---
title: "Security"
description: "Block source IPs after repeated failed sign-ins, and keep exceptions on the Allow and Deny lists"
canonical_url: "https://docs.ardge.com/en/guide/manage-arx/security"
---
# Security

> Block source IPs after repeated failed sign-ins, and keep exceptions on the Allow and Deny lists

## Overview

Security reduces the risk of someone guessing their way into ARX, and lets you name the IPs that should always be allowed or always refused.

Three parts:

- **IP Access Protection** — blocks a source IP automatically after too many failed sign-ins
- **Allow List** — trusted sources that are never blocked
- **Deny List** — what's currently blocked or explicitly refused

![The Security page](https://docs.ardge.com/screenshots/guide/en/security.webp)

## IP Access Protection

Set the attempt threshold, the window the attempts are counted over, and how long a block lasts.

Follow your company's security policy here rather than leaving the threshold loose.

![IP Access Protection settings](https://docs.ardge.com/screenshots/guide/en/sec-02.webp)

## Allow List

An IP on the Allow List is never blocked. If your company administers from a fixed subnet, adding it keeps an administrator from locking themselves out over a mistyped password.

<tip>

Add the IP you administer the device from to the Allow List, so a forgotten password can't lock you out. See [Which connection attempts get blocked?](https://docs.ardge.com/en/knowledge/arx-os/blocked-connections)

</tip>

<warning>

Only add IPs and management subnets you genuinely trust and can scope precisely. Don't add a broad range for convenience.

</warning>

## Deny List

Shows and manages the sources currently being blocked.

![The Allow and Deny lists](https://docs.ardge.com/screenshots/guide/en/sec-03.webp)


## Sitemap

See the full [sitemap](https://docs.ardge.com/sitemap.md) for all pages.