Enable Distributed Denial of Service DDoS Protection

• An attacker targets a specific victim—such as a website or an email server.
• The attacker harnesses numerous compromised devices (botnets) to generate a flood of requests.
• The inundated traffic prevents legitimate users from accessing the service.

​

Azure DDoS Protection Offerings

1. DDoS IP Protection
   This pay-per-protected IP model secures each public IP address individually. Key features include:
   • Mitigation policies tailored to your application needs
   • Detailed mitigation reports, metrics, alerts, and flow logs
   • Integration with Microsoft Sentinel for enhanced monitoring

2. DDoS Network Protection
   Charged per 100 protected IP addresses, this plan dynamically adjusts to safeguard all resources within your virtual network. It protects IPv4 and IPv6 addresses across various resources, such as virtual network interfaces, application gateways, and load balancers. Benefits include:
   • Rapid response support during DDoS attacks
   • Cost protection from unexpected financial impacts
   • Discounts on Web Application Firewall (WAF) usage for additional layers of security

​

Key Differences Between Protection Plans

• DDoS IP Protection: Provides per-IP protection ideal for a limited number of resources with standard public IP addresses.
• DDoS Network Protection: Offers comprehensive protection for multiple resources, including Basic Tier public IPs, making it the better option for environments with extensive internet exposure.

​

Enabling DDoS Protection in Azure

​

Step 1: Creating a Public IP Address

1. In the Azure portal, click on “Create public IP address.”
2. Fill out the required details (e.g., set Resource Group to rgprod and Name to PIP-demo).
3. Ensure that the SKU is set to “Standard.”
4. Click on “Review and create,” then “Create.”

​

Step 2: Configuring DDoS Protection for the Public IP

1. Within the public IP resource page, click on “Protect IP address.”
2. A notice will display that the public IP is not yet connected to any backend resource.
3. Choose from three available options:
   • Inherit the DDoS Protection from an existing plan applied to the associated virtual network.
   • Apply a dedicated DDoS Protection plan for this specific IP.
   • Create a DDoS Protection Plan to cover all resources across your subscriptions.

​

Step 3: Creating a DDoS Protection Plan

1. In the Azure portal, search for “DDoS” and select “DDoS Protection Plan.”
2. Click “Create” and provide the required details:
   • Resource Group: Use an existing resource group or create a new one.
   • Name: For example, “DDoS Plan East US.”
3. Once the plan is deployed, you can link various resources (public IP addresses, virtual network interfaces, application gateways, load balancers, etc.) across subscriptions and resource groups to this single plan. Note that each plan supports up to 100 protected IPs—additional IPs may incur extra costs.

​

Choosing Between Per IP and DDoS Protection Plans

• Use the per IP plan if you need to secure one or two public-facing IP addresses.
• Select the DDoS Protection Plan when you have multiple IP addresses or resources (such as virtual networks, firewalls, and load balancers) that require comprehensive protection. Although the network plan involves slightly higher costs, it delivers extensive coverage for your entire infrastructure.