简体繁体 English

在Windows Azure上组织DDoS保护

[英]Organizing DDoS protection on Windows Azure

原文 2012-10-23 13:23:05 3 1 azure/ nginx/ reverse-proxy/ squid/ ddos

If we have some spherical application in vacuum hosted on Microsoft Azure, that we would like to protect against DDoS attack with minimum economic impact and maximum reliability then: 如果我们在Microsoft Azure上托管的真空中有一些球形应用程序，那么我们希望以最小的经济影响和最大的可靠性来防御DDoS攻击，那么：

Is it useful to organize reverse proxy like squid or nginx as a protection level against DDoS? 组织诸如squid或nginx之类的反向代理作为针对DDoS的保护级别是否有用？
If true - does it make sense to deploy reverse proxy on Azure or as dedicated server? 如果为真-在Azure上或作为专用服务器部署反向代理是否有意义？
If we deploy proxy on Azure, should/can it be multiinstantinated and if not, won't it become a bottleneck? 如果我们在Azure上部署代理，是否应该/可以将其实例化？如果不是，它是否会成为瓶颈？
If false - what measures can be appplied to effective respond on ddos attack real time, except scaling out by throwing more instances to keep up with traffic surge and relying on Azure's Load Balancer? 如果为假-除了抛出更多实例以跟上流量激增并依靠Azure的负载均衡器进行扩展以外，可以采取什么措施对ddos攻击进行实时有效响应？

1 个解决方案

The Microsoft Datacenters that host Windows Azure already have protections for items such as DDoS attacks. 托管Windows Azure的Microsoft数据中心已经对DDoS攻击等项目提供了保护。 That said, it is still up to you to monitor your application for unexpected and potentially invalid spikes in traffic and to react accordingly. 也就是说，仍然需要您监视应用程序是否出现意外的和潜在的无效峰值流量，并做出相应的响应。 This can be scaling up your capacity to handle the load using multiple service instances, or by submitted support tickets to have the invalid traffic blocked by MSFT's datacenter protections. 这可以扩大您使用多个服务实例或通过提交的支持票证处理负载的能力，以使无效流量受到MSFT数据中心保护的阻止。