WSS Admin Guide

Creating IP Address-Based Groups

The Web Security Service tracks web traffic coming from any IP address that is registered to the account. In IP-based authentication, individual user names are not tracked. To add multiple IP-based groups, you first edit the Default IP Group to release its addresses, then create additional IP groups and allocate IP addresses to them.

To edit Default IP Group (required before creating the first IP group):

• Select the Groups tab.
• Under Actions, click the Default IP Group's Edit link.
• Select the Authentication subtab. Identify By is the IP address. Don't change this setting.
• Clear the Allow from all Account IP Addresses checkbox.
  This option is mutually exclusive with the Allow only from these IP Addresses text box.
• In the Allow only from these IP Addresses text box, enter the allocated IP addresses that constitute this group's members. Separate individual addresses and address ranges by a comma. Indicate an address range with a hyphen. You must have at least one entry.
• Skip the LDAP and DWP Configuration subtabs because they are not related to IP group configuration.
• Click Save.

To create an IP group:

• On the Groups tab, click Add Group.


The Add page opens at the General Information subtab. A new group inherits some default values from the Account subtab.


• Enter Customer Account Information settings.

  Customer Account Information	Description
  Group Name	Required. Enter a name of up to 30 characters. Valid characters are any combination from A to Z, a to z, 0 to 9; and the following special characters: ` ~ ! @ # $ % ^ & * ( ) _ + - = [ ] \ { } | ; ' : , . / < > ? Spaces are allowed.
  Administrator Email	Identified by email address and defaults to the account's primary administrator. Select the administrator who is responsible for this group.
  Time Zone	Defaults to the account's time zone. Select a time zone according to the group's geographical location, which may not necessarily be the same as the account's or administrator's time zone. This information is displayed on the grid.
  Policy	Required. Select a policy from the drop-down list. If no custom policy is defined, one of the out-of-the-box policies is applied, and you can change this later. This information is displayed on the grid. The policy might include quota definitions. Quotas are associated with time windows. If you later change the group's policy assignment with quotas using a different time window, the new time window takes effect.
  Opt-in for Notification of Policy Changes Affecting this Group	Recommended. Keep this checkbox selected so that the administrator receives an email whenever a policy change affects this group. By keeping this option selected, the administrator will always know if another administrator made a change that affects their group definitions.

• Skip the User Configuration section. These options don't apply to IP groups.

• If the service provider enabled your account for full logging, optionally change the Logging field. The provider sets your logging option at the account level. This option on the Account subtab is read-only.

  • Full Logging means every URL that passes through the Web Security Service is logged. This includes all links within the initial page that are called to render the web page completely. This logging type creates logs with huge data sets. If your account is provisioned for Full Logging, you can change to Site Logging at the Group level.
  • Site Logging means that only the URLs logged are those that are typed into the browser, or that the user clicks on. If your account is provisioned for Site Logging, this field is readonly for any group.
• Select the Authentication subtab.
  The Groups' Authentication subtab displays.

• Enter related settings.

Authentication by IP Address	Description
Identify By	Select IP address. Unrelated options are disabled or ignored. Only the following are relevant to IP group configuration: Allow from all Account IP Address checkbox Allow only from these IP addresses textbox
Allow from all Account IP Addresses	The default setting for the out-of-the-box Default IP Group. If another IP group is already using this setting, you are not allowed to use this setting for another IP group. Clear this checkbox if you are assigning IP addresses to this group. Note: Allow from all ... and Allow only from ... are mutually exclusive.
Allow only from these IP Addresses	Required if you have two or more IP groups. it must be unique for each group. After clearing the Allow from all Account IP Addresses checkbox, enter the unique set of IP addresses that comprise the members of this group. Separate individual addresses with a comma. Separate address ranges with a hyphen. Note: Allow from all ... and Allow only from ... are mutually exclusive.

• Click Save.
  You are done with the IP group; no additional configuration on any Groups subtabs is required. Repeat the process to create additional IP groups, ensuring that your IP address allocations are unique for each group.