Oracle Cloud Infrastructure Documentation

Managing Network Perimeters

Network perimeters in an identity domain in Oracle Cloud Infrastructure (OCI) Identity and Access Management (IAM) restrict the IP addresses, countries, and VCNs that users can use to sign in.

You can perform the following tasks related to network perimeters:

IP Addresses

After you create a network perimeter, you can control who can sign in to an identity domain based on the user's IP address.

  • Allow only the IP addresses you specify.
  • Block specific IP addresses or ranges.

IAM supports both IPv4 and IPv6.

Allowlists and Blocklists

Allowlist
Only users signing in from the IP addresses you define are allowed to sign in to an identity domain.
Blocklist
Users signing in from IP addresses you define are denied access to an identity domain.

You can use an allowlist, a blocklist, or both, depending on your security policy.

IP Address Formats You Can Use

Single IP Address
  • Enter one or more exact IP addresses.
  • Separate multiple IP addresses with commas.
  • Examples: 10.11.12.13 (IPv4), 2001:db8::1 (IPv6).
IP Range (two addresses separated by a hyphen)
  • Specify a start and end IP address with a hyphen.
  • Example: (IPv4): 10.10.10.1-10.10.10.10. Any address from 10.10.10.1 through 10.10.10.10 is included.
CIDR Block (masked range)
  • Use a Classless Inter-Domain Routing (CIDR) notation to define a network.
  • The number after the slash is the prefix length (number of network bits).
  • Examples: 10.11.12.0/24 (all IPv4 addresses starting with 10.11.12), 2001:db8::/32 (IPv6).
Note

The examples listed use IP addresses with the IPv4 protocol. However, you can apply the same formats to IP addresses that use the IPv6 protocol (for example, B138:C14:52:8000:0:0:4D8).

After defining network perimeters, you can assign them to a sign-on policy, and configure the policy so that if you're trying to sign in to an identity domain using an IP address that's defined in the network perimeter, you can sign in to an identity domain or be prevented from accessing an identity domain. You can also use the network perimeter as a allowlist for OAuth token issuance for an OAuth client application. Token requests from outside the network perimeter will be denied.

You can also configure the your Enterprise or Confidential application by providing client configurations.

For more information about assigning network perimeters to a sign-on policy, see Add a Sign-On Policy.

For more information about restricting the Client IP address by a network perimeter (client configuration), see Configuring OAuth.

Network Perimeter Configuration Options

Network Perimeters help you control access by specifying the sources of requests. You can configure network perimeters using the following options:

Risky IP NetworkPerimeter

The Oracle-managed Risky IP NetworkPerimeter is available in each identity domain. This perimeter includes a dynamic set of IP addresses that have been designated as risky.

You can use this built-in network perimeter in sign-on policy rules, or assign it to applications to protect interactive sign-ins and OAuth token issuance. You can only update the Exclude IPs list for the Risky IP NetworkPerimeter; other modifications aren't allowed. IPs in the Exclude IPs list are excluded from the Risky IP NetworkPerimeter.

Geographic Locations as Named IPs

You can include geographic locations by specifying country names.
Note

Add Unknown locations to the Network Perimeter to include the unknown locations in the Network Perimeter.

IAM uses IP geolocation data to determine the source country of an IP address for each access request.

Virtual Cloud Networks

Add OCI virtual cloud networks (VCNs) to a network perimeter and define specific IP ranges.

Exclude IPs List

Exclude IP addresses from the network perimeter. Excluded IP addresses aren't included in the perimeter, even if they're listed in the IP address field. You can also define IP ranges that are excluded from a network perimeter.
Note

The Exclude IPs lists apply only to IP addresses and countries, not VCNs.

When to Use Network Perimeters

Use network perimeters to:

  • Protect interactive sign-ins by specifying Deny or multifactor authentication (MFA) for requests from risky IPs. Update sign-on policies to use the Risky IP NetworkPerimeter.
  • Protect token issuance by assigning the Risky IP NetworkPerimeter to the application.
  • Define conditional access for interactive sign-ins based on geographic locations or VCNs (or both) by specifying countries and VCNs in a network perimeter and updating sign-on policy rules to Deny or require MFA.
  • Allow token issuance only from specific geographic locations, VCNs, or both by assigning network perimeters to applications.

With these options, you can defend against modern threats using the built-in Risky IP NetworkPerimeter. You can also meet regulatory compliance requirements around geographic restrictions and enforce more granular perimeter controls for your private networks in IAM.