Whitelist SSA IP Address

[SueValente]

Whitelist SSA IP Address Range in WAF

What

Whitelist Social Security Administration (SSA) IP address in the Web Application Firewall for catalog-beta.data.gov.

Why

SSA needs access to catalog-beta.data.gov but may be getting blocked by current WAF rules.

Done When

• SSA IP range 137.200.0.0/16 whitelisted in Cloudfront WAF
• Cloud.gov support ticket submitted with whitelist request
• SSA confirms access to catalog-beta.data.gov is working
• WAF rule change documented for future reference

Notes

catalog-beta.data.gov runs on Cloud.gov-managed Cloudfront. WAF rule changes must go through Cloud.gov support team - we cannot make these changes directly. Include justification that this is for legitimate government agency access to federal data catalog.

[SueValente]

catalog.data.gov WAF request with CG support

[neilmb]

Set up this rule on our own catalog.data.gov Cloudfront WAF and sent a matching request to support@cloud.gov.

[FuhuXia]

For the past three months there are only 50 requests from this ip block. Our WAF rules are not the one blocking them. I doubt whitelisting this IP block in our cloudfront config will help.

I see why they are blocked now. Their traffic triggers a rule that make us think they are malicious.

[FuhuXia]

This PR will unblock SSA. whitelist does not help.

[neilmb]

I turned off the whitelist rule in our WAF. @SueValente we believe this is fixed, can you confirm with SSA?