The IP address whitelist feature in Data Management (DMS) lets you control which IP addresses can access DMS. This feature helps you manage employee access and ensures that DMS is used only within trusted network environments. This topic describes the use cases and features of the IP address whitelist and provides solutions to frequently asked questions.
Use cases
This feature is ideal for an enterprise network with a static outbound IP address. By adding the static IP address to the whitelist, you can restrict DMS access to your corporate network. For help configuring your outbound IP address, contact technical support.
How it works
Initial state
By default, the IP address whitelist feature is enabled when you activate DMS. The initial whitelist contains a single entry, 0.0.0.0/0, which allows access from any IP address. This default entry serves only as a format example.
Procedure
Log in to DMS 5.0.
-
Move the pointer over the
icon in the upper-left corner and choose . NoteIf you use the DMS console in normal mode, choose in the top navigation bar.
Supported operations
-
Disable the IP address whitelist feature
After you disable this feature, any IP address can access DMS. DMS saves your existing whitelist configuration but does not enforce it.
-
Enable the IP address whitelist feature
After you enable this feature, only IP addresses on the whitelist can access DMS.
-
Add an IP address to the whitelist
Click Add to Whitelist. In the dialog box, enter the IP Address and Description, and then click Submit.
To add multiple IP addresses, separate them with semicolons (;).
-
Delete an IP address from the whitelist
Click Delete next to the entry you want to delete. In the Prompt dialog box, click OK.
-
Edit a whitelist entry
Click Edit next to the entry you want to modify. In the dialog box, modify the IP Address or Description, and then click Submit.
FAQ
-
Q: How can employees who work from home access DMS if an IP address whitelist is configured?
A:
-
If your company provides a VPN, employees who work from home can connect to the VPN. Their outbound IP address will then match the corporate office IP address, so no changes to the whitelist are needed.
-
If your company does not provide a VPN, the employee must provide their local IP address to the administrator to have it temporarily added to the whitelist.
-
-
Q: Our company has multiple office locations with different IP addresses. What should we do?
A: You can add the outbound IP address of each office location to the whitelist.
-
Q: If we add an IP address for temporary access, can we remove it later?
A: Yes. You can delete the entry from the whitelist when access is no longer required.
-
Q: After a power outage and restart in our IT data center, the outbound IP address changed and we cannot access the system. What should we do?
A:
-
Submit a ticket to Alibaba Cloud. In the ticket, provide the Alibaba Cloud account ID that was used to activate DMS Enterprise. Our support team will process your request to temporarily disable the IP address whitelist. An administrator can then log in and update the whitelist with the new IP address.
-
A future release will allow administrators to bypass the IP address whitelist by using SMS verification. Administrators can then log in and modify the configuration.
-
-
Q: The IP address whitelist feature is enabled by default with a configuration of
0.0.0.0/0, which allows access from any IP address. Does this pose a security risk?A: No. This default configuration does not pose a security risk because DMS Enterprise provides two additional layers of security. After you activate the service, you can refine this setting by adding specific IP addresses or by disabling the feature. These layers are:
-
Alibaba Cloud authentication: Users must authenticate with a valid Alibaba Cloud account.
-
DMS user management: Even if an employee has a valid Alibaba Cloud account or RAM user, they cannot access DMS Enterprise unless they have been added as a DMS Enterprise user.
-
-
Q: Access to DMS failed, and the system displayed an error message: "Access Denied. Your machine IP is not in the whitelist allowed by the enterprise." What should I do?
A: You can contact your administrator to add your local IP address to the IP address whitelist. Alternatively, you can ask the administrator to disable the IP address whitelist as suggested on the error page.