": 3,

"links": {

"previous": null,

"next": null

},

"results": [

{

"id": 2345,

"last_editor": "last.editor@azion.com",

"last_modified": "2023-03-27T21:19:27.996870Z",

"list_type": "ip_cidr",

"name": "Azion Origin Shield",

"country_list": [],

"ip_list": [

"192.168.0.5",

"2001:db8::/32"

]

}

]

}

On the ip_list field, you’ll receive all IPs added by Azion. You can copy the IP addresses list.

Clients with Origin Shield receive an email every time the list is updated and have 7 days to update automations, when necessary, to retrieve the new list.

Step 3. Automate new address additions

After having access and checking the list of IP addresses provided by Origin Shield, you can create an automation with Rules Engine, ensuring your infrastructure is always protected with the most recent version of safe IPs.