You can create network acceleration rules to enable an Anti-DDoS Premium instance of the Insurance or Unlimited mitigation plan to work together with an Anti-DDoS Premium instance of the MCA mitigation plan. If no attacks occur after you enable the network acceleration feature, service access is accelerated by the Anti-DDoS Premium instance of the MCA mitigation plan. If attacks occur, service traffic is switched to the Anti-DDoS Premium instance of the Insurance or Unlimited mitigation plan for scrubbing. This way, only normal service traffic is forwarded to the origin server.

Prerequisites

  • An Anti-DDoS Premium instance of the MCA mitigation plan is purchased.

    For more information, see Purchase an Anti-DDoS Premium instance of the MCA plan.

  • An Anti-DDoS Premium instance of the Insurance or Unlimited mitigation plan is purchased.
    Notice The clean bandwidth and queries per second (QPS) of the instance must meet the protection requirements of your services.

    For more information, see Purchase an Anti-DDoS Premium instance of the Insurance or Unlimited plan.

  • Your website is added to an Anti-DDoS Premium instance. The website is associated with both the Anti-DDoS Premium instance of the MCA mitigation plan and the Anti-DDoS Premium instance of the Insurance or Unlimited mitigation plan.

    For more information, see Add a website.

  • Both the Anti-DDoS Premium instance of the MCA mitigation plan and the Anti-DDoS Premium instance of the Insurance or Unlimited mitigation plan forward service traffic as expected.

    For more information, see Verify the forwarding configuration on your local machine.

Background information

Network acceleration is suitable for scenarios in which services are deployed outside mainland China but most users of the services are located in mainland China. In these scenarios, if you use only the Anti-DDoS Premium instance of the Insurance or Ultimate mitigation plan to protect your services, the access latency is increased for the users in mainland China.

You can purchase an Anti-DDoS Premium instance of the Insurance or Unlimited mitigation plan and an Anti-DDoS Premium instance of the MCA mitigation plan. This way, if no attacks occur, service access is accelerated by the Anti-DDoS Premium instance of the MCA mitigation plan. If attacks occur, service traffic is switched to the Anti-DDoS Premium instance of the Insurance or Unlimited mitigation plan for scrubbing.

The following figure shows how network acceleration works. For more information, see Configure Anti-DDoS Premium MCA. Anti-DDoS Premium

Create a network acceleration rule

  1. Log on to the Anti-DDoS Pro console.
  2. In the top navigation bar, select Outside Mainland China.
    If you select this region, the Anti-DDoS Premium console appears.
  3. In the left-side navigation pane, choose Provisioning > Sec-Traffic Manager.
  4. On the General tab, click Create Rule.
  5. In the Create Rule panel, configure a network acceleration rule and click Next.
    Network acceleration
    Parameter Description
    Interaction Scenario Select Network Acceleration.
    Name Enter a name for the rule.

    The name can be up to 128 characters in length and can contain letters, digits, and underscores (_).

    Anti-DDoS Instance IP Select an Anti-DDoS Pro or Anti-DDoS Premium instance.
    Mainland China Acceleration IP Select the IP address of the Anti-DDoS Premium instance of the MCA mitigation plan.
    The waiting time of switching back Specify the waiting time before the service traffic is switched back. Valid values:
    • Auto Switch-back: the waiting time before the service traffic is automatically switched back based on the duration of attacks. Valid values: 10 to 60. Unit: minutes.
    • Customize: the custom waiting time that is required before the service traffic is switched back. Valid values: 30 to 120. Unit: minutes. To avoid frequent switchover operations, we recommend that you specify a waiting time of 60 minutes.
  6. Change the DNS records of the domain name as prompted and click Complete.
    For the cloud service interaction rule to take effect, you must change the DNS records of your domain name on the website of the DNS service provider to map the domain name to the CNAME provided by Sec-Traffic Manager. If your DNS service is provided by Alibaba Cloud DNS, you need only to change the DNS records in the Alibaba Cloud DNS console.
    Notice After you change the DNS records of your domain name, the cloud service interaction rule takes effect. Before you change the DNS records, we recommend that you modify the hosts file on your computer to verify the cloud service interaction rule. This helps avoid incompatibility issues caused by inconsistent back-to-origin policies. Alibaba Cloud CDN (CDN) allows you to change the origin host for back-to-origin requests. However, you cannot use Anti-DDoS Pro or Anti-DDoS Premium to change the origin host for back-to-origin requests. If you use CDN together with Anti-DDoS Pro or Anti-DDoS Premium to retrieve data from an Object Storage Service (OSS) object, the normal traffic that is forwarded by Anti-DDoS Pro or Anti-DDoS Premium cannot be identified by OSS. As a result, your services are interrupted. For more information about origin hosts, see Origin hosts.

