Anti-DDoS:Cloud service interaction

How a cloud service interaction rule works

The cloud service interaction solution uses DNS-based intelligent resolution to schedule traffic dynamically and adjusts the traffic path based on the security status of your cloud resources.

• Normal state (no attack): Service traffic does not pass through Anti-DDoS Proxy for traffic scrubbing. Traffic goes directly from the client to the cloud resource.

  • Traffic path: client → cloud resource (direct access).

  • How it works: when the cloud resource is not under a DDoS attack, service traffic bypasses the Anti-DDoS Proxy scrubbing node. Traffic is resolved directly from the client to the cloud resource IP address, which ensures minimal latency and optimal performance.

• Attack state (traffic scrubbing triggered): Traffic automatically switches to Anti-DDoS Proxy for traffic scrubbing, so that only normal service traffic is forwarded to the cloud resource.

  Note

  You can also switch traffic to Anti-DDoS Proxy manually. For more information, see Traffic switching.

  • Trigger condition: the monitoring system detects that the cloud resource is under a DDoS attack and that all cloud resource IP addresses enter blackhole filtering.

  • Traffic path: client → Anti-DDoS Proxy (traffic scrubbing) → cloud resource.

  • How it works:

    1. The system automatically updates the DNS record to point your domain name to the CNAME address of Anti-DDoS Proxy.

    2. Service traffic is directed to the Anti-DDoS Proxy cluster for malicious traffic scrubbing.

    3. Only normal service traffic is forwarded back to the cloud resource, which ensures service continuity.

• Recovery state (automatic switchback)

  • Trigger condition: the DDoS attack ends and traffic stays stable for a period of time.

  • How it works:

    1. After the attack stops, Anti-DDoS Proxy enters a switchback waiting period (the configurable Fallback Time) to check whether the attack rebounds.

    2. When the waiting period ends, the system automatically restores the DNS record to the cloud resource IP address.

    3. Service traffic connects directly to the cloud resource again and exits the Anti-DDoS Proxy scrubbing mode.

Configure a cloud service interaction rule

1. Log on to the Anti-DDoS Proxy console.

2. In the top navigation bar, select the region of your instance.

   • Anti-DDoS Proxy (Chinese Mainland): Choose the Chinese Mainland region.

   • Anti-DDoS Proxy (Outside Chinese Mainland): Choose the Outside Chinese Mainland region.

3. In the left-side navigation pane, choose Onboarding > Sec-Traffic Manager.

4. For the Cloud Service Interaction scenario, on the General Interaction tab, click Create Rule.

5. In the Create Rule panel, on the Cloud Service Interaction tab, configure the following parameters and click Next.

   Parameter	Description
   Interaction Scenario	Select Cloud Service Interaction.
   Rule Name	The rule name can contain letters, digits, and underscores (_) and cannot exceed 128 characters in length.
   Anti-DDoS Pro or Anti-DDoS Premium Instance	Select the Anti-DDoS Proxy instance that you want to associate with the rule.
   Resource for Interaction	Enter the IP Address of Cloud Resource that you want to associate with the rule. You can use an ECS instance IP address, an SLB instance IP address, a WAF instance IP address, or an EIP. Click Add IP Address of Cloud Resource to add multiple cloud resources. You can add up to 20 IP addresses. Note If you add multiple cloud resource IP addresses, they are associated with a single Anti-DDoS Proxy IP address. When a DDoS attack occurs on one cloud resource IP address, the other cloud resource IP addresses are used first. Traffic switches to Anti-DDoS Proxy for protection only when no cloud resource IP address is available. If you want multiple cloud resources to share traffic and each resource to switch to Anti-DDoS Proxy independently when it is attacked, see Multi-path failover.
   Fallback Time	The waiting time before the switchback process (switching traffic back to the cloud resource IP addresses) can be triggered after service traffic is switched to Anti-DDoS Proxy for protection. After the attack ends and this waiting time elapses, service traffic automatically switches back to the cloud resource IP addresses. Valid values: 30 to 120 minutes. The recommended value is 60 minutes.

6. Update the DNS configuration: To ensure that the interaction rule in Sec-Traffic Manager takes effect, complete the DNS configuration changes as prompted on the page.

   1. Local verification: (Strongly recommended) Before you update the public DNS records, modify the hosts file on your local computer to simulate the resolution change and verify the traffic rerouting rule. This helps you avoid incompatibility issues caused by inconsistent back-to-origin policies. The following are typical risk cases:

      Note

      For more information about how to verify a traffic rerouting rule, see Locally validate your forwarding configuration.

      • Scenario: CDN + Anti-DDoS Proxy + OSS interaction

      • Potential conflict:

        • CDN: supports customizing the Back-to-origin HOST so that the OSS bucket is correctly identified.

        • Anti-DDoS Proxy: does not support modifying the back-to-origin HOST and uses the Host header in the request by default.

      • Symptom: When an attack triggers an automatic switchover to Anti-DDoS Proxy, the Host header passed through by Anti-DDoS Proxy does not match what OSS expects. OSS cannot identify normal traffic, which causes service access failures.

   2. Update the DNS record: After you complete the local verification and confirm that everything works as expected, perform the actual DNS change. Update the DNS record of your domain name to point to the CNAME address provided by Sec-Traffic Manager. Follow the instructions for your domain name registrar:

      Domain name registrar	Instructions
      Alibaba Cloud	Log on to the Alibaba Cloud DNS console and update the record.
      Third-party platform	Log on to the management platform of the third-party registrar where your domain name is registered and update the DNS record of the domain name.

   3. Verify the result: After you update the DNS record, use a browser to test whether your website is accessible.

      Note

      • After you complete the update, the rule may take some time to fully take effect because of the global DNS propagation time (TTL). For more information, see Modify a CNAME record for Traffic Scheduler.

      • If your website does not work as expected, troubleshoot the issue first. For more information, see Troubleshoot slow response, high latency, and access failures for services protected by Anti-DDoS Proxy.

Traffic switching

To meet the flexibility requirements of different service scenarios, Cloud Service Interaction rules support two switching modes:

Other operations

After you add a General Interaction rule, you can perform the following operations on the added rules in the rule list.