The option to Restrict IP Addresses, part of the Logon Protection feature, protects your ePO - On-prem server from invalid logon attempts by blocking source IP addresses or allowing only certain IP addresses. You can also monitor logon attempts and manage IP addresses, manually or automatically.
This feature is disabled by default and must be manually enabled by an administrator.
If ePO - On-prem detects a malicious logon attempt from an IP address, that IP address is added to the IP Address Management table and blocked. Access to ePO - On-prem is blocked until you unblock or delete the address from the table. The Actions option allows you to unblock an IP address by adding it, so logon from the address is allowed.
Managing IP addresses
You must enable automatic IP address restriction to manually add IP addresses.
From Server Settings, select Logon Protection, then Edit. You can manage IP addresses in two ways:
Automatically — When enabled, automatically blocks IP addresses after failed logon attempts (more than 10 tries within 60 seconds), and adds the address to the IP Address Management table.
Manually — Allows you to add an IP address or range of addresses to the IP Address Management table. You can permanently block or allow access, regardless of logon attempts.
Note
When adding a range of IP addresses, you might accidentally block your own IP address. If this occurs, access the ePO - On-prem console directly from the hosted server and add or unblock the IP address so that it's included in the Allow List. The server always has access because the localhost is never blocked.
Monitoring logon attempts
The Audit Log tracks the history of changes to or enforcement of any IP address. For example, you can see if an IP address is blocked, if logon attempts are made from a blocked IP address, and the start and completion time of an attempt.
From Automatic Responses, select Logon Protection, then Edit. You can configure email notifications when the following occurs:
Too many failed logons occur from an IP address.
A blocked IP address attempts to log on.
A system blocks an IP address.