This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(38.4, 21%, 13%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ENB%3C/text%3E%3C/svg%3E)
Hi,
Is it possible to set the allowed ip values or ranges in ip whitelisting policy through variables?
An Azure service that provides a hybrid, multi-cloud management platform for APIs.
Answer accepted by question author
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(0, 59%, 10%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EJM%3C/text%3E%3C/svg%3E)
Hi @Nagashree Balasundaram Thanks for reaching out. please find the sample policy below and could you please also confirm if this is what you're looking for ?
To benefit the community find the right answers, please do mark the post which was helpful by clicking on ‘Accept Answer’ & ‘Up-Vote’.
Thanks @JananiRamesh-MSFT for the quick response. Is it possible to populate the ranges as well in the same format as above?
Another query - If you have to add a new entry, we have to repeat the <address> element multiple times. Is that the only option? The intent behind this query is - if you already deployed the API with the ip whitelist policy defined with one address, if you need to modify and add another IP address restriction - defining another <address> element would mean changes to the policy code and redeployment of the API. Is there a way to avoid redeployment and just handle it through configuration?
Hi @Nagashree Balasundaram Thanks for getting back please refer the policy below for ranges
you can use namedvalues to avoid redeployments.
please let me know incase of further queries, I would be happy to assist you.
To benefit the community find the right answers, please do mark the post which was helpful by clicking on ‘Accept Answer’ & ‘Up-Vote’.
@JananiRamesh-MSFT , Thanks again.
Namedvalues would help to update the range or the individual address. If i have a new IP or range that I want to whitelist, that would require adding the address element in the xml right?
<ip-filter action="allow ">
<address>{{whitelist-1}}</address>
<address-range from="{{whitelistrange1-start}}"" to="{{whitelistrange1-end}}" />
</ip-filter>
Namedvalues initially defined
whitelist-1 10.1.32.24
whitelistrange1-start 10.3.20.21
whitelistrange1-end10.3.20.34
If i want to add a new whitelist, i can add whitelist-2 10.23.21.89 namedvalue. But how do i have it included in the policy without redeployment? Is that possible? or can address take something like comma separated values or ip mask etc
<ip-filter action="allow ">
<address>{{whitelist-1}}</address>
<address-range from="{{whitelistrange1-start}}"" to="{{whitelistrange1-end}}" />
<address>{{whitelist-2}}</address>
</ip-filter>
@Nagashree Balasundaram Yes, if you need to whitelist new set of ip address then you need to add address element again. To modify the existing IP address you can use named values. Named values can be used for both range as well as individual address.
Thanks again, for making it very clear. So it does require a redeployment if there are new ips/ranges to be added for the restriction. We were hoping to drive it through configuration. I will post it here if I find some workarounds in achieving that.
Are Policyfragments useful for this scenario?