Connecting to the Origin Server ECS in Port Access Mode

Scenarios

If non-website access is used and the origin server is a Huawei Cloud ECS, access traffic may bypass AAD and directly reach the origin server. To avoid this risk, you are advised to use the port mode to connect to the origin server ECS.

Prerequisites

• You have purchased an AAD instance, and the access type is IP access. For details, see Purchasing an AAD Instance.
• Create an ECS. For details, see section Purchasing an ECS.
• Purchase an EIP. For details, see Obtaining an EIP.

Resource and Cost Planning

Step 1: Obtain the Back-to-Origin IP Address Range to the Whitelist

1. Log in to the AAD console.
2. In the navigation pane on the left, choose Advanced Anti-DDoS > Forwarding Configuration. The Forwarding Configuration page is displayed.
3. Above the forwarding configuration list, click Back-to-Origin IP Address Range.
4. In the Back-to-Origin IP Address Segment dialog box, view information about the back-to-origin IP address range.

Step 2: Add a Forwarding Rule

1. Log in to the AAD console.
2. In the navigation pane on the left, choose Advanced Anti-DDoS > Forwarding Configuration.
3. Select the instance and route for the forwarding rule to be added.
4. Click Add to add a forwarding rule and set parameters as required.
5. Confirm that all information is correct and click OK.

   Return to the forwarding rule page. If the new forwarding rule is displayed in the list and its status is normal, the access is successful.

Step 3: Allow the Origin IP Address in the ECS Security Group

1. Log in to the ECS console.
2. Choose ECSs > Name/ID. The Summary page is displayed.
3. Click the security group name to go to the Inbound Rules tab page.
4. Add the IP address range obtained in Step 1 to the inbound rule of the ECS security group.

   Click Add Rule to go to the Add Inbound Rule page.

5. Set the parameters as required and click OK.

   The new rule is displayed on the Inbound Rules page.

Step 4: Verify the Connectivity

Open Telnet and run the following command to test the connectivity:

telnet <source-server-IP-address> <forwarding port> to check whether the ECS service can be accessed.

• If the connection is successful, the configuration is successful.
• If the connection fails, check whether the origin IP address and port are correctly configured.

  If the preceding parameters are correct, contact technical support.