Anti-DDoS：Create a tiered protection rule

Supported instance types

Anti-DDoS Proxy (Chinese Mainland) of the Profession mitigation plan, Anti-DDoS Proxy (Chinese Mainland) of the Advanced mitigation plan, Anti-DDoS Proxy (Outside Chinese Mainland) of the Insurance mitigation plan, and Anti-DDoS Proxy (Outside Chinese Mainland) of the Unlimited mitigation plan.

Create a tiered protection rule

1. Log on to the Anti-DDoS Proxy console.

2. In the top navigation bar, select the region of your instance.

   • Anti-DDoS Proxy (Chinese Mainland): If your instance is an Anti-DDoS Proxy (Chinese Mainland) instance, select Chinese Mainland.

   • Anti-DDoS Proxy (Outside Chinese Mainland): If your instance is an Anti-DDoS Proxy (Outside Chinese Mainland), select Outside Chinese Mainland.

3. In the left-side navigation pane, choose Provisioning > Sec-Traffic Manager.

4. On the General Interaction tab, click Add Rule. In the panel that appears, configure a Tiered Protection rule and then click Next.

   Parameter	Description
   Interaction Scenario	Select Tiered Protection.
   Rule Name	Enter a name for the rule. The name can be up to 128 characters in length and can contain letters, digits, and underscores (_).
   Anti-DDoS Pro	Select an Anti-DDoS Proxy instance.
   Resource for Interaction	Configure a cloud resource. Select the region in which the cloud resource resides and enter the IP address of the cloud resource. Important You must enter an elastic IP address (EIP) or enter the IP address of a cloud resource that is added to the Anti-DDoS Origin Enterprise instance. The cloud resource can be an Elastic Compute Service (ECS) instance, Server Load Balancer (SLB) instance, or Web Application Firewall (WAF) instance. For more information, see Add an object for protection. You can click Add IP Address of Cloud Resource to add more IP addresses. You can add up to 20 IP addresses. Note After you add multiple IP addresses, the IP addresses are associated with the specified Anti-DDoS Proxy instance. If one of the IP addresses is attacked, traffic is forwarded to other IP addresses. Traffic is forwarded to the Anti-DDoS Proxy instance only if all IP addresses are attacked. For more information about how to forward traffic to Anti-DDoS Proxy when one of the IP addresses is attacked, see Share one Anti-DDoS Proxy among multiple cloud resources.
   Waiting Time of Switchback	Specify the waiting time before the service traffic is switched from your Anti-DDoS Proxy instance back to the IP address of a cloud resource. When the attack stops and the waiting time that you specify elapses, the service traffic is automatically switched back to the IP address of the cloud resource. You can specify a value that ranges from 30 to 120. Unit: minutes. We recommend that you set the value to 60.

5. Modify the hosts file on your on-premises computer to verify the tiered protection rule. This helps prevent incompatibility issues caused by inconsistent back-to-origin policies. For more information, see Verify the forwarding configurations on your local computer.

6. Visit the website of your DNS provider and change the DNS record to forward traffic to the CNAME of Sec-Traffic Manager. For more information, see Change the CNAME record to redirect traffic to Sec-Traffic Manager.

   After you change the DNS record, you can use a browser to test whether the website can be accessed. If the website cannot be accessed, troubleshoot the issue. For more information, see How do I handle the issues of slow response, high latency, and access failure on my service that is protected by an Anti-DDoS Proxy instance?.

Select the waiting time. After the tiered protection rule is created, Anti-DDoS Origin automatically protects the service traffic that is destined for the cloud resource. The service traffic is automatically switched to your Anti-DDoS Proxy instance for scrubbing only if volumetric DDoS attacks occur on the cloud resource. This way, only service traffic is forwarded to the cloud resource. After the service traffic is automatically switched to your Anti-DDoS Proxy instance, the instance switches the service traffic back to the cloud resource when the attacks stop and the waiting time that you specify elapses.

In addition to automatic switchover, you can also manually switch the service traffic to your Anti-DDoS Proxy instance and then manually switch the service traffic back to the cloud resource based on your business requirements.

What to do next

Switch to Anti-DDoS Proxy

If service traffic is scrubbed by your Anti-DDoS Proxy instance, the icon is displayed in the Resource for Interaction column. In this case, you can manually switch the service traffic back to the associated cloud resources. You can manually switch service traffic before blackhole filtering is triggered. This reduces adverse impacts on your services.

1. On the General Interaction tab of the Sec-Traffic Manager page, find the rule whose Interaction Scenario is Tiered Protection.

2. Click Switch to Anti-DDoS in the Actions column. In the message that appears, click OK.

Switch back

If service traffic is scrubbed by your Anti-DDoS Proxy instance, the icon is displayed in the Anti-DDoS IP Address column. In this case, you can manually switch the service traffic back to the associated cloud resources.

1. On the General Interaction tab of the Sec-Traffic Manager page, find the rule whose Interaction Scenario is Tiered Protection.

2. Click Switchback in the Actions column. In the message that appears, click OK.

Edit a rule

1. On the General Interaction tab of the Sec-Traffic Manager page, find the rule whose Interaction Scenario is Tiered Protection.

2. Click Edit in the Actions column. Modify the Anti-DDoS Anti-DDoS Pro, Resource for Interaction, or Waiting Time of Switchback parameter. Then, click Next.

Delete a rule

1. On the General Interaction tab of the Sec-Traffic Manager page, find the rule whose Interaction Scenario is Tiered Protection.

2. Click Delete in the Actions column. In the message that appears, click Delete.