Salesforce IP Ranges

 we can define two types of IP Ranges in salesforce.

1.Login IP Ranges

2.Trusted IP Ranges

Want to improve user security for your organization beyond usernames and passwords? 

Use login IP ranges and trusted IP ranges to control the IP address ranges from which your users can log in to Salesforce.

Login IP ranges control login access for a user profile. Users with profile login IPs can only log in from IP addresses within the range; 

otherwise, they’re denied access to Salesforce. Login IP ranges are typically used to restrict login IPs at a granular level.

Trusted IP ranges control login access for an organization. When users log in from trusted IPs, they aren’t challenged to verify their identity 

(such as by entering a code sent to their mobile phone). Unknown users logging in from non-trusted IPs are challenged to verify their identity, 

and if successful, allowed to access Salesforce. Trusted IP ranges are typically used to “allowlist” IPs at the organization level.

Trusted IP Ranges :

1.Trusted IP Ranges Set at org level.

2.Computer activation not required.

 User logging in within the Trusted IP range means that computer activation is not trusted.

 so effectively, one particular login restriction is removed.

 

 Note : Trusted IP ranges remove the computer activation requirement.

Login IP Ranges :

1.Login IP Ranges set at Profile or user level.

2. Prevents login outside range.

Login IP ranges prevents user login outside the range.

Note :

Even if user IP address is in the range of Trusted IP Ranges but not in Login IP Ranges,

user still will not able to login and get the same error message.

Login Hours :

Login Hours settings will control what hours the user can log in during.

1.The first thing that is checked on any login is your profile login hours. 

If you have login hours on your profile, and you are outside login hours, 

the login process stops and you are denied access. No further checks are done. 

If you don't have login hours set, or if you are within login hours, you move to step 2.

2.Next we look to see if your profile has an IP restriction set on it. If you do and you are not within the login IP range, 

you are denied access. No further checks are done. No verification email. Nothing. Your access is blocked absolutely. 

If you are within your profile IP range, you are granted access.

3.If there is no profile IP range, then we will look for a browser cookie set that identifies that this user has accessed this org previously, 

or if they are within the organization-wide IP restrictions (Setup>Security Controls>Network Access). 

If you are your browser does not have the cookie, or is you are not within the org-wide range, your access is blocked but there are two ways to still gain access.