Sec-Traffic Manager lets you configure interaction rules between Anti-DDoS Proxy and cloud services, so Anti-DDoS Proxy is triggered and enabled only in specific scenarios. Your services run smoothly when no DDoS attack is in progress, and traffic switches to Anti-DDoS Proxy for protection when an attack occurs. Sec-Traffic Manager covers the cloud service interaction, tiered protection, CDN or DCDN interaction, network acceleration, and Secure Chinese Mainland Acceleration (Sec-CMA) scenarios.
What is the difference between using and not using Sec-Traffic Manager?
To protect your services with Anti-DDoS Proxy, you need only complete Website Config (for website services; for instructions, see Add a website configuration) or Port Config (for non-website services; for instructions, see Configure port forwarding rules). Sec-Traffic Manager is not required.
After your services are added to Anti-DDoS Proxy, all service traffic, including legitimate traffic and attack traffic, is forwarded through Anti-DDoS Proxy. Attack traffic is scrubbed, and only legitimate traffic is forwarded to the origin server. During normal access, legitimate traffic is also forwarded through Anti-DDoS Proxy, which introduces a small amount of latency to your services.
To address the latency introduced during normal access, you can enable the cloud service interaction feature of Sec-Traffic Manager. During normal access, traffic reaches the origin server directly instead of being forwarded through Anti-DDoS Proxy, which adds no latency. Traffic is forwarded through Anti-DDoS Proxy only when your services are under attack, which helps scrub DDoS attack traffic.
In addition to the preceding scenarios, Sec-Traffic Manager also enables Anti-DDoS Proxy to work with Anti-DDoS Native, CDN or DCDN, Chinese Mainland Acceleration (CMA), and the secure acceleration line. For details, see Interaction scenarios.
Sec-Traffic Manager is an access configuration feature of Anti-DDoS Proxy and is available at no additional charge.
Interaction scenarios
The following table describes the interaction scenarios of Anti-DDoS Proxy Sec-Traffic Manager and the related references.
A cross (×) indicates an interaction scenario that Anti-DDoS Proxy (Chinese Mainland) instances do not support.
Interaction scenario | Description | Anti-DDoS Proxy (Chinese Mainland) | Anti-DDoS Proxy (Outside Chinese Mainland) | References |
Cloud service interaction | Your services use Alibaba Cloud public IP resources and are protected by Anti-DDoS Proxy, with the following results:
Note Interaction with Alibaba Cloud Global Accelerator instances is supported. For details, see What is Global Accelerator?. | √ | √ | |
Tiered protection | Your services are protected by both Anti-DDoS Native and Anti-DDoS Proxy, with the following results:
| √ | √ | |
CDN or DCDN interaction scheduling | Your website services have Alibaba Cloud Content Delivery Network (CDN) or DCDN acceleration enabled and are protected by Anti-DDoS Proxy, with the following results:
| √ | √ | |
Network acceleration | Your services use both an Anti-DDoS Proxy (Outside Chinese Mainland) Insurance mitigation plan or Unlimited mitigation plan instance and Chinese Mainland Acceleration (CMA), with the following results:
Note The network acceleration solution applies when your service servers are deployed outside the Chinese mainland but most of your users are in the Chinese mainland. For details, see Configure a CMA plan for Anti-DDoS Proxy (Outside Chinese Mainland). | × | √ | |
Secure Chinese Mainland Acceleration (Sec-CMA) | Your services use both an Anti-DDoS Proxy (Outside Chinese Mainland) Insurance mitigation plan or Unlimited mitigation plan instance and the secure acceleration line, with the following results:
Note The secure acceleration line applies when users in the Chinese mainland need accelerated access to services outside the Chinese mainland and also need DDoS protection. For details, see Secure acceleration for Anti-DDoS Proxy (Outside Chinese Mainland). | × | √ |