    For more information about how to verify traffic forwarding rules, see Verify the forwarding configuration on your local machine.

    For more information about how to change the DNS records of a domain name, see Change the CNAME record to redirect traffic to Sec-Traffic Manager.

If no attacks occur after a network acceleration rule is created, service access of users in mainland China is accelerated by using the Anti-DDoS Premium instance of the MCA mitigation plan. If attacks occur, the service traffic is switched to the Anti-DDoS Premium instance of the Insurance or Unlimited mitigation plan for scrubbing. This way, only normal service traffic is forwarded to the origin server. If service traffic is automatically switched to the Anti-DDoS Premium instance of the Insurance or Unlimited mitigation plan, the instance switches the service traffic back to the Anti-DDoS Premium of the MCA mitigation plan when the attacks stop and the waiting time that you specify elapses.

In addition to automatic switchover, you can also manually switch the service traffic to the Anti-DDoS Premium instance of the Insurance or Unlimited mitigation plan and then manually switch the service traffic back to the Anti-DDoS Premium instance of the MCA mitigation plan based on the protection requirements of your services. For more information, see What to do next.

What to do next

After a cloud service interaction rule is created, you can perform the following operations on the rule.

Operation Description
Switch to DDoS If traffic scrubbing by your Anti-DDoS Pro or Anti-DDoS Premium instance is not automatically triggered, the Green icon is displayed in the Cloud Service column. In this case, you can manually switch service traffic to the instance for scrubbing. You can manually switch service traffic before blackhole filtering is triggered. This reduces adverse impacts on your services. Switch to DDoS
Service traffic can be switched to your Anti-DDoS Pro or Anti-DDoS Premium instance only if blackhole filtering is not triggered for the IP address of the instance.
Notice After you manually switch service traffic to your Anti-DDoS Pro or Anti-DDoS Premium instance, the service traffic cannot be automatically switched back to the associated cloud resources. To switch the service traffic back to the associated cloud resources, you must click Switch back to manually switch the service traffic.
Switch back If service traffic is scrubbed by your Anti-DDoS Pro or Anti-DDoS Premium instance, the Green icon is displayed in the Anti-DDoS Instance IP column. In this case, you can manually switch the service traffic back to the associated cloud resources. Switch back
Notice
  • Before you manually switch the service traffic, make sure that the attacks stop and the associated cloud resources also work as expected. This prevents the associated cloud resources from being added to sandboxes and prevents service interruptions.
  • If you click Switch to DDoS to switch service traffic to your Anti-DDoS Pro or Anti-DDoS Premium instance, you can switch the service traffic back to the associated cloud resource only by clicking Switch back.

If blackhole filtering is triggered for the IP addresses of all associated cloud resources, the switchback fails. If blackhole filtering is deactivated for some cloud resources, service traffic is first switched back to these cloud resources. After blackhole filtering is deactivated for the remaining cloud resources, service traffic is also switched back to these cloud resources.

Edit You can modify the cloud service interaction rule. However, you cannot change the values of Interaction Scenario and Name for the rule.
Delete You can delete the cloud service interaction rule.
Warning Before you delete a rule, make sure that the domain name of your website is not mapped to the CNAME provided by Sec-Traffic Manager. Otherwise, access to the website may fail after you delete the rule.