Access control policy not working

[abhijithsh]

I am trying to implement an IP range based allow/deny using Access control policy. Providing screenshot of the proxy debug screen showing my ip as the first one in X-FORWARDED_FOR. The same address is present in proxy.client.ip field also.

However, the policy is not denying access. Below is the implementation I have used.

Let me know if anyone can help @dchiesa1 @API-Evangelist 

Thanks in advance

[API-Evangelist]

If you just experimenting its ok else start exploring kvm -https://cloud.google.com/apigee/docs/api-platform/reference/policies/access-control-policy#deny-usin...

May be use ValidateBasedOn if it helps as I see multiple ip's

https://cloud.google.com/apigee/docs/api-platform/reference/policies/access-control-policy#validateb...

==

When the X-Forwarded-For HTTP header contains multiple IP addresses, use this ValidateBasedOn element to control which IP addresses are evaluated.

==

 Documentations in apigee are well written (Mostly) just need to go thru each attribute which will help. Good luck.

<AccessControl name="ACL">
  <IPRules noRuleMatchAction = "ALLOW">
    <MatchRule action = "DENY">
      <SourceAddress mask="32">198.51.100.1</SourceAddress>
    </MatchRule>
  </IPRules>
</AccessControl>

<AccessControl name="ACL">
  <IPRules noRuleMatchAction = "ALLOW">
    <MatchRule action = "DENY">
      <SourceAddress mask="32">198.51.100.1</SourceAddress>
    </MatchRule>
  </IPRules>
</AccessControl>

<AccessControl name="ACL">
  <IPRules noRuleMatchAction = "ALLOW">
    <MatchRule action = "DENY">
      <SourceAddress mask="32">198.51.100.1</SourceAddress>
    </MatchRule>
  </IPRules>
</AccessControl>

[dknezic]

It could be it's validating based on the last ip of the X-Forwarded-For, please refer to https://docs.apigee.com/api-platform/reference/policies/access-control-policy#xforwardedfor

[Mohammed-Mahtab]

Try this option , it should work for your use case 

<?xml version="1.0" encoding="UTF-8" standalone="yes"?>

<AccessControl async="false" continueOnError="false" enabled="true" name="Access-Control-1">

    <DisplayName>Access Control-1</DisplayName>

<IgnoreTrueClientIPHeader>true</IgnoreTrueClientIPHeader>

    <Properties/>

    <IPRules noRuleMatchAction="ALLOW">

        <MatchRule action="DENY">

            <SourceAddress mask="24">103.160.194.119</SourceAddress>

        </MatchRule>

            </IPRules>

<ValidateBasedOn>X_FORWARDED_FOR_FIRST_IP</ValidateBasedOn>

</AccessControl>

[Mohammed-Mahtab]

Did this solution work for you ?

Thanks

Mahtab