Setting a Traffic Scrubbing Threshold to Block Attack Traffic

1. Log in to the AAD console.
2. Select the Public IP Addresses tab and click Set Default Protection Policy.
3. Set the Traffic Scrubbing Level based on the site requirements, as shown in Figure 1.
   Figure 1 Manually configuring the default protection policy
   

   Table 1 Parameter description

   Parameter

   Description

   Traffic Scrubbing Level

   Anti-DDoS scrubs traffic when detecting that the incoming traffic of an IP address exceeds the threshold. If Default is selected, the traffic threshold is 120 Mbit/s. If Custom is selected, you can set another threshold. The traffic scrubbing threshold should be selected based on the service bandwidth. It is unrelated to any specific protection policies. If the threshold is set significantly lower than the actual service bandwidth, false alarms may be generated. Conversely, if the threshold is set much higher than the actual service bandwidth, some attacks might not be blocked. You are advised to set a value close to your actual bandwidth, without exceeding the purchased limit. If your service traffic triggers scrubbing, only attack traffic will be blocked. If your service traffic does not trigger scrubbing, no traffic is blocked.

4. Click OK.

   A message indicating successful policy configuration will be displayed.

   After you set the default protection policy, it will be applied to new EIPs.

1. Log in to the AAD console.
2. On the Public IP Addresses tab page, select a setting method based on the site requirements.
   • To configure protection policies for multiple public IP addresses, select multiple public IP addresses and choose Set Protection in the upper part of the page.
     Figure 2 Configuring protection policies in batches
     
   • To configure a protection policy for a single public IP address, in the row containing the desired public IP address, choose Set Protection.
     Figure 3 Configuring a protection policy for a public IP address
     

3. Set the Traffic Cleaning Threshold based on the site requirements.
   Figure 4 Configuring a protection policy
   

   Table 2 Parameters for configuring a protection policy

   Parameter

   Description

   Traffic Cleaning Threshold

   Anti-DDoS scrubs traffic when detecting that the incoming traffic of an IP address exceeds the threshold. The default protection rate is 120 Mbit/s. You can manually set more protection levels. The traffic scrubbing threshold should be selected based on the service bandwidth. It is unrelated to any specific protection policies. If the threshold is set significantly lower than the actual service bandwidth, false alarms may be generated. Conversely, if the threshold is set much higher than the actual service bandwidth, some attacks might not be blocked. You are advised to set a value close to your actual bandwidth, without exceeding the purchased limit. If your service traffic triggers scrubbing, only attack traffic will be blocked. If your service traffic does not trigger scrubbing, no traffic is blocked.

4. Then, click OK.

   If the Traffic Scrubbing Level of the IP address is updated to the value you configured, the configuration is successful.

After setting a traffic scrubbing threshold for an EIP, you can check the EIP status and protection information.

1. Log in to the AAD console.
2. Click the Public IP Addresses tab to check EIPs.
   Figure 5 Checking an EIP
   
   

   • Anti-DDoS provides a 500 Mbit/s mitigation capacity against DDoS attacks. If the traffic of an attacked EIP exceeds 500 Mbit/s, the excess traffic, including legitimate requests, will be discarded. To defend against attacks with more than 500 Mbit/s traffic, you are advised to purchase Huawei Cloud Advanced Anti-DDoS.

   Table 3 Parameter description

   Parameter	Description
   Public IP Address	Public IP address protected by Anti-DDoS. You can click a public IP address to go to its monitoring report page.
   Protection Status	Protection status of a public IP address. The values are: Normal: The EIP is normal. Configuring: The change of the traffic scrubbing threshold is being processed. Cleaning: Attack traffic is being scrubbed. Black hole: The traffic of the EIP is blocked by the black hole.
   Asset Type	Type of a protected object. It can be: EIP: elastic IP address ELB: Elastic Load Balance NetInterFace: elastic network interface VPN: Virtual Private Network NAT: NAT gateway VIP: high-availability virtual IP address CCI: Cloud Container Instance SubEni: supplementary network interface
   Capacity	Protection capacity of the current EIP and the peak inbound traffic in the last 24 hours. For example, the following picture shows that the protection capacity of the EIP is 5 Gbit/s and the peak inbound traffic in the past 24 hours is 412 kbit/s. Figure 6 Capacity
   Protection Settings	Traffic scrubbing threshold of the current EIP.
   Enterprise Project	Enterprise project of the EIP.