Tiered protection combines Anti-DDoS Native with Anti-DDoS Proxy to keep routine service access at low latency while mitigating volumetric attacks. Under normal conditions, Anti-DDoS Native handles routine attacks without adding access latency; when a volumetric attack occurs, traffic automatically switches to Anti-DDoS Proxy. Configure an interaction rule to dynamically balance mitigation capability and service performance.
Prerequisites
Your service uses Alibaba Cloud public IP resources, specifically Elastic Compute Service (ECS) instances or Server Load Balancer (SLB) instances that have public IP addresses, elastic IP addresses (EIPs), and Web Application Firewall (WAF).
Anti-DDoS Native: You have purchased an Anti-DDoS Native instance and enabled Anti-DDoS Native for your public IP assets. For instructions, see Purchase an Anti-DDoS Native instance and Protected objects.
Anti-DDoS Proxy: You have purchased one of the following Anti-DDoS Proxy editions and added your website services to Anti-DDoS Proxy. For instructions, see Purchase an Anti-DDoS Proxy instance and Add a website configuration.
Anti-DDoS Proxy (Chinese Mainland): Professional Edition and Premium Edition
Anti-DDoS Proxy (Outside Chinese Mainland): Insurance and Unlimited mitigation plan
The Anti-DDoS Proxy instance forwards service traffic as expected. For more information, see Locally validate your forwarding configuration.
How tiered protection interaction rules work
Tiered protection uses a Native protection by default, Anti-DDoS Proxy on demand strategy that dynamically adjusts the protection level based on the volume of attack traffic. This layered defense keeps latency low for routine services while providing elastic scrubbing capacity for massive volumetric attacks.
The interaction solution uses DNS scheduling to switch traffic. When a cloud asset enters blackhole filtering, it becomes inaccessible.
Services are affected during the switchover. The duration of the impact depends on the refresh interval of the client-side Local DNS cache.
Routine protection (no attack or small-scale attacks):
Protection provider: Anti-DDoS Native.
Traffic path: Client → Anti-DDoS Native → Cloud resource IP address.
How it works:
By default, service traffic is scrubbed by the Anti-DDoS Native capability that is built into the cloud resource.
This mode is suitable for routine small-scale attacks or scans. No traffic path switchover is required, which keeps service access latency to a minimum.
Emergency protection (triggered by a volumetric attack):
NoteYou can also manually switch traffic to Anti-DDoS Proxy. For details, see Switch traffic.
Trigger condition: A volumetric DDoS attack is detected on the cloud resource IP addresses, and all of them are in blackhole filtering.
Protection provider: Anti-DDoS Proxy.
Traffic path: Client → Anti-DDoS Proxy (deep scrubbing) → Cloud resource IP address.
How it works:
The system automatically changes the DNS record to point the domain name to the CNAME address of Anti-DDoS Proxy.
Service traffic is redirected to the Anti-DDoS Proxy cluster for malicious traffic scrubbing.
Only normal service traffic is forwarded back to the cloud resource, which ensures service continuity.
Automatic switchback (after an attack ends)
Trigger condition: The attack traffic stops completely and remains stable for longer than the configured fallback time.
How it works:
The system automatically switches traffic back, which restores DNS resolution or routing to the cloud resource IP address.
Service traffic is again handled by Anti-DDoS Native and exits Anti-DDoS Proxy scrubbing mode.
Configure a tiered protection interaction rule
Log on to the Anti-DDoS Proxy console.
In the top navigation bar, select the region of your instance.
Anti-DDoS Proxy (Chinese Mainland): Choose the Chinese Mainland region.
Anti-DDoS Proxy (Outside Chinese Mainland): Choose the Outside Chinese Mainland region.
In the left-side navigation pane, choose .
On the General Interaction tab, click Add Rule. In the panel that appears, select Tiered Protection as the interaction scenario. Configure the rule name, Anti-DDoS IP address, resource for interaction, and fallback time, and then click OK.
Parameter
Description
Interaction Scenario
Select Tiered Protection.
Rule Name
The rule name can contain letters, digits, and underscores (_) and cannot exceed 128 characters in length.
Anti-DDoS IP Address
Select the Anti-DDoS Proxy instance to associate.
Resource for Interaction
Configure the IP addresses of the cloud resources to associate: select the region where each cloud resource is deployed and enter its IP address.
ImportantThe IP addresses of cloud resources (ECS, SLB, EIP, and WAF) must already have Anti-DDoS Native (Enterprise) enabled. For instructions, see Protected objects.
Click Add IP Address of Cloud Resource to add multiple cloud resources. You can add up to 20 IP addresses.
