> For AI agents: the complete documentation index is available at https://www.jumpserver.com/docs/llms.txt, the full documentation bundle is available at https://www.jumpserver.com/docs/llms-full.txt.

# Asset Connect


Enterprise Edition

**Asset connection control** requires JumpServer Enterprise Edition.

[Request 14-day free trial](https://www.jumpserver.com/free-trial)

**Asset Connect** audits connections to assets against the source IP address and
time of day. An authorization decides whether a user may reach an asset at all;
an asset connect control adds a second gate that can reject the connection when
the request comes from an unexpected network or outside an allowed window.

Open the page from **Console > ACLs > Asset Connect**.

## Overview

Each rule matches a user, an asset, an account, and a time/IP condition. Rules are
evaluated by priority: the lower the number, the earlier the rule is matched, and
the first matching rule supplies the action. Rules are scoped to the current
organization.

## Before you begin

- Sign in with an account that can manage ACLs.
- Review existing [Authorizations](https://www.jumpserver.com/docs/features/console/policies/authorizations.md) so the new
  control does not duplicate or contradict them.
- Plan the allowed source networks and time windows before enabling a reject
  rule.

## Create an asset connect control


1

Click **Create**.

2

In the 
**Create asset connect**
 drawer, fill in the fields below.

3

Click **Submit**.

![Figure 1: Create asset connect drawer with users, assets, accounts, IP, time period, and action.](/images/v5/jumpserver/v5_admin_acls_06.png)

### Field reference

| Group    | Field       | Description                                                                                                                                   |
| -------- | ----------- | --------------------------------------------------------------------------------------------------------------------------------------------- |
| Basic    | Name        | Required. Rule name, unique within the organization.                                                                                          |
| Basic    | Priority    | Integer from 1 to 100. Defaults to 50; the lower the value, the earlier the rule is matched.                                                  |
| Users    | Users       | **All users**, **Specified users**, or **Attribute filter**.                                                                                  |
| Assets   | Assets      | **All assets**, **Specified assets**, or **Attribute filter**.                                                                                |
| Accounts | Accounts    | **All accounts** or **Specified accounts**.                                                                                                   |
| Rule     | IP          | Source IP restriction. `*` matches all. Single addresses, CIDR ranges, address ranges, and IPv6 are supported; press Enter to add each entry. |
| Rule     | Time period | Drag to select weekdays and hours. No selection means all day, every day.                                                                     |
| Action   | Action      | Behavior when the rule matches. Defaults to **Reject**.                                                                                       |
| Other    | Active      | When selected, the rule takes effect.                                                                                                         |
| Other    | Comment     | Optional.                                                                                                                                     |

## Approval exemption period

New in v5.1.0

Enterprise Edition

**Approval exemption periods** require JumpServer Enterprise Edition.

[Request 14-day free trial](https://www.jumpserver.com/free-trial)

When a control uses an action that requires
approval, configure an approval exemption period so the same user can reconnect to
the same asset with the same account without another approval during that period.

The exemption is tied to the specific user, asset, and account combination. A
different asset, account, or user still goes through approval, and when the period
ends the next matching connection goes through approval again.

![Figure 2: Configure an asset connect ACL](/images/v5/jumpserver/v5_console_acl_asset_connect_create.png)

## Test before enabling

1. Create the rule with a narrow scope: one user or one asset, and a test IP.
2. Keep **Active** selected and attempt a connection from an allowed and from a
   blocked address.
3. Confirm the expected result in the user's session and in
   [Login Logs](https://www.jumpserver.com/docs/features/audits/activities/login-logs.md).
4. Widen the user or asset scope only after the behavior is confirmed.


Warning

When an active rule returns **Reject**, matching users cannot connect to the
assets even when an authorization exists. Make sure the rule's users, assets,
and IP scope are as narrow as the scenario requires.


Note

The action list depends on the edition and enabled features. **Reject** and
**Accept** are always available; additional actions such as review require an
Enterprise license and the related configuration.

## Version history

| Version | Change                               |
| ------- | ------------------------------------ |
| v5.1.0  | Added the approval exemption period. |

## Related topics

- [ACLs](https://www.jumpserver.com/docs/features/console/policies/acls/index.md)
- [User Login](https://www.jumpserver.com/docs/features/console/policies/acls/user-login.md)
- [Connect Method](https://www.jumpserver.com/docs/features/console/policies/acls/connect-method.md)
- [Authorizations](https://www.jumpserver.com/docs/features/console/policies/authorizations.md)