You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
summary: This article answers common questions about Azure DDoS Protection.
@@ -30,7 +30,7 @@ sections:
30
30
31
31
Under a tenant, a single DDoS protection plan can be used across multiple subscriptions, so there's no need to create more than one DDoS protection plan.
32
32
33
-
When Application Gateway with WAF is deployed in a DDoS protected VNet, there are no extra charges for WAF - you pay for the Application Gateway at the [lower non-WAF rate](https://azure.microsoft.com/pricing/details/application-gateway/). This policy applies to both Application Gateway v1 and v2 SKUs.
33
+
When Application Gateway with WAF is deployed in a DDoS protected virtual network, there are no extra charges for WAF - you pay for the Application Gateway at the [lower non-WAF rate](https://azure.microsoft.com/pricing/details/application-gateway/). This policy applies to both Application Gateway v1 and v2 SKUs.
34
34
35
35
See [Azure DDoS Protection pricing](https://azure.microsoft.com/pricing/details/ddos-protection/) for pricing and more details.
36
36
@@ -57,31 +57,31 @@ sections:
57
57
- question: |
58
58
Are services unsafe in Azure without the service?
59
59
answer: |
60
-
Services running on Azure are inherently protected by the default infrastructure-level DDoS protection. However, the protection that safeguards the infrastructure has a much higher threshold than most applications have the capacity to handle, and does not provide telemetry or alerting, so while a traffic volume may be perceived as harmless by the platform, it can be devastating to the application that receives it.
60
+
Services running on Azure are inherently protected by the default infrastructure-level DDoS protection. However, the protection that safeguards the infrastructure has a higher threshold than most applications have the capacity to handle, and doesn't provide telemetry or alerting, so while a traffic volume may be perceived as harmless by the platform, it can be devastating to the application that receives it.
61
61
62
-
By onboarding to the Azure DDoS Protection Service, the application gets dedicated monitoring to detect attacks and application specific thresholds. A service will be protected with a profile that is tuned to its expected traffic volume, providing a much tighter defense against DDoS attacks.
62
+
By onboarding to the Azure DDoS Protection Service, the application gets dedicated monitoring to detect attacks and application specific thresholds. A service is protected with a profile that is tuned to its expected traffic volume, providing a tighter defense against DDoS attacks.
63
63
64
64
- question: |
65
65
What are the supported protected resource types?
66
66
answer: |
67
-
Public IPs in ARM based VNETs are currently the only type of protected resource. Protected resources include public IPs attached to an IaaS VM, Load Balancer (Classic & Standard Load Balancers), Application Gateway (including WAF) cluster, Firewall, Bastion, VPN Gateway, Service Fabric or an IaaS based Network Virtual Appliance (NVA). Protection also covers public IP ranges brought to Azure via Custom IP Prefixes (BYOIPs).
67
+
Public IPs in ARM based VNETs are currently the only type of protected resource. Protected resources include public IPs attached to an IaaS VM, Load Balancer (Classic & Standard Load Balancers), Application Gateway (including WAF) cluster, Firewall, Bastion, VPN Gateway, Service Fabric, or an IaaS based Network Virtual Appliance (NVA). Protection also covers public IP ranges brought to Azure via Custom IP Prefixes (BYOIPs).
68
68
69
69
To learn about limitations, see [Azure DDoS Protection reference architectures](ddos-protection-reference-architectures.md).
70
70
71
71
- question: |
72
72
Are Classic/RDFE protected resources supported?
73
73
answer: |
74
-
Only ARM based protected resources are supported in preview. VMs in Classic/RDFE deployments are not supported. Support is not currently planned for Classic/RDFE resources. For more information, see [Azure DDoS Protection reference architectures](ddos-protection-reference-architectures.md).
74
+
Only ARM based protected resources are supported in preview. VMs in Classic/RDFE deployments aren't supported. Support isn't currently planned for Classic/RDFE resources. For more information, see [Azure DDoS Protection reference architectures](ddos-protection-reference-architectures.md).
75
75
76
76
- question: |
77
77
Can I protect my PaaS resources using DDoS Protection?
