topic Re: Best Practice for creating IP Whitelist ACL for Web API Assets in WAF

Best Practice for creating IP Whitelist ACL for Web API Assets

Maxh — Mon, 06 Jan 2025 16:18:14 GMT

Hello,

we're currently deploying CloudGuard WAF aaS for our public services and wanted to add semi-public services also, which we currently run through our old WAF with IP (and Subnet) Whitelisting.

As per the title: What's the recommended way to achieve this?

Thanks!

Re: Best Practice for creating IP Whitelist ACL for Web API Assets

yuvalmamka — Tue, 07 Jan 2025 12:14:20 GMT

Hi Maxh,

You can use Custom Rules and Exceptions for achieving this.

Look for further details here: Setup Custom Rules and Exceptions | CloudGuard WAF

Re: Best Practice for creating IP Whitelist ACL for Web API Assets

Maxh — Tue, 07 Jan 2025 12:27:00 GMT

Okay, I was on the right path then. I'd just create a custom rule which drops traffic if the IP is not in the list.