Help Center/ Anti-DDoS Service/ User Guide/ CNAD Advanced (CNAD) Operation Guide/ Adding a Protection Policy/ Configuring a Basic Protection Policy to Intercept Attack Traffic
Updated on 2026-08-26 GMT+08:00
View PDF
Share

Configuring a Basic Protection Policy to Intercept Attack Traffic

Basic protection policies are default security measures provided to defend your services against common network attacks through automatic detection and defense, traffic scrubbing, default protection thresholds, log and alarm management, and resource isolation. After your service is connected to CNAD Advanced, you can configure basic protection policies for the protected objects. If the DDoS attack bandwidth on an IP address exceeds the configured threshold, CNAD Advanced is triggered to scrub the malicious traffic, ensuring your services remain available.

If the selected threshold is not suitable for your workloads, some attacks may not be properly mitigated, and service traffic may be mistakenly blocked. Choose a value close to but not greater than your purchased bandwidth.

Limitations and Constraints

If you have a custom policy, you cannot change the traffic scrubbing threshold. To change the traffic scrubbing threshold, submit a service ticket to Huawei technical support.

Enabling Basic Protection

  1. Log in to the AAD console.
  2. In the navigation pane on the left, choose Cloud Native Anti-DDoS Advanced > Protection Policies. The Protection Policies page is displayed.
  3. Click Create Protection Policy.
  4. In the displayed dialog box, set the policy name, select an instance, and click OK.

    Figure 1 Creating a policy

  5. In the row containing the target policy, click Set Protection Policy in the Operation column.
  6. In the Basic Protection area, click Set.

    Figure 2 Basic protection

  7. In the Basic Protection Settings dialog box that is displayed, set the traffic scrubbing threshold.

    Figure 3 Basic protection settings
    Table 1 Parameter description

    Parameter

    Description

    Traffic Scrubbing Level

    If the DDoS bandwidth on an IP address exceeds the configured scrubbing level, CNAD is triggered to scrub attack traffic.

    You are advised to set a value closest to, but not exceeding, the purchased bandwidth.

    NOTE:

    The traffic scrubbing threshold should be selected based on the service bandwidth. It is unrelated to any specific protection policies. If the threshold is set significantly lower than the actual service bandwidth, false alarms may be generated. Conversely, if the threshold is set much higher than the actual service bandwidth, some attacks might not be blocked. You are advised to set a value close to your actual bandwidth, without exceeding the purchased limit.

    Defense Mode

    If the traffic reaches the specified scrubbing level, traffic scrubbing is triggered. For details, see Application Scenarios of Defense Modes.

  8. Click OK. The basic protection policy configuration is completed.

Application Scenarios of Defense Modes

Selecting the right defense mode is essential to maintaining service security and stability. You can choose and fine-tune your defense mode based on your actual business conditions and security requirements to optimize protection and keep your services running smoothly. Huawei Cloud CNAD Advanced provides multi-layer, multi-dimensional protection at the packet level to support a wide range of operational scenarios.

Table 2 Application scenarios of defense modes

Defense Mode

Defense Measure

Description

Loose
  • Filter malformed packets (not compliant with protocol specifications).
  • Filter TCP/UDP/ICMP packets with distinct attack characteristics.
  • Filter IP fragments as well as non-TCP, non-UDP, and non-ICMP packets.
  • Filter malformed packets that do not comply with DNS communication standards.

Scrubbing is triggered when the traffic reaches three times the scrubbing level. This mode is recommended to mitigate the impact on services when traffic is incorrectly scrubbed.

Normal
  • Filter malformed packets (not compliant with protocol specifications).
  • Filter TCP/UDP/ICMP packets with distinct attack characteristics.
  • Filter IP fragments as well as non-TCP, non-UDP, and non-ICMP packets.
  • Filter malformed packets that do not comply with DNS communication standards.
  • Monitor UDP session interactions to identify abnormal traffic and defend against attacks, such as high-frequency packet floods.

Scrubbing is triggered when the traffic reaches twice the scrubbing level. This mode is recommended for the default protection policy.

Strict
  • Filter malformed packets (not compliant with protocol specifications).
  • Filter TCP/UDP/ICMP packets with distinct attack characteristics.
  • Filter IP fragments as well as non-TCP, non-UDP, and non-ICMP packets.
  • Filter malformed packets that do not comply with DNS communication standards.
  • Monitor UDP session interactions to identify abnormal traffic and defend against attacks, such as high-frequency packet floods.
  • Verify and rate-limit some suspicious source IP addresses.

Scrubbing is triggered when the traffic reaches the scrubbing level. This mode is recommended to enhance defense after there have been escaped attacks.
Parent Topic: Adding a Protection Policy