Anti-DDoS:Port-specific mitigation policies

What are port-specific mitigation policies?

• Definition and use: Port-specific mitigation policies defend non-website services against TCP connection resource exhaustion attacks. Configure fine-grained application-layer feature detection rules to identify and filter malicious traffic and protect the availability of backend non-web applications. When IP mitigation policies cannot meet the fine-grained protection requirements of non-website services, such as game servers, databases, and custom TCP services, use port-specific mitigation policies for session-level feature matching and filtering of traffic on specific ports.

• Core capability: Session Feature Filtering precisely identifies normal service traffic and attack packets based on session packet payload features and provides accurate protection. You can also configure matching policies for application-layer protocols.

• Comparison with IP mitigation policies:

  • Applicable products: IP mitigation policies apply to Standard and Enhanced products. Port-specific mitigation policies apply only to Enhanced products.

  • Mitigation granularity: IP mitigation policies apply at the IP level and provide broader coverage. Port-specific mitigation policies apply at the port level and provide more fine-grained control.

  • Priority: IP mitigation policies > port-specific mitigation policies.

Usage notes

• You can bind only one port-specific mitigation policy to each port.

• This feature is in public preview. For the usage policy during the public preview and the billing method after commercial release, see official announcements. To enable this feature, contact your account manager.

Prerequisites

You have configured the ports of Anti-DDoS Advanced EIP assets as protected objects. For instructions, see Configure protected objects.

Create a port-specific mitigation policy

1. Go to the Mitigation Settings page of the Traffic Security console.

2. Click Create Policy. In the creation panel, set Policy Name, select Port-specific Mitigation Policy for the policy type, and then click OK.

3. In the dialog box that states The policy is created., click OK to go to the Create Rule page.

4. On the Create Rule page, click Create Rule. Configure mitigation rules for the Policy Template, and then click Next.

   Important

   You can add up to 10 mitigation rules to each Policy Template. Each rule supports up to 10 match conditions.

   • Rule Name: Enter a custom rule name.

   • Match Conditions: Click Add Condition to configure the policy match conditions.

     • Rule Type: Select String or Hexadecimal.

     • Match Range: Valid values for the start position and end position: 0 to 1499. The start position must be less than or equal to the end position..

     • Logical Operator: Only Yes and No are supported.

     • Term to Match:

       • Rule Type is String: The match content must be no longer than 1500 characters, and end position - start position + 1 >= the length of the match content.

       • Rule Type is Hexadecimal: The match content must be hexadecimal, must be no longer than 3000 characters, and must contain an even number of digits. End position - start position + 1 >= the length of the match content / 2.

   • Action:

     • Monitor: Records hits only and does not block requests.

     • Block: Drops the current request.

5. In the Protected Assets list, select protected instances in the Objects to Select area.

6. After you select the Asset IP Address that you want to protect, in the Port/Protocol area, select the specific ports to protect.

7. After you confirm the configuration, click Add.

Modify a port-specific mitigation policy

1. In the upper-left corner of the Mitigation Settings page, select Port-specific Mitigation Policy from the drop-down list. Find the target policy. In the Actions column, click Modify Mitigation Policy.

2. On the Modify Mitigation Policy page, you can perform the following operations:

   • Create Rule: Click Create Rule above the list. Configure the rule as described in Create a port-specific mitigation policy, and then click OK.

   • Edit: In the target rule's Actions column, click Edit. Modify the rule as described in Create a port-specific mitigation policy, and then click OK.

   • Delete: In the target rule's Actions column, click Delete. In the confirmation dialog box, confirm the information, and then click Delete.

Manage protected objects

1. On the Mitigation Settings page, select Port-specific Mitigation Policy. Find the target policy. In the Actions column, click Add Object for Protection.

2. On View Applicable Object, you can perform the following operations:

   • Add Object for Protection:

     1. Click Add Object for Protection above the list. In the Objects to Select area, select protected instances.

     2. In the IP list, select the IP addresses to protect. In the Port/Protocol area, select the ports to protect.

        Note

        You can select up to 50 protected objects.

     3. Click Add.

   • Delete: In the target rule's Actions column, click Delete. In the confirmation dialog box, confirm the information, and then click OK.

Delete a port-specific mitigation policy

On the Mitigation Settings page, select Port-specific Mitigation Policy. Find the target policy. In the Actions column, click Delete.