How to purchase an Anti-DDoS Native instance - Anti-DDoS

This topic describes how to purchase an Anti-DDoS Native instance.

Choose an edition

Anti-DDoS Native protects public IP assets in your Alibaba Cloud account. The service requires no changes to your business architecture, supports multiple assets and ports, and integrates natively. Based on the billing method, Anti-DDoS Native is available in the following editions:

Comparison item	Anti-DDoS Native 2.0 (Subscription)	Anti-DDoS Native 2.0 (Pay-as-you-go) (End of sale)
Billing method	Subscription	Pay-as-you-go
Supported asset types	Anti-DDoS Native (SMB): Protects standard cloud products only. Enterprise: Protects standard cloud products and enhanced cloud products - Anti-DDoS Native (Advanced) EIP.	Protects standard cloud products and enhanced cloud products (Anti-DDoS Pro/PremiumEIP).
Protected region scope	Anti-DDoS Native (SMB): Supports a single region only. Enterprise: Supports all regions under your Alibaba Cloud account.	All regions.
Number of protection sessions	Anti-DDoS Native (SMB): 2 unlimited protection sessions per month. Enterprise: Unlimited.	Unlimited.

For more information about Anti-DDoS Native, see What is Anti-DDoS Native?, Product overview, and Pricing.

Anti-DDoS Origin 2.0 (Subscription)

Go to the Anti-DDoS Native 2.0 buy page and select Anti-DDoS Origin 2.0 (Subscription) as the product type.

Choose an edition based on the following comparison.

Comparison item	Anti-DDoS Native (SMB)	Anti-DDoS Native (Enterprise)
Supported asset types	Protects standard cloud products only.	Standard cloud products Enhanced cloud products — Anti-DDoS Native (Advanced) EIP
Protected region scope	Supports a single region only.	Supports all regions under your Alibaba Cloud account. Region matching rule for Anti-DDoS Advanced EIPs: The region of an Anti-DDoS Advanced EIP must exactly match the protected region configured for the Anti-DDoS Native instance. If the protected region of your Anti-DDoS Native instance is set to the Chinese mainland only, you cannot add Anti-DDoS Advanced EIPs from overseas or other regions, and you cannot purchase Anti-DDoS Native (Advanced) EIP in overseas regions. Upgrade the Anti-DDoS Native instance to adjust the protected region, and then purchase an Anti-DDoS Advanced EIP in the corresponding region.
Protection Mode	By default, only Insurance (2 Sessions/Month) is supported.	By default, only Unlimited (Unlimited Sessions/Month)

Configure the following parameters to purchase an Anti-DDoS Native 2.0 (Subscription) instance.

Parameter	Description
Edition	Anti-DDoS Native (SMB): Recommended if your public IP assets are in the same region and the number of IP addresses is 30 or fewer. Enterprise: Your public IP assets are distributed across multiple regions, the number of IP addresses exceeds 30, or your assets use both IPv4 and IPv6. You need to protect EIPs.
Protection Mode	Insurance (2 Sessions/Month): 2 advanced protection sessions per month. Unlimited (Unlimited Sessions/Month): Unlimited advanced protection sessions per month. Note Before you purchase the Anti-DDoS Native (SMB) Unlimited mode or the Enterprise Insurance mode, contact your pre-sales account manager. For more information about protection sessions, see Anti-DDoS Native 2.0 (Subscription).
Application Scope	Anti-DDoS Native (SMB): A single instance protects only the public IP assets in one region under your Alibaba Cloud account. Enterprise: A single instance protects all public IP assets under your Alibaba Cloud account, both in the Chinese mainland and outside the Chinese mainland.
Protocol	The IP protocol types supported by the Anti-DDoS Native instance. Anti-DDoS Native (SMB): A single instance protects either IPv4 or IPv6 assets only. Enterprise: A single instance protects both IPv4 and IPv6 assets at the same time.
Clean Bandwidth	The normal business scale of the service that you want to protect.
Metering Method of 95th Percentile Burstable Clean Bandwidth	Anti-DDoS Native (SMB) and Enterprise: Daily 95th Percentile is enabled by default. When your actual clean bandwidth exceeds the guaranteed Clean Bandwidth, burstable clean bandwidth is used. For more information, see Anti-DDoS Native 2.0 (Subscription) billing items - Pay-as-you-go.
IP Addresses	The total number of IP addresses that you want to protect.
Mitigation Logs	Supported by Anti-DDoS Native (Enterprise) only. Provides full log analysis and reporting for protected traffic.
Resource Group	A resource group is a set of related resources under your Alibaba Cloud account. Resource groups allow you to independently manage the members, permissions, and resources within a group. You can select an existing resource group or create a resource group.
Subscription duration	The validity period of the Anti-DDoS Native instance that you want to purchase. You can enable auto-renewal as needed.

