Function Overview

Cloud Native Anti-DDoS Basic (CNAD Basic) is enabled on Huawei Cloud by default and provides a 500 Mbit/s DDoS mitigation capacity for free. This free service can meet the basic security protection requirements of Huawei Cloud EIPs (IPv4 and IPv6).

Cloud Native Anti-DDoS Advanced (CNAD Advanced) is a security service launched by Huawei Cloud to improve the anti-DDoS capability of Huawei Cloud services, such as Elastic Cloud Server (ECS), Elastic Load Balance (ELB), Web Application Firewall (WAF), and Elastic IP (EIP). Its protection capability is not lower than 20 Gbit/s.

Advanced Anti-DDoS (AAD) ensures the continuity of important enterprise services. AAD can protect your servers against large volumetric DDoS attacks so your services can be reliable and stable.

If you enabled auto AAD when purchasing CNAD Unlimited Protection Basic, you can configure a tiered scheduling policy to automatically engage AAD protection for cloud resources protected by CNAD Unlimited Protection Basic.

CNAD Unlimited Protection Basic offers comprehensive protection against DDoS attacks. If a DDoS attack is detected, traffic scrubbing will be automatically initiated. If your service is blocked due to heavy traffic attacks, AAD CNAMEs will be called to divert malicious attack traffic to AAD for scrubbing, ensuring that important services are not interrupted.

CNAD Basic and CNAD Advanced can protect both IPv6 and IPv4 public IP addresses.

After the alarm notification function is enabled, you will receive notifications when your service is under a DDoS attack. The notification method can be set.

CNAD Advanced and AAD support one-click blocking of traffic from sources using User Datagram Protocol (UDP).

AAD supports one-click blocking of traffic outside China.

If the DDoS bandwidth on an IP address exceeds the configured threshold, CNAD Basic/Advanced is triggered to scrub attack traffic to ensure service availability.

CNAD Advanced and AAD allow you to configure an IP address blacklist or whitelist to block or allow access from specific IP addresses, thereby restricting users who access your service resources.

You can view protection logs on the Anti-DDoS Service console to learn about the network security status of your services.