NoteIf you add multiple cloud resource IP addresses, they are associated with a single Anti-DDoS Proxy IP address. When a DDoS attack occurs on one cloud resource IP address, the other cloud resource IP addresses are used first. Traffic switches to Anti-DDoS Proxy for protection only when no cloud resource IP address is available.
If you want multiple cloud resources to share traffic and each resource to switch to Anti-DDoS Proxy independently when it is attacked, see Multi-path failover.
Fallback time
The waiting period before a switchback to the cloud resource IP address can be triggered after service traffic switches to Anti-DDoS Proxy. After the attack ends and this period elapses, service traffic automatically switches back to the cloud resource IP address.
Valid values: 30 to 120 minutes. Recommended value: 60 minutes.
Modify DNS records: To ensure that the Sec-Traffic Manager interaction rule takes effect, complete the DNS record changes as prompted on the page.
Note(Recommended) Verify the configuration locally before the official switchover to avoid potential service compatibility risks.
Local verification: As a best practice, before you modify the public DNS records, simulate the change by modifying the
hostsfile on your local computer to verify the traffic rerouting rule. This prevents compatibility issues caused by inconsistent back-to-origin policies.NoteFor instructions on verifying the traffic rerouting rule, see Locally validate your forwarding configuration.
Update the DNS record: After you complete the local verification and confirm that everything works as expected, perform the actual DNS change. Update the DNS record of your domain name to point to the CNAME address provided by Sec-Traffic Manager. Follow the instructions for your domain name registrar:
Domain name registrar
Instructions
Alibaba Cloud
Log on to the Alibaba Cloud DNS console and update the record.
Third-party platform
Log on to the management platform of the third-party registrar where your domain name is registered and update the DNS record of the domain name.
Switch traffic
To provide flexibility for different service scenarios, Tiered Protection supports two switching modes:
Both the automatic mode and the manual mode rely on updates to the underlying DNS scheduling mechanism during switching. The switching process may be affected by network convergence time. (Recommended) Evaluate the tolerance of your service in advance.
Switching mode | Description | Applicable scenario |
Automatic switchover | Based on real-time traffic monitoring and attack characteristics, the system automatically switches traffic from Anti-DDoS Native to Anti-DDoS Proxy and from Anti-DDoS Proxy back to Anti-DDoS Native. | Delivers unattended automated protection around the clock without manual intervention. |
Manual switchover | You can manually trigger a switchover or a switchback in the console based on service forecasts, drill requirements, or special security events. |
|
Automatic switchover
Switchover type | Switchover condition |
Switch from Anti-DDoS Native to Anti-DDoS Proxy | All cloud resource IP addresses are in blackhole filtering. |
Switch back from Anti-DDoS Proxy to Anti-DDoS Native | After an attack on a cloud asset ends and a period of time (fallback time) elapses, service traffic automatically switches back to Anti-DDoS Native. |
Manual switchover
Switch to Anti-DDoS
Procedure:
On the Sec-Traffic Manager page, click the General Interaction tab.
Find the rule whose Interaction Scenario is Tiered Protection and for which Anti-DDoS Proxy scrubbing has not been triggered automatically (the Resource for Interaction entry shows the
icon).In the Actions column, click Switch to Anti-DDoS. In the confirmation dialog box, verify the information and click OK.
Restrictions:
If the Anti-DDoS Proxy instance is in blackhole filtering, or the fallback time has not elapsed since the blackhole event started, you cannot switch cloud resources to Anti-DDoS Proxy.
By default, service traffic that you manually switch to Anti-DDoS Proxy does not automatically switch back to the resources for interaction. Use the Switchback operation to switch traffic back to the resources for interaction.
Switchback
Procedure:
On the Sec-Traffic Manager page, click the General Interaction tab.
Find the rule whose Interaction Scenario is Tiered Protection and whose service traffic is scrubbed by Anti-DDoS Proxy (the Anti-DDoS Pro or Anti-DDoS Premium Instance entry shows the
icon).In the Actions column, click Switchback. In the confirmation dialog box, verify the information and click OK.
Restrictions:
If all resources for interaction are in blackhole filtering, the switchback operation fails.
If some resources for interaction have exited blackhole filtering while others are still in blackhole filtering:
Traffic first switches back to the resources for interaction that have exited blackhole filtering.
Traffic for the other resources for interaction is automatically restored after blackhole filtering ends.
Other operations
After you add a General Interaction rule, you can perform the following operations on the added rules in the rule list.
Operation | Description |
Edit | Edit a General Interaction rule. You can modify the parameter settings other than Interaction Scenario and Rule Name. |
Delete | Delete a General Interaction rule. Warning Before you delete an interaction rule, make sure that the DNS record of your website domain name does not point to the Sec-Traffic Manager CNAME. Otherwise, your website becomes inaccessible after the interaction rule is deleted. |