How to retrieve Azion IP ranges for origin server allowlisting

When your application’s origin server sits behind Azion, all inbound requests arrive from Azion’s global infrastructure — not directly from end users. To secure your origin, you need to allowlist only Azion’s IP/CIDR ranges and block everything else.

Origin Shield provides the Azion Origin Shield network list — a curated, dynamically updated list of all IPv4 and IPv6 prefixes used exclusively by Azion’s global infrastructure to connect to origin servers.

Prerequisites

• The Network Shield module enabled on your Firewall.
• An active Origin Shield add-on subscription. Contact the sales team to subscribe.

Access the list via Azion Console

1. Access Azion Console > Network Lists.
2. Select Azion Origin Shield from the list.
3. In the List field, copy all IP/CIDR entries.

Access the list via API

Run the following request, replacing [TOKEN VALUE] with your personal token:

curl --request GET \
--url https://api.azion.com/v4/workspace/network_lists \
--header 'Accept: application/json' \
--header 'Authorization: Token [TOKEN VALUE]'

The response will include the Azion Origin Shield entry:

{
"count": 4,
"total_pages": 1,
"schema_version": 3,
"links": {
  "previous": null,
  "next": null
},
"results": [
  {
    "id": 2345,
    "last_editor": "last.editor@azion.com",
    "last_modified": "2023-03-27T21:19:27.996870Z",
    "list_type": "ip_cidr",
    "name": "Azion Origin Shield",
    "country_list": [],
    "ip_list": [
      "192.0.2.0/24",
      "2001:db8::/32"
    ]
  }
]
}

The ip_list field contains all current Azion prefixes. Use these values to configure your origin firewall.

Related resources