Filtering client's IP

[danielgonzalez]

Hello experts,

I have been asked if it's possible to not allow consuming the web services published in PI from unauthorized IPs. As far as I know, this requisite isn't possible to accomplish using only PI. I think it should need to redefine the network map and use a firewall to reach PI. Please share your thoughts about this issue.

Regards,

[former_member191911 · Accepted solution]

Hi Gonzalez,

You can put a webdispatcher in front of your PI system and blacklist certain IP's via IP filtering.

See below documentation how to set this up.

http://help.sap.com/saphelp_nw04s/helpdata/en/16/12e34143b15f24e10000000a1550b0/content.htm

Installation of the webdispatcher itself is an easy task and it also doesn't consume too many resources of your system.

Kind regards,

Mark

[danielgonzalez · Accepted solution]

Thank you M. Dijsselbloem,

That link was very useful but I'm not sure about why it's needed to put the Web Dispatcher in front of the PI server. According to the next quote, I understand you can set that parameter directly in the ICM of the PI server. Am I wrong? Would there be any difference between setting the parameter in PI or in the Web Dispatcher?

With this parameter you can set up access restrictions in the ICM and SAP Web Dispatcher (as White List or Black List).

Regards,

[former_member191911 · Accepted solution]

Hi Gonzalez,

You are absolutely right!

Since NetWeaver 7.1 the java dispatcher has been replaced by the ICM, so you can put this parameter directly into the java stack.

Sorry for the inconvenience!

Kind regards,

Mark

[former_member208404]

Hi,

It has to be on the network layer. Your PI system must be on a different network. It's not possible to hit your system from anywhere.

Regards

Abhishek

[anupam_ghosh2]

Hi D Gonzalez,

                            The network team can set up a proxy server or firewall so that only authorised IP's can access the PI server network. 

Regards

Anupam 

[rajasekhar_reddy14]

To access PI web service they need at least PI Credetials ,I dont think any such configuration available in PI to stop IP's but may be Network infra team can do.