Query Regarding IAG Rest API for Blocking Malicious IP Address

I hope this message finds you well. We have identified an issue where one of our customers is pushing a malicious IP address in IAG. The path they follow to push the IP is outlined below:

-> Access Mgmt ->Web Authentication -> Authentication Policy -> Edit Policy -> Policy Name(xyz) -> Objects -> Push IP Addresss

I have thoroughly reviewed the IAG Rest API documentation, but unfortunately, I couldn't find any specific API for pushing IP addresses in this category. Can you please confirm whether there is a dedicated API for this purpose or if there are alternative methods we can explore?

Additionally, I am interested in knowing if there is any rest API for IAG that allows us to block an IP address on a specific instance. Your guidance on this matter would be greatly appreciated.

Thank you for your time and assistance.

Best regards,

IAG (Identity and Access Governance) is a broad term that can refer to various solutions and technologies related to managing user identities and access within an organization

Nevertheless, depending on how your infrastructure is configured, you may want to look at other approaches that make use of network APIs or more comprehensive security, which may have an indirect impact on firewall rules or access restrictions. Using firewall APIs or security management tools that communicate with IAG indirectly may be necessary in order to block an IP address on a particular instance. Examining more comprehensive security APIs or network infrastructure integrations may provide answers for IP blocking within your instance at a more granular level.

Unlike what you've described, the Intelligent Access Gateway (IAG) lacks a distinct REST API endpoint that is made to push or ban IP addresses under the Web Authentication or Authentication Policy settings. Such fine-grained changes to the authentication policy are often not made publicly available via an API.

Recall that the optimal strategy is contingent upon your particular setting, level of technical proficiency, and intended automation.

For IP address blocking, I advise giving the REST API or CLI priority as they provide the most effective and adaptable solutions. Investigate possible custom development possibilities while looking into scripting or third-party tools as interim fixes if pushing IP addresses is critical.

I hope you are doing well as I write this. We've discovered a problem where a malicious IP address is being sent into IAG by one of our clients. The following describes the procedure they use to push the IP:

-> Objects -> Push IP Addresses -> Access Management ->Web Authentication -> Authentication Policy -> Edit Policy -> Policy Name (xyz)

Despite carefully reading the IAG Rest API documentation, I was unable to locate a specific API for pushing IP addresses under this heading. Would you kindly confirm whether there is a specific API for this use case or if there are other options we should consider?

Thankfully, Sangfor IAG provides a REST API for IP address block management. On certain instances, you may add or delete IP addresses from the block list by using the /security/policy/ipblacklist endpoint with the required permissions.

You might be able to create a custom REST API endpoint that communicates with the internal pushing mechanism if your Sangfor IAG version permits custom development. A thorough understanding of Sangfor IAG's internal operations would be necessary for this, and it might not be possible in all situations or versions.
IP addresses being blocked in certain situations

Verify if any security orchestration or SIEM products you employ from third parties interact with Sangfor IAG. Some solutions may provide means of pushing IP addresses via their own connectors or APIs.

You may try using Selenium or Puppeteer to script the manual procedures. To push the IP address, this would include mimicking user behaviors via the web interface. Even while it's not ideal, if there aren't many IP addresses, it could work as a temporary fix.

There is no API yet