---
schema_version: "1"
id: 3837df84f58b5a6c7f7cc04ea8562a725ece26dbeecbcd1ee92453064eec3f3f
title: Realm Security Rules for eCDN Zones
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/cc/264-0-0/b2c_configure_zone_realm_security_rules.md
canonical_url: https://help.salesforce.com/s/articleView?id=cc.b2c_configure_zone_realm_security_rules.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: 393c6ccfd1d4f20e5c8d4318f9036c906e5c12cdf3b15d5672038384b1bf0c18
description: Realm Security Rules let you define Managed IP Address Lists and custom firewall rules that control how trusted IP traffic is handled across all your eCDN zones for B2C Commerce. These rules replace the legacy Trusted IP configuration.
products:
  - Commerce
  - B2C Commerce
release: "264"
---
# Realm Security Rules for eCDN Zones

Realm Security Rules let you define Managed IP Address Lists and custom firewall rules that control how trusted IP traffic is handled across **all** your eCDN zones for B2C Commerce. These rules replace the legacy Trusted IP configuration.

![Note](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-cc-b2c_merchandiser_administrator-264-0-0-production-enus/ea76f372-6cfa-42a6-8e7c-05c6df7abed8/images/icon_note.png)

Note Realm Security Rules, including Managed IP Address Lists, are available on SCAPI zones. There's one SCAPI zone for Development, Staging, and Production. Configure it only from the Production instance. It doesn't appear in Business Manager or the CDN API on Development or Staging. Scope rules by org ID so that they don't affect other environments. See [SCAPI Zone Support for B2C Commerce](https://help.salesforce.com/s/articleView?id=cc.b2c_scapi_zone.htm&release=264.0.0&type=5 "A SCAPI zone is the Salesforce-managed eCDN zone that fronts Salesforce Commerce API (SCAPI) traffic. Starting with B2C Commerce 26.10, the Production instance includes a subset of eCDN security controls and analytics for this zone in Business Manager and the CDN API, with no support case required.").

Realm Security Rules provide two components that work together to manage trusted IP traffic:

Managed IP Address Lists

Named lists of IP addresses or CIDR ranges. You can scope a list to your entire realm (account level) or to a single zone (zone level). See [Manage IP Address Lists for eCDN Zones](https://help.salesforce.com/s/articleView?id=cc.b2c_manage_trusted_ip_address_lists.htm&release=264.0.0&type=5 "Create named lists of trusted IP addresses or CIDR ranges to use with custom firewall rules that bypass security checks for trusted traffic on your B2C Commerce storefront.").

Custom firewall rules

Rules that reference your IP address lists and define a skip action, so traffic from trusted IPs bypasses selected security checks. See [Create a Custom Firewall Rule for an eCDN Zone](https://help.salesforce.com/s/articleView?id=cc.b2c_create_eCDN_firewall_rule.htm&release=264.0.0&type=5 "Configure a custom firewall rule to control incoming traffic to your B2C Commerce storefront based on specified request parameters.").

![Important](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-cc-b2c_merchandiser_administrator-264-0-0-production-enus/ea76f372-6cfa-42a6-8e7c-05c6df7abed8/images/icon_important.png)

Important Realm Security Rules replace the legacy Trusted IP list groups that were previously configured via the Firewall tab in the zone settings slider. If you had existing Trusted IP configurations, Salesforce migrates them automatically. See [Trusted IP Migration to WAF Custom Rules](https://help.salesforce.com/s/articleView?id=cc.b2c_migrate_trusted_ips_to_custom_rules.htm&release=264.0.0&type=5 "Salesforce automatically migrates your legacy B2C Commerce Trusted IP configurations to web application firewall (WAF) custom rules and Managed IP Address Lists in the new Realm Security Rules tab. Learn what the migration does and how to verify your migrated configuration.") for details.

For information about what traffic a skip rule bypasses, the DDoS Layer 7 overrides, eligible zone types, and the feature switch that controls this functionality, see [eCDN Zone Security Rules](https://help.salesforce.com/s/articleView?id=cc.b2c_ecdn_security_rules.htm&release=264.0.0&type=5 "Use the Security Rules tab on the Configure Zone screen to protect a B2C Commerce embedded CDN (eCDN) zone with web application firewall (WAF) managed rulesets, realm and zone security rules, custom firewall rules, and rate limiting. Learn what each control does, which zone types are eligible, and how traffic from trusted sources bypasses security checks.").

## The Realm Security Rules Tab in B2C Commerce

Realm Security Rules is a sub-tab of the **Security Rules** tab on the Configure Zone screen. To open the Configure Zone screen, select **Configure Zone** from a zone's dropdown menu on the Embedded CDN Settings page.