78
78
answer: |
79
-
Public IPs attached to multi-tenant, single VIP PaaS services are not supported presently. Examples of unsupported resources include Storage VIPs, Event Hubs VIPs and App/Cloud Services applications. For more information, see [Azure DDoS Protection reference architectures](ddos-protection-reference-architectures.md).
79
+
Public IPs attached to multi-tenant, single VIP PaaS services aren't supported presently. Examples of unsupported resources include Storage VIPs, Event Hubs VIPs, and App/Cloud Services applications. For more information, see [Azure DDoS Protection reference architectures](ddos-protection-reference-architectures.md).
80
80
81
81
- question: |
82
82
Can I protect my on-premises resources using DDoS Protection?
83
83
answer: |
84
-
You need to have the public endpoints of your service associated to a VNet in Azure to be enabled for DDoS protection. Example designs include:
84
+
You need to have the public endpoints of your service associated to a virtual network in Azure to be enabled for DDoS protection. Example designs include:
85
85
- Web sites (IaaS) in Azure and backend databases in on-premises datacenter.
86
86
- Application Gateway in Azure (DDoS protection enabled on App Gateway/WAF) and websites in on-premises datacenters.
87
87
@@ -90,17 +90,17 @@ sections:
90
90
- question: |
91
91
Can I register a domain outside of Azure and associate that to a protected resource like VM or ELB?
92
92
answer: |
93
-
For the Public IP scenarios, DDoS Protection service will support any application regardless of where the associated domain is registered or hosted as long as the associated Public IP is hosted on Azure.
93
+
For the Public IP scenarios, DDoS Protection service supports any application regardless of where the associated domain is registered or hosted as long as the associated Public IP is hosted on Azure.
94
94
95
95
- question: |
96
96
Can I manually configure the DDoS policy applied to the VNets/Public IPs?
97
97
answer: |
98
-
No, unfortunately policy customization is not available at this moment.
98
+
No, unfortunately policy customization isn't available at this moment.
99
99
100
100
- question: |
101
101
Can I allowlist/blocklist specific IP addresses?
102
102
answer: |
103
-
No, unfortunately manual configuration is not available at this moment.
103
+
No, unfortunately manual configuration isn't available at this moment.
104
104
105
105
- question: |
106
106
How can I test DDoS Protection?
@@ -110,12 +110,12 @@ sections:
110
110
- question: |
111
111
How long does it take for the metrics to load on portal?
112
112
answer: |
113
-
The metrics should be visible on portal within 5 minutes. If your resource is under attack, other metrics will start showing up on portal within 5-7 minutes.
113
+
The metrics should be visible on portal within 5 minutes. If your resource is under attack, other metrics start showing up on portal within 5-7 minutes.
114
114
115
115
- question: |
116
116
Does the service store customer data?
117
117
answer: |
118
-
No, Azure DDoS protection does not store customer data.
118
+
No, Azure DDoS protection doesn't store customer data.
119
119
120
120
- question: |
121
121
Is a single VM deployment behind public IP supported?
@@ -79,7 +79,7 @@ There are many ways to implement an N-tier architecture. The following diagrams
79
79
In this architecture diagram DDoS IP Protection is enabled on the public IP address.
80
80
81
81
> [!NOTE]
82
-
> Scenarios in which a single VM is running behind a public IP is not recommended. DDoS mitigation may not initiate instantaneously when a DDoS attack is detected. As a result a single VM deployment that can’t scale out will go down in such cases.
82
+
> Scenarios in which a single VM is running behind a public IP isn't recommended. DDoS mitigation may not initiate instantaneously when a DDoS attack is detected. As a result a single VM deployment that can’t scale out will go down in such cases.
83
83
84
84
### PaaS web application
85
85
@@ -125,7 +125,7 @@ documentation.
125
125
126
126
This reference architecture details a hub-and-spoke topology with Azure Firewall inside the hub as a DMZ for scenarios that require central control over security aspects. Azure Firewall is a managed firewall as a service and is placed in its own subnet. Azure Bastion is deployed and placed in its own subnet.
