Allow IP ranges that can access your environment
Latest Dynatrace
With environment IP allowlisting, Dynatrace provides you with fine-tuned control over external access to your environments.
IP address allowlisting restricts access to your environment to specific IP addresses that you consider acceptable.
This includes access to the Dynatrace web UI and the API. With this configuration, you can significantly restrict the threat actor from direct access to your Dynatrace environment.
CIDR notation
Dynatrace employs the IPv4 Classless Inter-Domain Routing (CIDR) system, as defined in RFC 4632, to specify which IP ranges can access your Dynatrace environment. This system pairs an IPv4 address with a subnet mask to define a range of allowable IP addresses.
For example, the CIDR notation 192.168.0.128/28 encompasses a block of 16 IP addresses, starting from 192.168.0.129 and ending at 192.168.0.142.
IPv6 CIDR notation isn't currently supported.
Who is this for?
The guide is intended for the Dynatrace and network administrators who are tasked to limit external access to their Dynatrace environments to well-known and accepted CIDR ranges.
Add the CIDR range to the allowlist
- In Account Management, go to Settings > Environments
- In the row for the environment for which you want to configure the allowlist, select > Edit environment.
- Select IP allowlist tab.
- Select CIDR range to start creating your allowlist.
- You can create 50 ranges per environment.
- Give your range a friendly name so that other administrators can recognize it.
- Add the CIDR range. Based on your input, Account Management will calculate the count of allowed IP addresses and list the first and last usable IPs.
- Select Save.
- Go back to the IP allowlist page. You need at least one CIDR range to enable IP allowlisting.
Dynatrace verifies your configuration to make sure that Dynatrace IP addresses aren't affected by your configuration.
Manage IP allowlisting using API
The Dynatrace Account Management API provides you with the endpoints that let you manage and create IP allowlists at scale.