How do I find the Allow and Deny Start and End Range for IP Range Based Authentication

[Gemma Jacobs]

Hi everyone, 

I need help defining the ip range ( system security - IP Address Access Control) to ensure the allow and deny range can be used in tandem. 

I reviewed this article to get the allow list https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB0550613

1. Log in using the admin role.
2. Navigate to System Logs > Transactions (All user).
3. Edit the filters as necessary.
4. Click the gear symbol .
5. In the slushbucket, add the column IP address from the Available column on the left side to the Selected column on the right side.
6. Click OK.
7. Click Run.
   However, this article explain to get the ip from NOW support. 

   https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB0598826

Not sure which is correct? 

Also, how do I determine the deny list? 

Thanks so much for all the help!

[Maik Skoddow]

Hi @Gemma Jacobs 

please provide first the underlying business requirement before we can answer.

That topic is too "hot" and complex in order just to answer for a technical without having the whole picture in mind.

Maik

[Gemma4]

Hi @Maik Skoddow 

Thank you and I'm sorry I didn't share more information. Our goal is to be compliant with the healthscan/instance security center. In order to make the restrict access to specific IP ranges compliant I need to set a range under system security-ip address access control.

In addition, we want our environment to be more secure with the allow and deny list. However I'm struggling to know and find what IP addresses to add to both the allow and deny list. I don't want to cause a problem by adding both allow and deny, that users can't access our system. Thanks for your help and feedback as this is not my specialty. 

[Maik Skoddow]

Hi @Gemma Jacobs / @Gemma4 

with the help of your screenshot, I now understand what you are referring to.

Let me tell you that the compliance score is just for orientation and not a must. And it is also impossible to reach the 100% level as some requirements are really special and make no sense for some customers. Furthermore, you should know that the underlying KPIs only cover a certain portion of ALL critical aspects you have to take care of. So don't stick to match to that compliance score!

And coming back to the original question: Restricting IP address ranges only makes sense in certain scenarios. For example, imagine you are running a public service portal. In that case, users are coming from allover the world, and it is impossible to restrict IP ranges or let's say it makes no sense.

In another scenario, you might want to restrict access to company internal users. In that case, you have to ask the network team for the IP ranges of the proxy servers the users are coming from.

What I want to say: Your question cannot be answered in that Community. Instead, engage an expert onsite and find a solution tailored to your instance, your network situation and your business.

[Gemma4]

Thank you @Maik Skoddow 

Thank you for the feedback it is really helpful. 

Is there any risk to how I added the range I did by using the transactions users ip address range?