Configure collection level security

This article discusses how to apply IP restricted access to a Funnelback collection

The access_restriction collection.cfg setting is used to configure the IP whitelist for collection access.

The syntax for this setting differs for Modern UI vs Classic UI. When a collection is secured this needs to be taken into account to ensure that the collection is fully secured.

In Funnelback 15.0 and newer a collection only needs to be secured for the Modern UI as the Classic UI was removed.

Access restrictions for the Modern UI must specify IP addresses in CIDR format.

In order to secure Funnelback security in versions 11.0 - 14.2 collection level security must be applied for both Modern UI and Classic UI - even if only one of the interfaces is used by the search. This ensures that anyone who tries to access the search by either interface will have the access restriction applied.

When applying the IP address restriction is is vital to specify the IP addresses so that the CIDR format addresses for the Modern UI appear before the addresses for Classic UI. This is because the Modern UI requires all addresses to be in CIDR format and will stop processing the IP address list when it encounters an address that is not in this format.

Classic UI applies the restrictions as substring matches of the patterns compared against the user’s IP address.

Note: The Modern UI will report a misconfiguration error when a valid IP is not found due to the Classic UI-style patterns. This can be ignored so long as the Classic UI patterns appear after the Modern UI patterns

Funnelback 10.1.2 and earlier uses only the Classic UI. Addresses used for access restriction are matched as substrings against the user’s IP address.