Help Center/ Anti-DDoS Service/ Best Practices/ Best Practices of Advanced Anti-DDoS/ Best Practices for AAD Integration Configuration
Updated on 2026-08-26 GMT+08:00
View PDF
Share

Best Practices for AAD Integration Configuration

Scenarios

If the protection provided by CNAD Basic is insufficient to meet your DDoS mitigation requirements, you can access Advanced Anti-DDoS instances (AAD instances). AAD instances effectively scrub attack traffic, elevating your security posture to ensure service stability and availability.

This section describes how to access AAD using a domain name or IP address.

Constraints

  • The forwarding protocol and forwarding port in each forwarding rule must be unique.
  • If your services are accessible through domain names, the domain names must have ICP filing.

Prerequisites

  • You have purchased an AAD instance. For details, see Purchasing an AAD Instance.
  • Create an ECS. For details, see section Purchasing an ECS.
  • Purchase an EIP. For details, see Obtaining an EIP.
  • Sort out the service protocol, external port, origin server public IP address, and origin server port.

Resource and Cost Planning

Table 1 Resource and cost planning

Resource

Resource Description

Quantity

Cost Description

Elastic Cloud Server (ECS)

Bind an EIP.

1

For details about the ECS billing modes and standards, see ECS Billing.

AAD

Defend against DDoS attacks.

1

For details about the AAD billing modes and pricing, see AAD Billing.

Method 1: Connect a Domain Name to AAD

  1. Log in to the AAD console.
  2. In the navigation pane on the left, choose Advanced Anti-DDoS > Domain Name Access.
  3. Above the domain name list, click Add Domain Name.
  4. On the Add Domain Name page, set parameters as required.
  5. (Optional) Upload a certificate.

    If Origin Server Type is set to IP address and Forwarding Protocol is set to HTTPS, you need to import a certificate.

    You can select an existing certificate from the drop-down list or upload a certificate.

  6. Click Next and select an AAD instance.
  7. Click Next. The back-to-origin IP address range list of AAD is displayed. You are advised to click Next to skip this step and configure the settings by referring to Step 2: Whitelist Back-to-Source IP Addresses on Your Origin Server.
  8. The page for modifying DNS resolution is displayed.

    You are advised to click Next to skip this step. You can configure DNS resolution later by referring to Step 4: Modifying DNS Resolution.

  1. Log in to the AAD console.
  2. In the navigation pane on the left, choose Advanced Anti-DDoS > Domain Name Access.
  3. On the displayed page, click Back-to-Origin IP Address Range.
  4. In the Back-to-Origin IP Address Segment dialog box, view information about the back-to-origin IP address range.
  5. Add the back-to-origin IP address range to the whitelist of the firewall or security software on the origin server.
  1. Log in to the AAD console.
  2. In the navigation pane on the left, choose Advanced Anti-DDoS > Domain Name Access.

    Figure 1 Domain name access

  3. In the CNAME column of the target domain name, click to copy the CNAME value of the domain name.
  4. Run the following command to check whether the configuration for connecting the domain name to AAD is correct:

    telnet <CNAME-value-in-3> 80
    • If you can access the domain name, the configuration is correct.
    • If the connection fails, run the following command to check the connectivity between the origin server and AAD:

      telnet Origin_server_IP_address 80

      • If the connection is successful, the Telnet public IP address is available in the local network environment.
      • If the connection fails, contact technical support.

    For details about how to verify whether WAF basic protection is enabled, see Testing WAF.

The following uses Huawei Cloud as an example:

  1. Log in to the AAD console.
  2. In the navigation pane on the left, choose Advanced Anti-DDoS > Domain Name Access. The Domain Name Access page is displayed.

    Figure 2 Domain name access

  3. In the CNAME column of the target domain name, click to copy the CNAME value of the domain name.
  4. Click in the upper left corner of the page and choose Networking > Domain Name Service.
  5. For details, see section Adding a CNAME Record Set.

AAD supports multiple protection policies. For more information, see Configuring a Protection Policy.

Method 2: Connect a Non-Domain Name to AAD

  1. Log in to the AAD console.
  2. In the navigation pane on the left, choose Advanced Anti-DDoS > Forwarding Configuration. The Forwarding Configuration page is displayed.
  3. Above the forwarding configuration list, click Back-to-Origin IP Address Range.
  4. In the Back-to-Origin IP Address Segment dialog box, view information about the back-to-origin IP address range.
  5. Add the back-to-origin IP address range to the whitelist of the firewall or security software on the origin server.
  1. Log in to the AAD console.
  2. In the navigation pane on the left, choose Advanced Anti-DDoS > Forwarding Configuration.
  3. Select the instance and route for the forwarding rule to be added.
  4. Click Add to add a forwarding rule and set parameters as required.
  5. Confirm that all information is correct and click OK.

    Return to the forwarding rule page. If the new forwarding rule is displayed in the list and its status is normal, the access is successful.

AAD supports multiple protection policies. For more information, see Configuring a Protection Policy.

Parent Topic: Best Practices of Advanced Anti-DDoS