127
127
128
-
There are two spokes that are connected to the hub using VNet peering and there's no spoke-to-spoke connectivity. If you require spoke-to-spoke connectivity, then you need to create routes to forward traffic from one spoke to the firewall, which can then route it to the other spoke. All the Public IPs that are inside the hub are protected by DDoS Protection. In this scenario, the firewall in the hub helps control the ingress traffic from the internet, while the firewall's public IP is being protected. Azure DDoS Protection also protects the public IP of the bastion.
128
+
There are two spokes that are connected to the hub using virtual network peering and there's no spoke-to-spoke connectivity. If you require spoke-to-spoke connectivity, then you need to create routes to forward traffic from one spoke to the firewall, which can then route it to the other spoke. All the Public IPs that are inside the hub are protected by DDoS Protection. In this scenario, the firewall in the hub helps control the ingress traffic from the internet, while the firewall's public IP is being protected. Azure DDoS Protection also protects the public IP of the bastion.
129
129
130
130
DDoS Protection is designed for services that are deployed in a virtual network. For more information, see [Deploy dedicated Azure service into virtual networks](../virtual-network/virtual-network-for-azure-services.md#services-that-can-be-deployed-into-a-virtual-network).
Copy file name to clipboardExpand all lines: articles/ddos-protection/ddos-protection-sku-comparison.md
+3-3Lines changed: 3 additions & 3 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -5,7 +5,7 @@ author: AbdullahBell
5
5
ms.author: Abell
6
6
ms.service: azure-ddos-protection
7
7
ms.topic: concept-article
8
-
ms.date: 11/20/2024
8
+
ms.date: 03/17/2025
9
9
ms.custom: template-concept
10
10
---
11
11
@@ -42,13 +42,13 @@ The following table shows features and corresponding tiers.
42
42
| Price | Per protected IP | Per 100 protected IP addresses |
43
43
44
44
> [!NOTE]
45
-
> At no additional cost, Azure DDoS infrastructure protection protects every Azure service that uses public IPv4 and IPv6 addresses. This DDoS protection service helps to protect all Azure services, including platform as a service (PaaS) services such as Azure DNS. For more information on supported PaaS services, see [DDoS Protection reference architectures](ddos-protection-reference-architectures.md). Azure DDoS infrastructure protection requires no user configuration or application changes. Azure provides continuous protection against DDoS attacks. DDoS protection does not store customer data.
45
+
> At no additional cost, Azure DDoS infrastructure protection protects every Azure service that uses public IPv4 and IPv6 addresses. This DDoS protection service helps to protect all Azure services, including platform as a service (PaaS) services such as Azure DNS. For more information on supported PaaS services, see [DDoS Protection reference architectures](ddos-protection-reference-architectures.md). Azure DDoS infrastructure protection requires no user configuration or application changes. Azure provides continuous protection against DDoS attacks. DDoS protection doesn't store customer data.
46
46
47
47
## Limitations
48
48
49
49
DDoS Network Protection and DDoS IP Protection have the following limitations:
50
50
51
-
- PaaS services (multi-tenant), which includes Azure App Service Environment for Power Apps, Azure API Management in deployment modes other than APIM with virtual network integration, and Azure Virtual WAN aren't currently supported. For more information, see [Azure DDoS Protection APIM in VNET Integration](https://techcommunity.microsoft.com/t5/azure-network-security-blog/azure-ddos-standard-protection-now-supports-apim-in-vnet/ba-p/3641671)
51
+
- PaaS services (multitenant), which includes Azure App Service Environment for Power Apps, Azure API Management in deployment modes other than APIM with virtual network integration, and Azure Virtual WAN aren't currently supported. For more information, see [Azure DDoS Protection APIM in VNET Integration](https://techcommunity.microsoft.com/t5/azure-network-security-blog/azure-ddos-standard-protection-now-supports-apim-in-vnet/ba-p/3641671)
52
52
- Protecting a public IP resource attached to a NAT Gateway isn't supported.
53
53
- Virtual machines in Classic/RDFE deployments aren't supported.
54
54
- VPN gateway or Virtual network gateway is protected by a DDoS policy. Adaptive tuning isn't supported at this stage.
0 commit comments