1

Purely hypothetical here, but I have been dealing with (accidental) DDoS attacks on one of our web servers in the recent past, and was always curious what would happen if you completely opened the flood gates.

Obviously, anything hosted on that particular web server instance would come to a grinding halt, and our best bet to (relatively) quickly mitigate the issue would be to completely kill the app service plan, and roll up a new one from scratch (making absolutely sure it didn't end up with the same IP address).

Aside from that, what would be a good way to mitigate an "attack" like this, particularly in an Azure App Service environment? Would you be able to inspect the appropriate headers and dump the traffic prior to the web server handling the request? Is this something that can be handled by Traffic Manager?

I know Azure has some built-in DDoS prevention, but I think something like this scenario would be nearly impossible to mitigate, as the traffic will be coming from everywhere.

Thanks in advance!

4

1 回答 1

0

对于第 7 层(HTTP/HTTPS);您可以在 Web 应用程序防火墙 (WAF) 模式下配置 Azure 应用程序网关 - 将所有流量路由到您的应用服务环境。对于 L3/L4 保护,您可以在应用程序网关的虚拟网络上配置 Azure DDoS 保护标准服务。进一步在 Web 应用程序设置中确保仅通过应用程序网关 IP 接受流量。

于 2017-12-13T00:35:27.103 回答