Carefully read and select the Terms of Service, and then click Buy Now and complete the payment.

Anti-DDoS Origin 2.0 (Pay-as-you-go) - End of sale

Important

Anti-DDoS Native 2.0 (Pay-as-you-go) is activated on a monthly basis. The service must be formally activated for at least 30 days, and you cannot deactivate it within 30 days.
Anti-DDoS fees are additional security feature fees and do not change the original billing of the cloud products.

Go to the Anti-DDoS Native 2.0 buy page and select Anti-DDoS Origin 2.0 (Subscription) as the product type.
Edition and Protection Mode are set by default to the Enterprise value of Unlimited (Unlimited Sessions/Month).

Protection authorization (first purchase)

The first time you purchase Anti-DDoS Native 2.0, you must complete protection authorization. This allows Anti-DDoS Native to access services such as ECS, SLB, NAT, and EIP, so that you can use Anti-DDoS Native features.

Go to the Instance Management page of the Traffic Security console.
If this is your first purchase, the Service-linked role for Anti-DDoS Native authorization dialog box appears. Click OK. After you authorize the service-linked role, the system automatically creates:
- Role name: AliyunServiceRoleForDDoSBgp
- Permission policy: AliyunServiceRolePolicyForDDoSBgp

Note

If you have already created AliyunServiceRoleForDDoSBgp, the authorization dialog box no longer appears on subsequent visits.

Protection scenarios

Important

Before you use the following protection capabilities, you must complete protection authorization. Otherwise, you cannot protect the corresponding cloud products.

Protect standard cloud products

Use your Alibaba Cloud account to purchase an instance of any edition of Anti-DDoS Origin 2.0 (Subscription).
Purchase cloud products: For instructions, see the documentation of each cloud product.
Note
When you purchase an EIP, select Default for the security protection capability. Other cloud products do not require you to select a security protection capability.
Add a protected object: You can go to the Instance Management page to view your purchased instances and add the public IP assets that you want to protect as protected objects of an instance.
- You can add protected objects automatically or manually.
- If the multi-account management feature is enabled, you can manually add the assets of a member account.

Protect enhanced cloud products (Anti-DDoS Advanced EIP protection)

Instructions

Use your Alibaba Cloud account to purchase the Anti-DDoS Origin 2.0 (Subscription) Enterprise instance.
Purchase an Anti-DDoS Advanced EIP: Follow these steps to purchase Anti-DDoS Native (Advanced) EIP.
1. In the EIP console, click Create EIP.
2. On the Elastic IP Address buy page, set Billing Method to pay-as-you-go. For the security protection capability, select Anti-DDoS Advanced EIP.
Note
A newly purchased Anti-DDoS Advanced EIP is associated by default with the Anti-DDoS Native instance that has the largest remaining IP quota. If the purchase quantity exceeds the remaining quota of that instance, the purchase of Anti-DDoS Native (Advanced) EIP fails. For instructions, see How to purchase an Anti-DDoS Advanced EIP.

Add a protected object: After you purchase an Anti-DDoS Advanced EIP, the system adds it to the protected objects of the corresponding instance in the following order.

Newly purchased Advanced EIP (non-Resource Directory scenario):
- If you have only one Anti-DDoS Native 2.0 (Pay-as-you-go) instance, the EIP is automatically added to that instance.
- If you have only one Anti-DDoS Native 2.0 (Subscription) - Enterprise instance, the EIP is automatically added to that instance.
- If you have both a Pay-as-you-go instance and a Subscription - Enterprise instance, the EIP is preferentially added to the Pay-as-you-go instance.

