---
title: "Allowing our agent through Google Cloud Armor"
source: "https://ottom.io/docs/cdn/google-cloud-armor"
summary: "On Google Cloud Armor, our agent is let through with one rule in the security policy on your load balancer: an advanced expression that matches our addresses on origin.ip and a user agent starting with our token, with the action allow, at a priority number lower than your WAF and bot rules."
---

# Allowing our agent through Google Cloud Armor

On Google Cloud Armor, our agent is let through with one rule in the security policy on your load balancer: an advanced expression that matches our addresses on origin.ip and a user agent starting with our token, with the action allow, at a priority number lower than your WAF and bot rules.

## What to match

- User agent starts with `OttomAgent/`. The full string is `OttomAgent/1.0 (+https://ottom.io/agent)`, with `Mobile` added when a check walks your store at phone size.
- Source address is one of those in https://ottom.io/agent/ips.json, also listed at https://ottom.io/agent#addresses.

Match both, never the user agent alone: anyone can send our user agent, but only we send it from those addresses.

## What you need

- Permission to edit the Cloud Armor security policy attached to the backend service that serves your store.
- The current addresses from https://ottom.io/agent/ips.json.

## Setting it up

1. **Add a rule to the security policy.** In the console, go to Network Security, Cloud Armor policies, open your policy and add a rule. Choose Advanced mode.
2. **Paste the expression.** Use the expression below, with one inIpRange for each address in the file, joined with ||. Header names are lower case. Use origin.ip, which is the connecting address, not origin.user_ip, which is read from a header.

```
inIpRange(origin.ip, '203.0.113.10/32') && request.headers['user-agent'].startsWith('OttomAgent/')
```
3. **Set the action and priority.** Set the action to allow and a priority number lower than your preconfigured WAF rules and any bot management rule, such as 100. Cloud Armor evaluates the lowest number first and stops at the first match.
4. **Save.** Save the rule.

## Checking it works

Run a scan of your store from your Ottom dashboard. When the rule works, the report has no bot protection finding and the agent reaches your products. In Cloud Logging, the load balancer’s request logs show our requests with your rule’s priority as the one that matched, and the outcome ACCEPT.

## When a scan is still blocked

### The expression is refused as too long

Cloud Armor allows five subexpressions in one expression, and each address and the user agent check counts as one. With more addresses than fit, add a second rule with the rest, at the next priority number.

### 203.0.113.10 is in the example

That is a documentation address, never one of ours. Replace it with each address in the file.

## Good to know

- An allow at this priority passes every lower priority rule, including the preconfigured WAF rules, for the requests it matches.

## Google Cloud Armor documentation

- Rules language reference: https://docs.cloud.google.com/armor/docs/rules-language-reference

## Questions

### Why origin.ip and not origin.user_ip?

origin.user_ip comes from a header you configure, which a client can send itself. origin.ip is the address that connected, which only we can send from our addresses.

The same rule for other providers: https://ottom.io/docs/cdn