What Is the Black Hole Policy of HUAWEI CLOUD?

What Is a Black Hole?

A black hole refers to a situation where access to a cloud server is blocked by Huawei Cloud because attack traffic targeting a cloud server exceeds a certain threshold.

Why Is the Blackhole Policy Required?

DDoS attacks will interrupt user services and cause adverse impacts on the AAD data center. Defense against DDoS attacks is costly on bandwidth consumption.

Bandwidth is purchased by Huawei Cloud from carriers, and those carriers bill for bandwidth even if it was part of DDoS attack. Huawei Cloud provides Cloud Native Anti-DDoS Basic (Anti-DDoS) for free to protect your resources against DDoS attacks below a certain threshold, but if an attack exceeds a certain size, we will route the traffic to a black hole.

How Do I Deactivate a Black Hole?

When the access to a cloud server is blocked by Huawei Cloud because attack traffic targeting a cloud server exceeds a certain threshold, follow the instructions described in Table 1 to handle that.

Self-Service Unblocking Rules

If you have purchased Anti-DDoS (Native Advanced Anti-DDoS Protection or Advanced Anti-DDoS), you will be rewarded with three self-service blackhole-deactivation quotas for free every month. If the quotas are not used up in the current month, they will be cleared at the end of the month.

Currently, only public IP addresses in North China, East China, and South China can be unblocked by you.

• There is a minimum block duration after which you can unblock a blocked IP address. The minimum block duration for the first time you unblock an IP address in a day is 30 minutes. Minimum block duration = 2 ^(n-1) x 30 minutes (n indicates the number of times you want to unblock the same IP address)

  For example, a 30-minute block duration is required for the first time you unblock an IP address, a 60-minute block duration for the second time, and a 120-minute block duration for the third time.

• For the same protected IP address, if it is blocked again less than 30 minutes after it is unblocked, you can unblock it 2ⁿ x 30 minutes later (n indicates the number of times you are unblocking it).

  For example, if the IP address has been unblocked once at 10:20, and is blocked again at 10:40, the interval between the two time points is less than 30 minutes. This is the second time you unblock the IP address on the day. The IP address cannot be unblocked until the 120-minute block duration expires at 12: 40 (2x2x30 minutes after 10:40).

  

  If you have unblocked any other IP address within 30 minutes, you cannot unblock the IP address even if the preceding conditions are met.

• ADS automatically adjusts the allowed IP unblocking attempts and the interval based on the risk control.

How Can I Increase the Black Hole Threshold?

You can increase the black hole threshold using the following methods:

• Enable Cloud Native Anti-DDoS Pro (CNAD Pro) to obtain the unlimited protection capability without changing the service IP address.
• Connect your services to AAD to obtain the Tbit/s protection capability. The malicious attacks targeting the origin servers can be diverted to the high-defense IP address for scrubbing to ensure the stable running of mission-critical workloads.