You can purchase exclusive IP addresses for Web Application Firewall (WAF) to protect
important domain names. Each exclusive IP address protects one domain name. A domain
name that is protected by an exclusive IP address can be accessed even if other domain
names in the same WAF instance are under DDoS attacks. The other domain names use
a shared IP address.
What is an exclusive IP address?
When you purchase a WAF instance, it has a default IP address, which can be used to
protect multiple domain names in the instance. This default IP address is a shared
IP address. If you want to enable exclusive protection for a specific domain name,
you can purchase an exclusive IP address. An exclusive IP address can be bound to
only one domain name.
Note Exclusive IP addresses are available for subscription WAF instances of the Pro or
If a domain name is under DDoS attacks, the exclusive IP address that protects this
domain name can also help prevent other domain names in the same WAF instance from
access failures. By default, a WAF instance uses a shared IP address to protect all
domain names. If traffic of this IP address is routed to a black hole due to DDoS
attacks on one of the domain names, the other domain names cannot be accessed. In
the preceding situation, we recommend that you purchase exclusive IP addresses to
protect important domain names from access failures.
Purchase an exclusive IP address
You can specify the number of exclusive IP addresses when you purchase a subscription
If you have purchased a WAF instance, you can upgrade the instance to enable more
exclusive IP addresses. For more information, see Renewal and upgrade
Assign and enable an exclusive IP address
Log on to the WAF console
. In the left-side navigation page, choose . On the page that appears, set Protection Resource
to Shared Cluster and Exclusive IP
After you enable an exclusive IP address for a domain name and the CNAME record is
used for access, the domain name is automatically resolved to the exclusive IP address.
You can ping the CNAME record of the domain name to check whether the resolution directs
to the required exclusive IP address.
Note If the A record is used for access, the domain name cannot be automatically resolved
to the exclusive IP address. You must ping the CNAME record of the domain name to
obtain the exclusive IP address and manually modify the DNS record.