---
sourceDocument: Zurich Platform security
sourceDocumentLink: https://www.servicenow.com/docs/r/zurich/platform-security

 Release :

    - zurich

ft:locale :

    - en-US

ft:publication_title :

    - Zurich Platform security

ft:clusterId :

    - psec

bundleId :

    - psec

workflow :

    - Platform


---

# IP address access control

# IP address access control {#ariaid-title1}

* Release version: Zurich
* 
* Updated January 30, 2025
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 2 minutes to read

Apply an IP access control to outbound traffic, inbound traffic, or bidirectional traffic. The system only blocks an IP address if a matching Deny rule exists and no matching Allow rule exists. By default, there are no
restrictions on access to your instance.

## Before you begin

Note:  
Use the Adaptive Authentication (AA) pre-authentication context policy to enforce IP based authentications and restrictions for additional capabilities. For more information, see [Adaptive authentication](https://www.servicenow.com/docs/az_9pAZETVAxoWQR5xOLTg "Use the Adaptive authentication policy framework to enforce contextual authentication controls to the right users at the right time. Adaptive authentication uses authentication policies to evaluate authentication requests and then either deny or allow access to your instance based on the specified policy conditions.").

Role required: admin  
Important:  
IP Address Control access control rules can affect the MID Server outbound traffic. If you configure the denylist, add the MID Server IP addresses as allowlist exceptions to avoid connectivity disruptions. For MID Server IP requirements, see [MID Server system requirements](https://www.servicenow.com/docs/access?context=r_MIDServerSystemRequirements&version=zurich&pubname=zurich-servicenow-platform&ft:locale=en-US)

## Procedure

1. Navigate to AllSystem SecurityIP Address Access Control to see a list of your IP access controls.  
   You might have to activate the IP Range Based Authentication \[com.snc.ipauthenticator\] plugin.
2. Complete the form.  
   Note:  
   To find your instance IP information, Log in to [ServiceNow - NOW Support](https://support.servicenow.com/now), and Search for the My IP Information service catalog item.
   {#t_AccessControl__table_mym_412_hlb__entry__2}

   | Field | Description |
   |-|-|
   | MID Server traffic | MID Server outbound connections use the MID Server host IP address and not the instance. When using rules, add the MID Server host IP addresses to allowlist with the Outbound direction to avoid blocking MID Server traffic. For a list of MID Server IP requirements, see [MID Server system requirements](https://www.servicenow.com/docs/access?context=r_MIDServerSystemRequirements&version=zurich&pubname=zurich-servicenow-platform&ft:locale=en-US) |
   | Type | Type of access control rule to include. * Allow: Any IP address in this range can interact with this instance. * Deny: Any IP address in this range cannot interact with this instance unless it is listed in an Allow rule. Also, when adding deny rules, you cannot deny your own public IP address or your instance does not update a deny rule. {#t_AccessControl__ul_nm1_zb2_zq} Note: To support maintenance, upgrades, and Customer Service and Support, some ServiceNow internal IPs cannot be blocked by Deny rules. |
   | Direction | Direction of the IP access control rule. * Inbound: Choose Inbound to allow or deny inbound transactions. These are transactions initiated from outside of your instance. * Outbound: Choose Outbound to allow or deny outbound transactions. These are transactions initiated from within your instance. * Bidirectional: Choose Bidirectional for the configuration to apply for both Inbound and Outbound. {#t_AccessControl__ul_aqg_v12_hlb} |
   | Active | When selected, the form is active. |
   | Description | Description of the access control. |
   | Range Start | Starting range of IP addresses to allow or deny. Note: These rules also affect transferring update sets. To ensure that IP address access control does not cause update sets to fail, add the target instance as an exception. |
   | Range End | Ending range of IP addresses to allow or deny. Note: To limit access to specific VPN addresses only, enter a Deny range of 0.0.0.0 through 255.255.255.255 into the Deny field, and only enter the specific allowed VPN ranges. |
   | Ports | Comma-separated list of ports to which the access control rule applies. Leave it empty to apply the rule to all ports. |
   | Enforce on MID Server | When selected, applicability of the access control rule to outbound connections from MID Servers in addition to instance-level connections. |
   | Specify ports | When selected, enables the Ports field to enter specific ports for the rule. |
   [ ]

   {#t_AccessControl__table_mym_412_hlb}
3. Select Submit.

*[\>]: and then