Configuring a Denylist

Networking Requirements

Figure 1 shows the networking configuration of API data security protection.

Figure 1 Reverse proxy networking

Configuring a Denylist

Before configuring a denylist, ensure that you have added application assets. For details, see Adding a Proxy Application. Ensure that no rules that conflict with the denylist are enabled. Figure 2 shows the process of configuring a denylist.

Figure 2 Configuring a denylist

1. Log in to the API data security protection web console as user sysadmin.
2. In the navigation pane on the left, choose Security Policies > Access Control.
3. Click the Denylist tab and click Add in the upper right corner.
4. In the Add Rule dialog box, configure the denylist, as shown in Figure 2.
5. After the configuration is complete, click OK to save the denylist.

Verifying a Denylist

1. Enter the proxy connection IP address and port (172.16.35.44:8182) of the application in the address box of the browser as the client IP address 172.16.212.65. If the access is denied, the denylist takes effect. The following figure shows an example.
   Figure 3 Access denied
   

2. Log in to the API data security protection web console as user sysadmin.
3. Choose Log Management > Alerts, locate the target request record, and click Details.
4. If the request matches the configured denylist and the access risk severity is marked as unauthorized, the denylist takes effect.