Upgrading to AAD Instances

Scenarios

If the protection provided by CNAD Basic is insufficient to meet your DDoS mitigation requirements, you can upgrade to Advanced Anti-DDoS instances (AAD instances). AAD instances effectively scrub attack traffic, elevating your security posture to ensure service stability and availability.

Notes and Constraints

• If your business servers are located in Chinese Mainland, you are advised to purchase AAD. To use AAD, ensure that all the domain names to be protected have obtained valid ICP licenses.
• If your business servers are located outside the Chinese mainland, submit a service ticket for consultation.

Prerequisites

• Ensure your account has a sufficient balance to prevent resource purchase failures.
• Ensure your account has been granted the required permissions. For details, see Creating a User and Granting AAD Permissions.
• Create an ECS. For details, see section Purchasing an ECS.

Resource and Cost Planning

Step 1: Purchase an AAD Instance

1. Log in to the AAD console.
2. In the upper right corner of the page, click Buy DDoS Mitigation.
3. On the Buy DDoS Mitigation page, configure the following parameters and retain the default settings for other parameters:
   • Instance Type: AAD
   • Access Type: Website
   • Region: Chinese mainland

4. Click Next.
5. On the Product Information page, select the Agreements check box and click Submit Order.
6. Pay for the order on the payment page.

   For details, see Purchasing AAD Instances.

Step 2: Connect a Domain Name to AAD

1. Log in to the AAD console.
2. In the navigation pane on the left, choose Advanced Anti-DDoS > Domain Name Access.
3. Above the domain name list, click Add Domain Name.
4. Configure the following parameters and retain the default settings for other parameters:
   • Domain Name Type: Website
   • Origin Server Type: IP address

5. (Optional) Upload a certificate.

   If Origin Server Type is set to IP address and Forwarding Protocol is set to HTTPS, you need to import a certificate.

   You can select an existing certificate from the drop-down list or upload a certificate.

   To upload a certificate, perform the following steps:

   1. Click Upload Certificate. In the displayed Upload Certificate dialog box, select a certificate upload mode.

      The certificate name can contain a maximum of 10 characters and cannot contain special characters.

      • Manual: Enter a certificate name, then paste the certificate content and private key.
      • Automatic: Select an issued certificate.
      

      • Currently, only TLS 1.0, TLS 1.1, and TLS 1.2 certificates can be uploaded.
      • Currently, only .pem certificates are supported.
      • Each certificate name of a user must be unique.

      Table 2 Parameter description

      Parameter	Description
      Certificate	The certificate must be in the following format: -----BEGIN CERTIFICATE----- MIIDljCCAv+gAwIBAgIJAMD2jG2tYGQ6MA0GCSqGSIb3DQEBBQUAMIGPMQswCQYD VQQGEwJDSDELMAkGA1UECBMCWkoxCzAJBgNVBAcTAkhaMQ8wDQYDVQQKEwZodWF3 ZWkxDzANBgNVBAsTBmh1YXdlaTEPMA0GA1UEAxMGaHVhd2VpMQ8wDQYDVQQpEwZz ZXJ2ZXIxIjAgBgkqhkiG9w0BCQEWE3p3YW5nd2VpZGtkQDE2My5jb20wHhcNMTUw MzE4MDMzNjU5WhcNMjUwMzE1MDMzNjU5WjCBjzELMAkGA1UEBhMCQ0gxCzAJBgNV BAgTAlpKMQswCQYDVQQHEwJIWjEPMA0GA1UEChMGaHVhda2VpMQ8wDQY...... -----END CERTIFICATE----- Method for you to copy your certificate: For a .pem certificate: Use a text editor to open the certificate file and copy the content here. For other certificates: Convert your certificate to a .pem one. Then open it with a text editor and copy its content.
      Private Key	The private key must be in the following format: -----BEGIN RSA PRIVATE KEY----- MIIDljCCAv+gAwIBAgIJAMD2jG2tYGQ6MA0GCSqGSIb3DQEBBQUAMIGPMQswCQYDVQQG EwJDSDELMAkGA1UECBMCWkoxCzAJBgNVBAcTAkhaMQ8wDQYDVQQKEwZodWF3ZWkxDzAN BgNVBAsTBmh1YXdlaTEPMA0GA1UEAxMGaHVhd2VpMQ8wDQYDVQQpEwZzZXJ2ZXIxIjAg BgkqhkiG9w0BCQEWE3poYW5nd2VpZGtkQDE2My5jb20wHhcNMTUwMzE4MDMzNjU5WhcN MjUwMzE1MDMzNjU5WjCBjzELMAkGA1UEBhMCQ0gxCzAJBgNVBAgTAlpKMQswCQYDVQQH EwJIWjEPMA0GA1UEChMGaHVhd2VpMQ8wDQYDVQQLEwZ -----END RSA PRIVATE KEY----- Method for you to copy your private key: For a .pem certificate: Use a text editor to open the certificate file and copy the content here. For other certificates: Convert your certificate to a .pem one. Then open it with a text editor and copy its content.

