Anti-DDoS:Configure port-specific mitigation policies

Usage notes

• Assets of regular Alibaba Cloud services support only IP-specific mitigation policies. EIPs with Anti-DDoS (Enhanced) enabled support both IP-specific and port-specific mitigation policies. If you configure both IP-specific and port-specific mitigation policies, IP-specific mitigation policies have a higher priority.

• You can associate only one port-specific mitigation policy with a port.

Prerequisites

A port of an EIP with Anti-DDoS (Enhanced) enabled is added to a mitigation policy on the Protected Objects page. For more information, see Add objects for protection.

Procedure

1. Log on to the Traffic Security console.

2. In the left-side navigation pane, choose Network Security > Anti-DDoS Origin > Mitigation Settings.

3. Click Create Policy. In the Create Policy panel, configure Policy Name and select Port-specific Mitigation Policy in the Select Policy Type section. Then, click OK.

4. In the The policy is created. message, click OK.

5. Click Create Rule, configure rules for the policy, and then click Next.

   Parameter	Description
   Rule Name	The name of the rule. You can add up to 10 rules to each mitigation policy.
   Minimum Bytes to Trigger Matching	The minimum number of bytes in a session to trigger matching. Valid values: 0 to 2048. Default value: 0. The value specifies that matching is triggered when a session contains at least a byte. If you set this parameter to 1500 and the number of bytes in a session is less than 1,500, the rule does not take effect.
   Rule Type	The type of session to detect. Valid values: String Match (ASCII) and Hexadecimal String Match.
   Match Conditions	Start Position: the start position of the detection. Valid values: 0 to 2047. The value 0 indicates the first byte. The value 1 indicates the second byte. All values follow the same rule. Match Range in Bytes from Start Position: the number of bytes detected from the start position. Valid values: 1 to 2048. If you set this parameter to 20 and the Start Position parameter to 10, the eleventh to thirtieth bytes in a session are detected. Term to Match: the content to match. The content is a string and can be up to 2,048 characters in length.
   Priority	The priority of the detection. A smaller value indicates a higher priority. Valid values: 1 to 100.
   Logical Operator	The condition based on which an action is performed.
   Action	The method to process a session that hits the rule. The value is fixed as Discard.

6. In the Protected Assets section of the Objects to Select step, search for the required port and protocol by region, EIP name, and IP address. Then, select the Port/Protocol and click Add.

What to do next

• To modify a port-specific mitigation policy, select Port-specific Mitigation Policy on the Mitigation Settings page. Find the policy that you want to modify and click Modify Protection Rule in the Actions column.

  Important

  After you modify a mitigation policy, the new mitigation policy takes effect on all protected objects. Proceed with caution.

• To delete a port-specific mitigation policy, select Port-specific Mitigation Policy on the Mitigation Settings page. Find the policy that you want to delete and click Delete in the Actions column.

  Important

  If the mitigation policy that you want to delete is attached to an object, you cannot delete the mitigation policy. You must detach the mitigation policy from the protected object before you can delete the mitigation policy.

• To attach a mitigation policy to an object for protection or detach a protected object from a mitigation policy, select Port-specific Mitigation Policy on the Mitigation Settings page. Find the policy that you want to manage and click Add Object for Protection in the Actions column.

Examples

Your game is deployed by using EIP with Anti-DDoS (Enhanced) enabled and provides services over TCP and ports 8191 and 8192. We recommend that you block HTTP requests for daily operations after you add the game for protection, or use a tool, such as a packet capture tool, to analyze the characteristics of the attack requests and modify port-specific mitigation policies after the game is attacked.

The following table describes the configurations to block HTTP requests.