Using ELB and CNAD Advanced to Improve the DDoS Protection Capabilities of ECSs
Application Scenarios
CNAD Advanced enhances the DDoS protection capabilities of cloud services, such as Elastic Cloud Server (ECS) and Elastic Load Balance (ELB), ensuring service security.
You can deploy ELB and connect its public IP address to CNAD Advanced to significantly improve defense against various types of DDoS attacks.
Architecture
When your website services are deployed on HUAWEI CLOUD ECSs, you can configure the combination of CNAD Advanced and ELB for your services. Deploy ELB on the origin server of your ECS, and add the EIP address of the ELB to the CNAD instance to improve the anti-DDoS capability of the ECS.

Advantages
Compared to enabling CNAD Advanced for ECSs, combining CNAD Advanced and Elastic Load Balance (ELB) allows for the discarding of traffic from unlistened protocols and ports. This enhances defense against various DDoS attacks (including reflection attacks like SSDP, NTP, and Memcached, as well as UDP flood and SYN flood attacks), significantly improving the DDoS protection capability of ECSs and ensuring the security and reliability of user services.
Limitations and Constraints
ELB must be deployed in regions where CNAD Advanced instances can be purchased, for example, CN North-Beijing4.
Resource and Cost Planning
Resource |
Description |
Quantity |
Cost |
---|---|---|---|
ELB |
Distributes access traffic to backend ECSs to mitigate single point of failures (SPOFs) caused by DDoS attacks. |
1 |
For details, see Billing Overview. |
CNAD Advanced |
Public IP addresses used to connect to the ELB for DDoS attack defense. |
1 |
For details about CNAD Advanced billing modes and standards, see Billing Overview. |
Procedure
- Create a load balancer. For details, see Creating a Shared Load Balancer.
Table 1 Parameter description Parameter
Description
Region
Select the region where the ECS is located.
EIP
Select Automatically assign.
Line
Select Dynamic BGP.
- Obtain the public IP address of the created load balancer, as shown in Figure 2.
- Buy a CNAD Advanced instance in the same region as the ECS.
- In the navigation pane on the left, choose Instances page is displayed.
. The Figure 3 Instance list
- In the upper right corner of the target instance box, click Add Protected Object.
- In the Add Protected Object dialog box that is displayed, select the elastic IP address of the load balancer obtained in 2 and click OK.
After adding protected objects, you can configure protection policies for them. Cloud Native Anti-DDoS Advanced provides unlimited protection against DDoS attacks for ECSs. When a DDoS attack occurs, traffic scrubbing is automatically triggered.
For details about how to configure a protection policy, see Adding a Protection Policy.
Feedback
Was this page helpful?
Provide feedbackThank you very much for your feedback. We will continue working to improve the documentation.See the reply and handling status in My Cloud VOC.
For any further questions, feel free to contact us through the chatbot.
Chatbot