--- schema_version: "1" id: a839c2b771d69a649005a4534bc68880d2dc70fd656b62aa38c0558fb1593728 title: Manage IP Address Lists for eCDN Zones collection: admin version: current locale: en-us portal_url: https://docs.salesforce.com/admin/current/en-us/cc/264-0-0/b2c_manage_trusted_ip_address_lists.md canonical_url: https://help.salesforce.com/s/articleView?id=cc.b2c_manage_trusted_ip_address_lists.htm&release=264.0.0&type=5 source_site: help.salesforce.com content_type: documentation content_hash: 0ca94d71bcfad35162d7a6aa0dc60ff456cf632493da655b819a0255d8df2668 description: Create named lists of trusted IP addresses or CIDR ranges to use with custom firewall rules that bypass security checks for trusted traffic on your B2C Commerce storefront. products: - Commerce - B2C Commerce release: "264" --- # Manage IP Address Lists for eCDN Zones Create named lists of trusted IP addresses or CIDR ranges to use with custom firewall rules that bypass security checks for trusted traffic on your B2C Commerce storefront. You must have the eCDN Admin role on the Production instance to create or modify Managed IP Address Lists. On non-production instances the Realm Security Rules tab is read-only. ![Note](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-cc-b2c_merchandiser_administrator-264-0-0-production-enus/ea76f372-6cfa-42a6-8e7c-05c6df7abed8/images/icon_note.png) Note IP access lists are available on SCAPI zones. There's one SCAPI zone for Development, Staging, and Production. Configure it only from the Production instance. It doesn't appear in Business Manager or the CDN API on Development or Staging. A list or rule applied on Production affects all three environments unless you scope it by org ID. See [SCAPI Zone Support for B2C Commerce](https://help.salesforce.com/s/articleView?id=cc.b2c_scapi_zone.htm&release=264.0.0&type=5 "A SCAPI zone is the Salesforce-managed eCDN zone that fronts Salesforce Commerce API (SCAPI) traffic. Starting with B2C Commerce 26.10, the Production instance includes a subset of eCDN security controls and analytics for this zone in Business Manager and the CDN API, with no support case required."). Managed IP Address Lists are named collections of IP addresses or CIDR ranges. For how lists are scoped at the account (realm) or zone level and which zone types are eligible, see [Realm Security Rules for eCDN Zones](https://help.salesforce.com/s/articleView?id=cc.b2c_configure_zone_realm_security_rules.htm&release=264.0.0&type=5 "Realm Security Rules let you define Managed IP Address Lists and custom firewall rules that control how trusted IP traffic is handled across all your eCDN zones for B2C Commerce. These rules replace the legacy Trusted IP configuration."). Two list types are supported: - **Allowlist** — IP addresses that should bypass security checks. Use with a Custom Firewall Rule with skip actions. - **Blocklist** — IP addresses that should be explicitly blocked. Use with a Custom Firewall Rule with a block action. After creating a list, create a Custom Firewall Rule that references the list and specifies the appropriate action. See [Create a Custom Firewall Rule for an eCDN Zone](https://help.salesforce.com/s/articleView?id=cc.b2c_create_eCDN_firewall_rule.htm&release=264.0.0&type=5 "Configure a custom firewall rule to control incoming traffic to your B2C Commerce storefront based on specified request parameters."). ![Important](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-cc-b2c_merchandiser_administrator-264-0-0-production-enus/ea76f372-6cfa-42a6-8e7c-05c6df7abed8/images/icon_important.png) Important Trusted IP Skip behavior is enforced at zone scope. A Cloudflare account-level Skip rule does not bypass zone-level rules. If you add a new zone to your realm, you must ensure the Skip rule exists at the new zone level for the Managed IP List to take effect against zone-level rules on that zone. ![Important](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-cc-b2c_merchandiser_administrator-264-0-0-production-enus/ea76f372-6cfa-42a6-8e7c-05c6df7abed8/images/icon_important.png) Important List names are automatically prefixed with `customer_` by the system. You enter only the name portion. The prefix is stripped from display in Business Manager but is required internally. For example, if you enter trusted\_ips, the list is stored as `customer_trusted_ips`. 1. In Business Manager, click the App Launcher, and then select **Administration** | **Sites** | **Embedded CDN Settings**. 2. Locate the zone you want to configure and select **Configure Zone** from the dropdown menu. 3. Select the **Security Rules** tab, then select the **Realm Security Rules** sub-tab. 4. In the Managed IP Address Lists section, click **New List**. 5. Select the scope for the list. | Scope | Description | | --- | --- | | **Account** | The list applies to all eligible zones in your realm (Proxy, Legacy, and Default Domain zones). | | **Zone** | The list applies only to the current zone. | 6. Enter a name for the list. Follow these naming requirements: - Use only lowercase letters, numbers, and underscores. - Maximum 41 characters for the name you enter (the system adds a `customer_` prefix, making the total stored name 50 characters maximum). - Hyphens and spaces are not allowed. Use underscores instead — for example, enter support\_team\_vpn instead of support-team-vpn. The stored name format differs by scope and list type: | Scope | List type | Stored name format | | --- | --- | --- | | Account | Allowlist | `customer_name` — for example, `customer_trusted_ips` | | Account | Blocklist | `customer_blk_name` — for example, `customer_blk_blocked_ips` | | Zone | Allowlist | `customer_zoneID_name` — the system automatically prepends the first 8 characters of the zone ID, for example, `customer_81d5067d_trusted_ips` | | Zone | Blocklist | `customer_zoneID_blk_name` — for example, `customer_81d5067d_blk_blocked_ips` | Zone-level list names are automatically namespaced with the zone ID prefix by the system to prevent naming collisions. Two zones in the same realm can have lists with the same name without conflict. 7. In the IP Addresses field, enter the IP addresses or CIDR ranges to include in the list. Enter one record per line. Accepted formats: - Single IPv4 address — for example, `198.51.100.1` - IPv4 CIDR range — for example, `198.51.100.0/24` 8. Click **Save**. The list appears in the Managed IP Address Lists section. To use this list to bypass security checks for trusted traffic, create a Custom Firewall Rule that references it. See [Create a Custom Firewall Rule for an eCDN Zone](https://help.salesforce.com/s/articleView?id=cc.b2c_create_eCDN_firewall_rule.htm&release=264.0.0&type=5 "Configure a custom firewall rule to control incoming traffic to your B2C Commerce storefront based on specified request parameters."). To edit a list, select it from the Managed IP Address Lists section, update the IP addresses, and click **Save**. To delete a list, select it and click **Delete**. Deleting a list also removes any Custom Firewall Rules that reference it.