Resource Directory (RD) multi-account scenario (sub-account purchases Advanced EIP): The EIP is automatically associated based on a hierarchical strategy:

Pay-as-you-go instances take priority over subscription instances.
Main account resources take priority over member account resources.
Subscription instances prefer the one with larger remaining capacity.

Priority	Account	Instance
1	RD main account	Anti-DDoS Native 2.0 (Pay-as-you-go)
2	RD member account	Anti-DDoS Native 2.0 (Pay-as-you-go)
3	RD main account	Anti-DDoS Native 2.0 (Subscription) - Enterprise Note Prefer the instance with the largest remaining capacity.
4	RD member account	Anti-DDoS Native 2.0 (Subscription) - Enterprise Note Prefer the instance with the largest remaining capacity.

Lifecycle of Advanced EIPs

The lifecycle of Advanced EIP assets is aligned with the Anti-DDoS Native 2.0 (Enterprise) instance:

When an Advanced EIP is released, the asset information is synchronized to Anti-DDoS Native via an API, and the asset is automatically removed from the instance.
When an Anti-DDoS Native (Subscription) instance expires, a message is synchronized to the EIP to stop traffic forwarding. After forwarding stops, the EIP can continue to be used once you renew the instance. If the instance is not renewed, the EIP follows the Anti-DDoS Native lifecycle for suspension and release.
When the Anti-DDoS Native instance is suspended and released, the associated Advanced EIP is also automatically released. The Advanced EIP stops providing services, and related configurations and data are permanently deleted and cannot be recovered.
Warning
Migrate your business and data from the Advanced EIP before the Anti-DDoS Native instance is released to avoid data loss.

FAQ

What do I do if I selected the wrong region when I purchased an Anti-DDoS Native instance?
- Terminology: The region of an Anti-DDoS Native instance refers to the sales region and is unrelated to the region where your cloud assets reside. When you purchase an instance, you must specify the asset region: a single region, multiple regions in the Chinese mainland, multiple regions in international regions and China (Hong Kong), China (Macao), and China (Taiwan), or multiple regions worldwide.
- Solution: If the region where the IP addresses that you want to protect reside differs from the selected asset region, contact technical support to request a refund, and then purchase a new instance in the asset region that meets your requirements.
What is the difference between the billing methods of unlimited protection in Anti-DDoS Native and burstable protection in Anti-DDoS Proxy?
- Anti-DDoS Native provides the Unlimited protection capability. When an attack occurs, the system automatically dispatches the maximum Alibaba Cloud DDoS mitigation capability in the region where the Anti-DDoS Native instance resides to provide unlimited protection. The unlimited protection service is included in the Anti-DDoS Native instance plan and does not incur additional burstable protection fees.
- The burstable protection billing of Anti-DDoS Proxy (Chinese Mainland) is based on the peak traffic of the burstable bandwidth on that day. For more information, see Billing of elastic protection capability.
What are the core technical advantages of the Anti-DDoS Advanced EIP (native Anti-DDoS Proxy EIP)? Which business scenarios is it suitable for?
- Core technical advantages
  The Anti-DDoS Advanced EIP combines the low-latency characteristics of Anti-DDoS Native with the Tbps-level defense capability of Anti-DDoS Proxy. It has the following advantages:
  - Transparent access and imperceptible deployment: The service uses transparent access. Traffic is automatically scrubbed at the Anti-DDoS Proxy centers at the network edge, and the scrubbed normal traffic reaches your servers directly through EIPs and shared bandwidth. No major changes to your business architecture are required.
  - Both low latency and high-bandwidth defense:
    - Low latency: Retains the network path advantages of Anti-DDoS Native and meets the requirements of latency-sensitive workloads.
    - Tbps-level defense: Withstands large-scale DDoS attacks at the Tbps level and addresses the limited defense ceiling of traditional Anti-DDoS Native.
  - Full asset coverage: Supports comprehensive protection for multiple IP addresses, domain names, and ports, and is suitable for business systems with a large number of public IP assets.
- Applicable business scenarios: This solution is designed for customers who need both high-volume DDoS defense and ultra-low business latency. Typical use cases include premium gaming and game distribution.