Anti-DDoS:Create a secure acceleration rule

How it works

Sec-MCA protects service traffic only from carriers in the Chinese mainland. To protect all service traffic, use Sec-MCA together with an Anti-DDoS Pro or Anti-DDoS Premium instance (outside the Chinese mainland) under the Insurance or Unlimited mitigation plan.

The following example shows how Sec-MCA 2.0 interacts with an Anti-DDoS Pro or Anti-DDoS Premium instance (outside the Chinese mainland) under the Unlimited mitigation plan:

• Traffic from China Telecom, China Unicom, and China Mobile in the Chinese mainland is scheduled to the IP address of the Sec-MCA 2.0 instance.

• All other traffic is scheduled to the IP address of the Anti-DDoS Pro or Anti-DDoS Premium instance (outside the Chinese mainland) under the Unlimited mitigation plan.

Prerequisites

Before you begin, make sure that you have:

• An Anti-DDoS Pro or Anti-DDoS Premium instance (outside the Chinese mainland) under the Insurance or Unlimited mitigation plan and a Sec-MCA 2.0 instance

• Services that are not accessed directly by IP addresses. If your services are accessed directly by IP addresses, Sec-Traffic Manager cannot automatically schedule service traffic

Procedure

1. Add your website service to both the Anti-DDoS Pro or Anti-DDoS Premium instance (outside the Chinese mainland) under the Insurance or Unlimited mitigation plan and the Sec-MCA 2.0 instance. Then, verify that service traffic is forwarded as expected.

   • To add your service, see Add a website configuration or Configure port forwarding rules.

     Note

     Only add your service at this stage. Do not modify the domain name resolution.

   • To verify that service traffic is forwarded as expected, see Verify traffic forwarding settings on a local machine.

2. Configure the secure acceleration rule.

   1. Log on to the Anti-DDoS Proxy console.

   2. In the top menu bar at the upper left corner, choose the Outside Chinese Mainland region.

      If you select this region, you are redirected to the Anti-DDoS Proxy (Outside Chinese Mainland) console.

   3. In the left-side navigation pane, choose Provisioning > Sec-Traffic Manager.

   4. On the General Interaction tab, click Add Rule.

   5. On the Add Rule page, configure a Sec-CMA rule with the following parameters, and click OK.

      Parameter	Description
      Interaction Scenario	Select Sec-CMA.
      Rule Name	Enter a name for the rule. The name can be up to 128 characters in length and can contain letters, digits, and underscores (_).
      Sec-CMA	Select the IP address of the Sec-MCA instance.
      Anti-DDoS Proxy (Outside Chinese Mainland)	Select the IP address of the Anti-DDoS Pro or Anti-DDoS Premium instance (outside the Chinese mainland) under the Unlimited mitigation plan.

      After you add the rule, Sec-Traffic Manager generates a CNAME for the rule. View the rule and its CNAME in the rule list.

3. Change the DNS records of the domain name as prompted and click Complete.

   For the cloud service interaction rule to take effect, you must change the DNS records of your domain name on the website of your DNS service provider to map the domain name to the CNAME provided by Sec-Traffic Manager. If your DNS service is provided by Alibaba Cloud DNS, you need to only change the DNS records in the Alibaba Cloud DNS console.

   Important

   After you change the DNS record of your domain name, the network acceleration rule takes effect. Before you change the DNS records, we recommend that you modify the hosts file on your on-premises computer to verify the cloud service interaction rule. This helps prevent incompatibility issues caused by inconsistent back-to-origin policies. CDN allows you to change the origin host for back-to-origin requests. However, you cannot use Anti-DDoS Proxy to change the origin host for back-to-origin requests. If you use CDN together with Anti-DDoS Proxy to retrieve data from an Object Storage Service (OSS) object, the service traffic that is forwarded by Anti-DDoS Proxy cannot be identified by OSS. As a result, your services are interrupted. For more information about origin hosts, see Configure the default origin host.

   For more information about how to verify traffic forwarding rules, see Verify the forwarding configurations on your on-premises computer.

   For more information about how to change the DNS records of a domain name, see Change the CNAME record to redirect traffic to Sec-Traffic Manager.

Manage existing rules

After you add a General Interaction rule, you can perform the following operations on the rule in the rule list.