Create and manage network policies

Create a network policy once, then assign it to MCP servers, API tokens, workspace-user sign-in, or end-user authentication. This article covers creating, editing, and deleting a policy, and viewing where it's assigned. A policy restricts nothing until you assign it — to assign one, see Assign a network policy. For what a network policy is and how Celigo evaluates the allowed and blocked lists, see Network policies overview.

Prerequisites:

• You're signed in as an account owner or administrator.
• You're working in the environment where you need the policy. A policy belongs to the environment where you create it.
• You know the IP addresses or Classless Inter-Domain Routing (CIDR) ranges to allow or block. For users behind a proxy or VPN, that's the proxy's or VPN's public address.

Create a network policy

1. Go to Account (the avatar at the top of the page), select Security, and then select Governance from the left menu.
2. In the Network policies table, select Create network policy.
3. Enter a Name. The name must be unique in the environment.
4. Optionally, enter a Description.
5. In Allowed IPs, enter the addresses and CIDR ranges that can connect, separated by commas. Leave the field empty to allow every address you don't block.
6. In Blocked IPs, enter the addresses and CIDR ranges to refuse, separated by commas. Leave the field empty if there are none.
7. Select Save & close. To save and keep the drawer open, select Save.

The policy appears in the Network policies table with a count of allowed and blocked entries. To read its description, select the note icon next to its name. The policy restricts nothing until you assign it.

Note: When you leave Allowed IPs or Blocked IPs, Celigo validates every entry and stores a single address as a range of one, so 203.0.113.5 becomes 203.0.113.5/32. If an entry is invalid, an error under the field names it — for example, 10.0.0.999/33 is not a valid IP address or CIDR range. — and you can't save until you fix it.

Create a network policy during assignment

You can create a policy from any Network policy field: on an MCP server's Governance tab, in an API token's General section, or under either IP-based access restriction checkbox.

1. Open the Network policy list and select Create network policy at the bottom. If no policy exists, the field shows a Create network policy button instead of a list.
2. In the Create network policy drawer, complete the same four fields as in the Create a network policy procedure.
3. Select Save & close. Celigo selects the new policy in the field.
4. Save the server, token, or restriction to finish the assignment.

Field reference

• Name — A label for the policy, such as Corporate VPN or Vendor access. Required. Up to 300 characters, unique within the environment. The uniqueness check is case-sensitive, so Corporate VPN and corporate vpn are different names. This is the name you pick from when you assign the policy.
• Description — What the policy is for or who it covers. Optional. Up to 1,000 characters. Shown from the note icon in the Network policies table.
• Allowed IPs — Only requests from the addresses in this list are allowed. Enter IP addresses or CIDR ranges, separated by commas, for example 192.168.1.10, 10.0.0.0/24. Default: empty, which allows every address you don't block. Accepted values: IPv4 and IPv6 addresses and CIDR ranges, up to 200 entries.
• Blocked IPs — Requests from the addresses in this list are refused, even if they also fall inside an allowed range. Enter IP addresses or CIDR ranges, separated by commas, for example 192.168.1.11, 10.0.0.0/28. Default: empty. Accepted values: IPv4 and IPv6 addresses and CIDR ranges, up to 200 entries.

Edit a network policy

Editing a policy changes every assignment at once — there's nothing to update on the servers, tokens, or restrictions that use it.

1. Go to Account > Security > Governance.
2. In the Network policies table, select Actions (…) next to the policy, and then select Edit.
3. Change the name, description, allowed IPs, or blocked IPs.
4. Select Save & close.

The change reaches every assignment within about 30 seconds. You can also edit a policy from any Network policy field: select Edit next to the assigned policy, or open the list and select Edit on the policy's row.

View where a network policy is used

1. Go to Account > Security > Governance.
2. In the Network policies table, select Actions (…) next to the policy, and then select Used by.

The Used by dialog lists each assignment with its Name and Type. The types are MCP server, Access token, Workspace user sign-in, and End user sign-in. A policy with no assignments shows This network policy is not assigned. ⚠ VERIFY: the Used by dialog wasn't reached during dev verification — confirm its contents on staging.

Delete a network policy

You can only delete a policy when nothing uses it. Remove it from every server, token, and restriction first — see Assign a network policy for how to unassign.

1. Go to Account > Security > Governance.
2. In the Network policies table, select Actions (…) next to the policy, and then select Delete.
3. In the Delete network policy dialog, which asks Are you sure you want to delete "<name>"?, select Delete.

If the policy is still assigned, the Unable to delete network policy dialog opens with the message This network policy is in use and cannot be deleted until assignments are removed. and lists every assignment with its name and type. Unassign the policy from each one and try again. You can also delete a policy from the trash icon in its row in any open Network policy list, with the same confirmation and guard.

Deleting a policy moves it from the Network policies table to the Recycle bin, where it stays for 30 days before Celigo purges it. The audit log records the deletion. To restore a deleted policy within those 30 days, select Recycle bin in the left navigation — the policy is listed with its Name, Type, Deleted date, and Auto purge period, and you restore it from the Actions column.

Errors you might see

Related articles

• Network policies overview
• Assign a network policy
• Set up authentication for an MCP server
• Managing API tokens