---
schema_version: "1"
id: 3f26a10ef07522541274dd253b0412dee64a2eb5d6b296841a056940be6a5406
title: Using the Login IP Allowlist with Broad or Dynamic IP Ranges
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/mktg/264-0-0/mc_overview_allowlist_large_ranges.md
canonical_url: https://help.salesforce.com/s/articleView?id=mktg.mc_overview_allowlist_large_ranges.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: a51ae7c85f63d6a041aa6de0aab76c0b02c3ab0d511aad27d89f28670fb8fd24
description: For the login IP allowlist to be effective, traffic that accesses your Marketing Cloud Engagement account must come from a stable IP range. If your organization uses the public cloud, dynamic infrastructure, or distributed networks, or if you have many remote employees, your users can access Marketing Cloud Engagement from a diverse range of IP addresses. In these situations, establish a stable egress path for your users before you turn on the login IP allowlist in blocking mode.
products:
  - Marketing
  - Marketing Cloud Engagement
release: "264"
---
# Using the Login IP Allowlist with Broad or Dynamic IP Ranges

For the login IP allowlist to be effective, traffic that accesses your Marketing Cloud Engagement account must come from a stable IP range. If your organization uses the public cloud, dynamic infrastructure, or distributed networks, or if you have many remote employees, your users can access Marketing Cloud Engagement from a diverse range of IP addresses. In these situations, establish a stable egress path for your users before you turn on the login IP allowlist in blocking mode.

Use one of these recommended strategies to handle broad IP ranges when blocking mode is on:

- **Static egress IP:** Configure your cloud environment so that Marketing Cloud Engagement traffic exits through a static public IP, such as an Elastic IP.
- **Dedicated egress proxy:** Route traffic through a proxy or API gateway with a fixed public IP.
- **Corporate VPN:** Route traffic through your corporate VPN so that requests exit through a known, stable public IP range.
- **Centralized cloud NAT or egress gateway:** Consolidate outbound traffic from multiple cloud workloads behind a small set of static public IP addresses.
- **Enterprise gateway:** If API traffic passes through an API gateway, enterprise service bus, or integration gateway, configure it to use stable outbound IP addresses for Marketing Cloud Engagement traffic.
- **Stable provider ranges:** If your cloud or network provider has a predictable range of outbound addresses, add the smallest appropriate CIDR range to your allowlist. This solution is easier to maintain than a large list of individual addresses.

#### See Also

- [Add IP Addresses to the Login IP Allowlist](https://help.salesforce.com/s/articleView?id=mktg.mc_overview_allowlist_ip.htm&release=264.0.0&type=5 "Add IP addresses and ranges to the login IP allowlist for Marketing Cloud Engagement.")
- [Enable and Configure the Login IP Allowlist](https://help.salesforce.com/s/articleView?id=mktg.mc_overview_enable_allowlisting.htm&release=264.0.0&type=5 "Configure the behavior of the login IP allowlist in your Marketing Cloud Engagement account.")