Question 1

What is Network Shield and how does it work?

Accepted Answer

Network Shield is a Firewall module on the Azion Web Platform that provides programmable network-layer protection. It allows you to create Network Lists based on IP/CIDR addresses, Autonomous System Numbers (ASNs), and countries (geolocation), then reference those lists in the Firewall Rules Engine to block, deny, or rate-limit traffic. When a request arrives at an Azion location, it's evaluated against your configured rules and network lists , filtering out known offenders before the request reaches your infrastructure.

Question 2

What is the difference between Network Shield and a Web Application Firewall (WAF)?

Accepted Answer

Network Shield operates at the network layer (Layer 3/4), filtering traffic based on IP addresses, CIDR blocks, ASNs, and geolocation before requests are processed. WAF operates at the application layer (Layer 7), analyzing HTTP/HTTPS request content to detect attacks like SQL injection and XSS. Both are modules within Azion's Firewall and can be combined in the same firewall configuration for comprehensive protection — Network Shield blocks known bad actors and regions, while WAF inspects the content of allowed requests for application-level threats.

Question 3

What types of Network Lists can I create?

Accepted Answer

Network Shield supports three types of Network Lists: IP/CIDR lists for blocking or allowing specific IP addresses and CIDR ranges, ASN lists for filtering traffic by Autonomous System Number (groups of IP networks managed by specific operators), and Country lists for geolocation-based access control. You can also use Azion-managed lists like the Tor Exit Nodes list, which is automatically maintained and updated by Azion's security team.

Question 4

How quickly do Network List updates propagate?

Accepted Answer

Network List updates propagate across Azion's entire global infrastructure in seconds. When you update a list via Console or API, changes are automatically applied to all firewalls that reference that list — without any service interruption or downtime window. This near-instant propagation enables real-time threat response, allowing your security automation tools to update blocklists and see immediate effects across all locations.

Question 5

Can I share Network Lists across multiple firewalls?

Accepted Answer

Yes. A single Network List can be associated with multiple firewalls and rules. When you update the list, changes propagate automatically to all associated firewalls. This centralized management approach ensures consistent security policies across all your applications without duplicating configuration or risking policy drift between environments.

Question 6

What is Origin Shield and how does it relate to Network Shield?

Accepted Answer

Origin Shield is a security add-on that provides a dynamic Network List containing all IP/CIDR addresses used by Azion's infrastructure. By configuring your origin server's firewall to accept traffic only from Origin Shield addresses, you create a Layer 3/4 perimeter that blocks all direct external access to your origin. Origin Shield requires the Network Shield module to be enabled and is maintained automatically by Azion, with clients notified 7 days before any changes to the IP list.

Question 7

How much does Network Shield cost?

Accepted Answer

Network Shield is included as a module within Azion's Firewall product. You can start with $300 in free credits to test the service with no credit card required. Pricing is usage-based with no hidden fees or infrastructure costs. Since Network Shield blocks unwanted traffic before it reaches your infrastructure, most customers see significant cost savings on bandwidth and infrastructure. For detailed pricing, visit the pricing page.

Question 8

Can I automate Network List updates with my SIEM or security tools?

Accepted Answer

Yes. Network Shield integrates with your existing security infrastructure through the Azion API. Stream security events in real time to your SIEM using Data Stream, then use automated playbooks to update Network Lists via API with effects propagated in seconds. You can also use Functions to implement programmable per-request logic, enabling dynamic threat response that adapts to evolving attack patterns without manual intervention.

Block threats at the network layer before origin

Block traffic before origin

Eliminate bandwidth waste from attacks

Propagate rules in seconds

Protect any environment consistently

Share lists across firewalls

Automate threat response at scale

Block threats at the network layer, before they consume resources

Programmable network-layer security

Rule-based traffic control with centralized list management

Automated threat response with real-time event streaming

Lock down your infrastructure

Frequently Asked Questions

Protected by default.Always on.