Loading...

Guarding the Gates: Exploring Supported Scenarios for Azure DDoS Protection and Public IP Prefixes

Guarding the Gates: Exploring Supported Scenarios for Azure DDoS Protection and Public IP Prefixes

Introduction

In the face of an ever-evolving digital landscape, businesses are constantly under the threat of Distributed Denial of Service (DDoS) attacks. These relentless assaults have the potential to overwhelm network resources, disrupt services, compromise sensitive data, and lead to significant financial losses. As these threats become increasingly common, the need for a robust defense mechanism has never been more critical.

 

In this blog post we are showing you the scenarios where Azure DDoS Protection can help protect Public IP Prefixes from these attacks.

 

What is Azure DDoS Protection?

Azure DDoS Protection is a cloud-based service provided by Microsoft Azure that provides automatic detection and mitigation of DDoS attacks for Azure resources. Key features and benefits of Azure DDoS Protection include:

  • Adaptive tuning of the DDoS mitigation policy thresholds based on the traffic patterns and characteristics of each application.
  • Automatic detection and mitigation of DDoS attacks without requiring any user intervention or configuration changes.
  • Detailed monitoring and reporting of DDoS attack incidents and mitigation actions.

 

Azure DDoS Protection protects resources using Public IPs and Public IP Prefixes in ARM based VNETs, such as:

 

  • IaaS Virtual Machines
  • Load Balancers
  • Application Gateway (including WAF)
  • Azure Firewall
  • Bastion
  • VPN Gateway
  • IaaS based Network Virtual Appliance (NVA)
  • Others as described here

 

What is Public IP Prefix?

A public IP address prefix is a reserved range of public IP addresses in Azure. Public IP prefixes are assigned from a pool of addresses in each Azure region. You create a public IP address prefix in an Azure region and subscription by specifying a name and prefix size. The prefix size is the number of addresses available for use. Public IP address prefixes consist of IPv4 or IPv6 addresses. In regions with Availability Zones, Public IP address prefixes can be created as zone-redundant or associated with a specific availability zone. After the public IP prefix is created, you can create public IP addresses. A Public IP Prefix can be used in different scenarios as described here.

 

Protecting Public IP Prefixes from DDoS attacks

Upon the creation and assignment of a Public IP Prefix to a resource, it becomes exposed and potentially susceptible to DDoS attacks. To prevent these attacks from disrupting services or rendering applications unresponsive, the use of Azure DDoS Protection is highly recommended. However, it is important to know what to expect when you are protecting a Public IP Prefix. Below you will find the supported scenarios using a PIP from a Prefix and a Public IP Prefix.

 

PIP from a Public IP Prefix:

gusmodena_0-1709735986087.png

 

Public IP Prefix:

gusmodena_1-1709736046817.png

 

The only SKU available to protect an IP Prefix is DDoS Network Protection. Once the DDoS protection plan is enabled at VNET level the IP Prefix attached to a resource in the same VNET is protected. Next, we need to create a Diagnostic Setting, enabling all 3 DDoS log categories, so we can get visibility of attacks when they occur.

 

gusmodena_1-1709735762721.png

 

Through the IP Prefix Metrics blade, we can also gain visibility of all the DDoS metrics such as “Inbound TCP packets to trigger DDoS mitigation”, “Under DDoS attack or not”, and others.

 

gusmodena_2-1709735803495.png

 

Conclusion

The digital landscape is fraught with threats, and DDoS attacks are among the most disruptive. The exposure of Azure resources using Public IPs and Public IP Prefixes can make them vulnerable to such attacks. However, with Azure DDoS Protection, organizations can fortify their defenses, ensuring the continuity of services and the responsiveness of applications keeping in mind each scenario discussed in this blog.

 

Resources

Published on:

Learn more
Azure Network Security Blog articles
Azure Network Security Blog articles

Azure Network Security Blog articles

Share post:

Related posts

Microsoft Azure: You’re not eligible for an Azure free account

Got the below message, while trying to setup the Microsoft Azure Trial for 30 days. You’re not eligible for an Azure free account Don...

19 hours ago

How to create Microsoft Azure 30 days trial?

Microsoft Azure is a comprehensive cloud computing platform developed by Microsoft. It provides a wide range of cloud services, including comp...

1 day ago

Azure SDK Release (April 2025)

Azure SDK releases every month. In this post, you find this month's highlights and release notes. The post Azure SDK Release (April 2025) appe...

2 days ago

Getting Started with Azure Cosmos DB Using the Python SDK

If you’re new to Azure Cosmos DB and looking to build applications with Python, you’re in the right place. I’ve created a four-par...

2 days ago

Azure Developer CLI (azd) in a real-life scenario

This post shares some useful tips and lessons learned while using azd during a migration. The post Azure Developer CLI (azd) in a real-life sc...

3 days ago

Webinar: Translate Dynamics 365 Data in Real-Time using Azure AI Translator with our New App!

Is your business operating across multiple regions? Managing multilingual CRM data in Microsoft Dynamics 365 can lead to communication gaps, d...

3 days ago
Stay up to date with latest Microsoft Dynamics 365 and Power Platform news!
* Yes, I agree to the privacy policy