**Configure Zone option in the zone dropdown menu**

![Embedded CDN Settings page showing the Configure Zone option in the zone actions dropdown menu](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-cc-b2c_merchandiser_administrator-264-0-0-production-enus/ea76f372-6cfa-42a6-8e7c-05c6df7abed8/cc/b2c_merchandiser_administrator/images/b2c_ecdn_settings_configure_zone_menu.png)

At the account level, the tab lists your custom firewall rules and Managed IP Address Lists, including rules migrated from legacy Trusted IP configurations.

**Realm Security Rules tab — account level**

![Realm Security Rules tab at the account level showing migrated custom firewall rules and Managed IP Address Lists](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-cc-b2c_merchandiser_administrator-264-0-0-production-enus/ea76f372-6cfa-42a6-8e7c-05c6df7abed8/cc/b2c_merchandiser_administrator/images/b2c_ecdn_realm_security_rules_account_level.png)

Each custom firewall rule uses IP address list conditions to match trusted traffic, and skip actions to define which security checks that traffic bypasses.

**Custom firewall rule — skip action detail**

![Edit Custom Rule dialog showing IP address list conditions and Skip actions configured for a migrated Trusted IP allowlist rule](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-cc-b2c_merchandiser_administrator-264-0-0-production-enus/ea76f372-6cfa-42a6-8e7c-05c6df7abed8/cc/b2c_merchandiser_administrator/images/b2c_ecdn_realm_security_rules_custom_rule.png)

Managed IP Address Lists and their associated custom firewall rules can be scoped at two levels:

| Scope | Where it applies | Eligible zone types |
| --- | --- | --- |
| **Account (Realm)** | Applies to all eligible zones in your realm, including development, staging, production, and sandbox instances. | Proxy, Legacy, Default Domain, and SCAPI zones |
| **Zone** | Applies only to the specific zone you're configuring. Two zones in the same realm can have independent zone-level lists with the same name without conflict. | Proxy, Legacy, Default Domain, and SCAPI zones |

![Note](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-cc-b2c_merchandiser_administrator-264-0-0-production-enus/ea76f372-6cfa-42a6-8e7c-05c6df7abed8/images/icon_note.png)

Note Account-level changes affect all eligible zones across development, staging, and production. A warning banner is displayed when you make account-level changes on a Production instance. On non-production instances, the Realm Security Rules tab is read-only. Use the Production instance to create or modify account-level rules and lists.

**Realm Security Rules tab — zone level**

![Realm Security Rules tab at the zone level showing custom firewall rules and Managed IP Address Lists scoped to a single zone](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-cc-b2c_merchandiser_administrator-264-0-0-production-enus/ea76f372-6cfa-42a6-8e7c-05c6df7abed8/cc/b2c_merchandiser_administrator/images/b2c_ecdn_realm_security_rules_zone_level.png)

**Zone Security Rules tab**

![Zone Security Rules tab showing zone-level custom firewall rules, rate limiting rules, and WAF-v2 eCDN Managed Ruleset settings for a specific eCDN zone](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-cc-b2c_merchandiser_administrator-264-0-0-production-enus/ea76f372-6cfa-42a6-8e7c-05c6df7abed8/cc/b2c_merchandiser_administrator/images/b2c_ecdn_zone_security_rules.png)

## Realm Security Rules Permissions in B2C Commerce

| Action | Required role |
| --- | --- |
| View Realm Security Rules and lists (any instance) | eCDN Admin or eCDN Viewer |
| Create, edit, or delete rules and lists | eCDN Admin (Production instance only) |

On non-production instances (staging, development, sandbox), the Realm Security Rules tab is read-only. A blue information banner indicates: _"Realm-level configuration is read-only on this instance. Use the Production instance to make changes."_

On Production, an amber warning banner indicates: _"Account-level changes affect all zones (development, staging, and production)."_

- **[Manage IP Address Lists for eCDN Zones](https://help.salesforce.com/s/articleView?id=cc.b2c_manage_trusted_ip_address_lists.htm&release=264.0.0&type=5)**  
    Create named lists of trusted IP addresses or CIDR ranges to use with custom firewall rules that bypass security checks for trusted traffic on your B2C Commerce storefront.
- **[Trusted IP Migration to WAF Custom Rules](https://help.salesforce.com/s/articleView?id=cc.b2c_migrate_trusted_ips_to_custom_rules.htm&release=264.0.0&type=5)**  
    Salesforce automatically migrates your legacy B2C Commerce Trusted IP configurations to web application firewall (WAF) custom rules and Managed IP Address Lists in the new Realm Security Rules tab. Learn what the migration does and how to verify your migrated configuration.