   2. Click OK

6. Click Next and select an AAD instance and line.

   You can map a domain name to multiple lines (AAD IP addresses). When selecting multiple AAD IP addresses, ensure that all selected IP addresses have identical settings for the forwarding rule count, forwarding protocol, forwarding port, and service type.

7. Click Submit and Continue. The Modify DNS page is displayed.

   You are advised to click Next to skip this step. You can configure DNS resolution later by referring to Step 6: Change DNS Resolution to the AAD CNAME.

Step 3: Configure a Protection Policy

The following procedure uses the gro-blocking policy as an example. For more information, see Configuring a Protection Policy.

1. Log in to the AAD console.
2. In the navigation pane on the left, choose Advanced Anti-DDoS > Protection Policies. The Protection Policies page is displayed.
3. Select the instance for which geo-blocking needs to be configured.
4. In the Geo-Blocking configuration area, click Set.
5. In the displayed dialog box, select a route and select the areas you want to block.
   Figure 1 Geo-blocking settings
   

6. Click OK. The geo-blocking setting is complete.

Step 4: Add the Back-to-Origin IP Address Range to the Whitelist

1. Log in to the AAD console.
2. In the navigation pane on the left, choose Advanced Anti-DDoS > Domain Name Access.
3. Above the domain name list, click Back-to-Origin IP Address Range.
4. In the Back-to-Origin IP Address Segment dialog box, view information about the back-to-origin IP address range.
5. Add the back-to-origin IP address range to the whitelist of the firewall or security software on the origin server.

Step 5: Verifying the Access

1. Log in to the AAD console.
2. In the navigation pane on the left, choose Advanced Anti-DDoS > Domain Name Access. The Domain Name Access page is displayed.
   Figure 2 Domain name access
   

3. In the CNAME column of the target domain name, click to copy the CNAME value of the domain name.
4. Enable Telnet and run the following command to check the connectivity between the origin server and AAD:

   telnet Origin_server_IP_address 80

   Take the port 80 as an example.

   • If the connection setup is successful, you can Telnet to the public IP address from your local network environment.
   • If the connection setup fails, change your test network environment and try again. Some enterprises may have internal network constraints that cause the failure of the verification. For example, you can connect to the personal hotspot of your phone to verify the connectivity.

5. Run the following command to check whether the configuration for connecting the domain name to AAD is correct:
   telnet <CNAME-value-in-3> 80

   • If you can access the domain name, the configuration is correct.
   • If you fail to access the domain name, check whether the domain name parameters are correctly configured.

   

   For details about how to verify whether WAF basic protection is enabled, see Testing WAF.

Step 6: Change DNS Resolution to the AAD CNAME

1. Log in to the AAD console.
2. In the navigation pane on the left, choose Advanced Anti-DDoS > Domain Name Access. The Domain Name Access page is displayed.
   Figure 3 Domain name access
   

3. In the CNAME column of the target domain name, click to copy the CNAME value of the domain name.
4. Click in the upper left corner of the page and choose Networking > Domain Name Service.
5. For details, see section Adding a CNAME Record Set.

Related Operations

• For details about how to modify a protection policy, see Configuring a Protection Policy.
• For details about how to modify domain name parameters, see Managing Domain Names.
• For details about how to modify, export, or delete forwarding rules, see Managing Forwarding Rules.