Help Center/ Cloud Firewall/ User Guide/ Attack Defense/ Configuring Intrusion Prevention/ Configuring the IPS Whitelist
Updated on 2026-09-14 GMT+08:00
View PDF
Share

Configuring the IPS Whitelist

Scenario

A company requires uninterrupted access to specific IP addresses while checking the traffic of other IP addresses. However, IPS checks all traffic by default and may accidentally block normal traffic.

In CFW, you can add trusted IP addresses to the IPS whitelist. The traffic of the whitelisted IP addresses will not be checked by IPS. In this way, you can protect workloads without affecting critical services.

This section describes how to configure the IPS whitelist.

Impacts on Services

The IP addresses configured in the IPS whitelist will not be checked by IPS.

Notes and Constraints

  • Up to 256 IPS whitelist items can be configured for a firewall instance.

    Calculation method: When you configure an IPS whitelist item, if you select EIP + VPC, or EIP + NAT, or all options for Effective Scope, this item will be counted as two items. A whitelist item with other settings will be counted as one.

Adding an IPS Whitelist Item

  1. Enable at least one type of traffic protection.

  2. Log in to the CFW console.
  3. Click in the upper left corner of the management console and select a region or project.
  4. (Optional) Switch to another firewall instance. If there are multiple firewall instances, you can select a desired instance from the drop-down list in the upper left corner of the page.
  5. In the navigation pane on the left, choose Protection Policies > Attack Defense > Intrusion Prevention.
  6. Click the IPS Whitelist tab. On the displayed page, click Add IPS Whitelist and configure the IPS whitelist parameters.

    The IPS whitelist takes effect immediately after being configured.

    Table 1 IPS whitelist

    Parameter

    Description

    IPS Whitelist Name

    User-defined IPS whitelist name.

    It must meet the following requirements:
    • Only uppercase letters (A to Z), lowercase letters (a to z), numbers (0 to 9), and the following special characters are allowed: -_
    • A maximum of 255 characters are allowed.

    IP Type

    IP address type. It can be IPv4 or IPv6.

    Effective Scope

    Select the scope of traffic to be allowed.

    IPv6 protection is supported only for EIPs.

    Source
    Configure the session initiator.
    • IP address: Enter a single IP address, for example, 192.168.10.1 or 2407:c834:125d:ff01:1103:15a7:6462:0536, or a subnet, for example, 192.168.10.2/24 or 2407:c834:125d:ff01:1103:15a7:6462:0536/32.
    • Any: It indicates all IP addresses.

    Destination
    Configure the session recipient.
    • IP address: Enter a single IP address, for example, 192.168.10.1 or 2407:c834:125d:ff01:1103:15a7:6462:0536, or a subnet, for example, 192.168.10.2/24 or 2407:c834:125d:ff01:1103:15a7:6462:0536/32.
    • Any: It indicates all IP addresses.

    IPS Rule ID
    Select the ID of the IPS rule to allow traffic.
    • IPS rule ID: Set a single rule to allow the traffic from Source to Destination.
    • All: Let all rules allow the traffic from Source to Destination.

    Description

    (Optional) Enter the remarks for the whitelist.

  7. Click OK.

Related Operations

  • To modify an IPS whitelist item, click Edit in its Operation column. On the page that is displayed, configure IPS whitelist parameters and click OK.
  • To delete an IPS whitelist item, click Delete in its Operation column. In the dialog box that is displayed, confirm the information, enter DELETE, and click OK.
  • For details about how to modify the overall IPS protection, see Configuring Basic IPS Protection.
  • For details about custom signature rules, see Adding a Custom IPS Signature.
Parent Topic: Configuring Intrusion Prevention