Documentation · Letting our agent through your CDN · Akamai

Allowing our agent through Akamai

On Akamai, our agent is let through by defining it as a custom bot in Bot Manager, in a custom bot category of its own whose action is Allow. The addresses are kept in a client list. Like any Akamai security change, it takes effect only once the new configuration version is activated, on the staging network first and then on production.

What to match

User agent starts with OttomAgent/
Source address is one of those in https://ottom.io/agent/ips.json

Match both, never the user agent alone: anyone can send our user agent, but only we send it from those addresses. The current addresses are also listed on our agent page.

What you need

Access to Akamai Control Center with permission to edit and activate the security configuration that covers your storefront.
The current addresses from https://ottom.io/agent/ips.json.
Bot Manager, for the narrow rule. With App & API Protector alone, the client list in step 1 is what you have.

Setting it up

1. Create a client list of our addresses
In Control Center, open Client Lists and create an IP list named Ottom agent. Add each address from the file, then activate the list on staging and on production. A client list is activated per network, like a configuration.
2. Create a new version of the security configuration
Under Web & Data Center Security, open the security configuration that covers your storefront and create a new version from the one active on production.
3. Create a custom bot category
In Bot Manager, add a custom bot category named Ottom. Akamai does not let a custom bot join one of its own categories, so it needs a category of its own.
4. Define our agent as a custom bot
In that category, add a custom bot named Ottom agent. Give it a condition on the User-Agent header starting with the value below and, where your version offers it, a condition on the client list from step 1. If it will not take both conditions in one bot, match on the client list.
```
OttomAgent/
```
5. Set the category action to Allow
Set the action of the Ottom category to Allow for each security policy that covers your storefront. A new category starts with an action set automatically, so check it rather than assume it.
6. Activate on staging, then production
Activate the new version on the staging network, run a scan against a hostname that resolves to Akamai staging if you have one, then activate the same version on production.

Checking it works

Run a scan of your store from your Ottom dashboard. When the rule works, the report has no bot protection finding and the agent reaches your products. In Bot Manager’s reports, requests with our user agent appear under the Ottom category with the action Allow.

When a scan is still blocked

Nothing changed after saving
A saved version does nothing until it is active on production. Check the version number active on production is the one with the Ottom category.
Rate controls still deny us
Rate controls are separate from Bot Manager. Add the client list from step 1 as an exception to the rate policy that fires.
You have App & API Protector without Bot Manager
Use the client list from step 1 as an exception in the IP/Geo Firewall. That matches the address alone, so add only the addresses in the file.

Good to know

Akamai’s screens differ between contracts and versions, more than most providers’. If a name here does not match yours, the Terraform pages below describe the same objects, and your Akamai account team can point at the screen.

Akamai documentation

Menus move. If a name here no longer matches your dashboard, these are the pages we checked this guide against:

Questions

Why a category of its own?

Akamai sets actions per category, and custom bots cannot be added to the categories Akamai defines. A category for us alone means its Allow covers us and nothing else.

The same rule for other providers, and why it is safe: the CDN guides.