IP address book - Web Application Firewall - Alibaba Cloud Documentation Center

Manually configuring and maintaining the same set of IP addresses across multiple Web Application Firewall (WAF) protection rules is inefficient and error-prone. The IP address book feature allows you to create reusable collections of IP addresses and reference them in multiple protection rules. When an IP address changes, you only need to update it in the address book, and all referencing rules are automatically synchronized. This simplifies configuration and ensures policy consistency.

Scope

Supported protection modules: IP address books can be used in any protection module that allows you to set the Match Field to IP.
IP address limit: The maximum number of IP addresses varies by WAF edition. For more information, see Editions.
Integration limits: Function Compute (FC) is not supported. MSE requires version 2.0.18 or later. API Gateway requires version 2.1.13 or later.

Procedure

Create an IP address book

Log on to the Web Application Firewall 3.0 console. From the top menu bar, select the resource group and region (Chinese Mainland or Outside Chinese Mainland) for the WAF instance.
In the left navigation pane, go to Protection Config > Global Configuration > IP Address Book.
Click Create IP Address Book, configure the following parameters, and then click OK.
- Address Book Name: Enter a descriptive name for the address book.
- Description: Enter a description based on your business needs.
- IP Address: Enter IP addresses to add to the address book. You can add IP addresses in two ways: Manual Entry and Upload CSV File.
  - Manual Entry: Enter IP addresses in the text box. For example:
```
203.0.113.1,203.0.113.0/24,2001:db8::1,2001:db8::/32
```
  - Upload CSV File: Click Upload File and select a CSV file to upload. Each file can contain up to 2,000 IP addresses or CIDR blocks, and the file size must not exceed 1 MB. For large numbers of IP addresses, upload in batches. Example CSV file content:
```
Address
203.0.113.1
203.0.113.0/24
2001:db8::1
2001:db8::/32
```

Apply the IP address book to protection rules

After you create an address book, you can apply it to protection rules to avoid the maintenance overhead of duplicate configurations. For example, in the Whitelist module, when you create a whitelist rule and set the Match Field to IP, you can select an existing IP address book. A single rule can reference up to 5 IP address books. For more information, see Add a whitelist rule in a template.

Daily O&M

View associated protection rules: Find the target IP address book and click the icon in the Associated Rules column.
Search for an address book: You can search for an address book by name or IP address in the search box. IP address search supports only exact matches. For example, if an address book contains 192.168.1.0/24, searching for 192.168.1.10 will not return it.
Edit an IP address book: Find the target IP address book and click Edit in the Actions column to perform operations such as Add IP Address, Import IP Addresses, and Clear IP Addresses.
Delete an IP address book: Find the target IP address book and click Delete in the Actions column. You can only delete address books that are not associated with any protection rules.

FAQ

Is the IP address book feature free of charge?

Yes, the IP address book feature is free of charge. However, the maximum number of IP addresses varies by WAF edition. For more information, see Editions.

What is the purpose of the default `Security Center Vulnerability Scanning IPs` address book ?

The System Address Book named Security Center Vulnerability Scanning IPs is a predefined list of IP addresses used by the Security Center vulnerability scanner. If you use Security Center, you can reference this address book in a whitelist rule to allow the scanner to access your servers and perform vulnerability scans. For more information, see Vulnerability scanning.