Security Issue with IP Allowlisting in Confluence?

Question

I'm currently demoing Confluence and considering Confluence Cloud Premium because of the IP Allowlisting feature, which is mandatory for our use case.

We were full speed ahead, but a potential Atlassian Partner (platinum if it makes a difference) mentioned that there is a serious security issue with the IP Allowlisting and that they don't recommend their customers use it.

I've been looking around for any reference to the issue in the forum and online, but I haven't seen any mention. Since I'm not yet a paying customer of an Atlassian product, I can't access their help directly.

Is anyone aware of any security issues with the IP Allowlisting feature? Alternatively, is there a way to contact Atlassian directly for such questions if you're not a paying customer yet? Uncertainty on this issue is preventing me from becoming one.

Brant Schroeder · Answer

@Chuck Blakney Hopefully sales will be able to address your questions.  IP Allow Lists only provide so much security so that should be kept in mind but I am not aware of any issues outside of what you would run into with any other IP-based security.

Chuck Blakney · Answer

Thanks Jonathan,

I sent a request for info with sales at the link you provided. We'll see what they come back with.

Cheers,

Chuck Blakney · Answer

Hi Brant,

That's what I'm trying to get to the bottom of. They didn't provide much detail, and I'm trying to find a second or more direct source. Just a comment about IP Spoofing. I've asked them for additional info, but they haven't provided any yet. Confusingly, they said if I used Jira Service Management as an entry point to get into Confluence using IP Allowlisting, it would be more secure, which confuses me. For some reason, they said IP Allowlisting was more secure for JSM than Confluence.

The partner's name is Valiantys.

Right now, I'm just trying to identify the risk profile, as I really need an economical way for a small number of content creators to post content to a much larger (20x) number of users for our internal knowledge base.