IP Fencing in Senturo: Detect Devices on Unapproved Networks

Overview

IP Fencing lets an automation respond when a device connects from a network that isn't on your approved list. You define your trusted networks once — as a set of IP ranges — and IP Fencing treats a connection from anywhere outside that list as the condition that starts the automation.

This is useful for spotting devices that leave your trusted network environment: a corporate laptop connecting from an unknown network, or a device that has moved off your approved infrastructure. When that happens, Senturo can pull network data, alert an administrator, lock the device, or run any other action you choose.

IP Fencing is the When (trigger) of an automation. This article explains how it works and how to configure it. To build the full automation around it, see How to Create a Security Policy Automation; for all trigger types, see the Automation Triggers reference.

How IP Fencing Works

IP Fencing works from an allow list. You provide the IP ranges you consider trusted (your whitelisted IPs), and the trigger's condition is met whenever a device connects from a network outside those ranges. In other words, everything you list is approved; anything else is treated as an unapproved network.

You define these ranges in a reusable policy. A policy is a named list of approved networks that you can attach to any automation using the IP Fencing trigger.

Steps to Configure IP Fencing

1. Add the IP Fencing trigger
   • In the automation builder, on the Triggers tab, click on IP Fencing. The IP Fencing picker opens.
2. Select or create a whitelist policy
   • To use an existing policy, select it from the list.
   • To create a new one, click on the + button to open the Whitelisted IPs form.
3. Build the whitelist policy (for a new policy)
   • Enter a Policy Name that identifies the network set (for example,Approved Corporate Networks).
   • Click on Download CSV Template to get the correctly formatted file.
   • Add your approved network ranges to the CSV in CIDR notation, following the template's format.
   • Upload the CSV by dragging and dropping it into the upload area (or selecting it from your files).
   • Click on Save.
4. Select the policy
   • Back in the picker, select the saved policy so it's attached to the trigger. The Triggers pre-save check clears once a policy with network ranges is selected.
5. Complete the automation
   • Add your actions, select device groups, and set a schedule, then save. See the walkthrough for the full flow.

Understanding CIDR Notation

Approved networks are listed in CIDR notation, which expresses a range of IP addresses as an address followed by a slash and a prefix length — for example, 203.0.113.0/24. The prefix length controls how many addresses the entry covers:

• A /32 covers a single IP address (for example, 203.0.113.5/32).
• A smaller prefix number covers a larger range (for example, /24 covers 256 addresses, 203.0.113.0 through 203.0.113.255).

List each trusted network as its own entry in the CSV. If you're unsure of your organization's public IP ranges, your network administrator or ISP can provide them. Always start from the Download CSV Template so the columns match what Senturo expects.

Common Use Cases

• Detect off-network devices. Trigger an alert or a location pull when a device connects from a network outside your organization's approved ranges — a school device off campus, or a corporate laptop away from the office network.
• Enforce network boundaries for sensitive devices. Apply IP Fencing to a group of high-value or regulated devices — clinical workstations, finance laptops, point-of-sale terminals — so any connection from an unapproved network prompts an immediate response.
• Support investigations. Pair IP Fencing with Pull Current Network Data and Pull Current Location** actions to capture where and how a device connected when it left your approved networks.

Troubleshooting

My policy won't save. Confirm you've entered a Policy Name and uploaded a CSV of approved networks. Use Download CSV Template to ensure the file is formatted correctly.

The trigger shows "network CIDR not set." A whitelist policy with network ranges must be selected. Open the IP Fencing picker and select a policy, or create one with the + button.

The automation isn't firing when I expect. Confirm the device is actually connecting from a network outside your listed ranges, that the device is in a selected group, and that the current time falls within the automation's schedule.

I need to change my approved networks. Edit the policy from the picker (the pencil icon) and upload an updated CSV. Because policies are reusable, changes affect every automation that uses the policy — review usage before editing.

Conclusion

IP Fencing turns your list of trusted networks into an automatic tripwire: connect from anywhere outside it, and your automation responds. By defining approved ranges once in a reusable whitelist policy, you can enforce network boundaries consistently across any set of devices.

FAQs

Q: What counts as an "unapproved" network? A: Any network outside the ranges in your whitelist policy. Everything you list is trusted; a connection from anywhere else meets the trigger condition.

Q: What format do the approved networks use? A: CIDR notation (for example, 203.0.113.0/24). Use the Download CSV Template to get the correct file layout.

Q: Can I use one whitelist policy in multiple automations? A: Yes. Policies are reusable — attach the same whitelist to as many IP Fencing automations as you need.