Risk Engine - unable to update IP allowed and blocked addresses

Products

• Symantec Identity Security Platform - IDSP (formerly VIP Authentication Hub)

Issue/Introduction

Following the documentation to update allowed and blocked IP addresses, as described in this document: https://techdocs.broadcom.com/us/en/symantec-security-software/identity-security/vip-authentication-hub/3-4/Using/Management-APIs/vip-auth-hub-risk-engine/risk-management/risk-service-apis.html#_060878bc-3941-4f39-b344-db6cc8859715_blockedIP . Your fraud database contains about 1,000,000 entries. You have about a million CIDR entries. This means, You will have about a million elements in the array "ipAddressList". Using the API IPList/BLOCKED is not practical and not possible at all. Please, advise in what manner these IP ranges can be uploaded. If they are in CIDR format, that would be perfect.

Environment

VIP Authentication ( Auth ) Hub

Release: 3.4.1

Resolution

Allowed or Blocked list currently supports individual IP's or the Range of IP's. It does not support the CIDR range as of now and that is an enhancement request in the product, If adding CIDR is a requirement then please reach out to AuthHub support team which can engage the Product management team on this. Adding the entries in BlockedIp list is explained below:

Setting Blocked IP List

Use this API to update the Blocked IP List -

PUT https://${SSP_FQDN}/{{tenantName}}/iarisk/v1/IPList/BLOCKED
Request payload of "/IPList/BLOCKED" is shown in the following example:

{
    "ipAddressList": {
        "ipAddressRange": [
            {
                "fromIP": "10.#.#.1",
                "toIP": "10.#.#.5"
            }
        ],
        "ipAddress": [
            "10.#.#.10"
        ]
    }
}