Azure DDoS Protection

A Distributed Denial of Service (DDoS) attack is a malicious attempt to disrupt normal traffic of a targeted server, service, or network by overwhelming the target or its surrounding infrastructure with a flood of Internet traffic. These attacks can be devastating: they can take an e-commerce site offline during peak shopping season, knock a gaming platform offline during a tournament, or cripple a financial institution's customer portal. The cost of downtime includes lost revenue, brand damage, and potential regulatory fines. Azure DDoS Protection is a cloud-based service that provides always-on traffic monitoring and automatic mitigation of network-layer and application-layer attacks. It is designed to protect Azure resources such as virtual machines, load balancers, and application gateways from the most common and sophisticated DDoS attacks.

Azure DDoS Protection operates at the Azure network edge, meaning it inspects traffic before it reaches your virtual network. The mechanism involves three phases: detection, mitigation, and telemetry.

Detection: Azure continuously monitors traffic patterns for your public IP addresses. It uses a set of baseline thresholds that are automatically learned based on your typical traffic profile. When traffic deviates significantly from this baseline—for example, a sudden spike in packets per second or bandwidth—the service triggers an alert.

Mitigation: Once an attack is detected, Azure DDoS Protection begins scrubbing traffic. It analyzes each packet against global threat intelligence signatures and heuristics. Malicious traffic is dropped, and only legitimate traffic is forwarded to your application. The mitigation happens automatically within minutes of detection, without any manual intervention. The service can absorb attacks up to multiple Tbps (terabits per second) by leveraging Azure's global network capacity.

Telemetry: After mitigation, you can view detailed reports through Azure Monitor and DDoS Protection Metrics. These reports show attack duration, attack type (e.g., SYN flood, UDP flood, DNS amplification), and total attack volume. This information helps you understand the threat landscape and adjust your defenses.

Azure DDoS Protection comes in two tiers:

Basic (Free): Automatically enabled for all Azure resources. It provides always-on traffic monitoring and real-time mitigation of common network-layer attacks. However, it does not provide visibility into attack traffic, and it is limited to protecting against attacks that are less than 1 Gbps. It is suitable for small-scale applications or development environments.

Standard (Paid): Offers enhanced protection for production workloads. Key features include:

Important: DDoS Protection Standard is applied at the virtual network level, not per individual VM. You create a DDoS Protection plan and associate it with one or more virtual networks.

On-premises DDoS mitigation typically requires dedicated hardware appliances (e.g., from Arbor Networks, Radware, or F5). These appliances have fixed capacity, require manual configuration, and need to be scaled by purchasing and installing additional hardware. They also represent a single point of failure if the attack overwhelms the appliance itself. In contrast, Azure DDoS Protection is elastic—it can absorb massive attacks by leveraging Azure's global network capacity. It requires no hardware procurement, no maintenance, and scales automatically. The on-premises approach also lacks the benefit of global threat intelligence that Azure collects from its massive network footprint.

Azure Portal: - Navigate to "DDoS Protection Plans" under Security in the Azure Portal. - Create a new plan, specifying a name, subscription, resource group, and location. - Associate the plan with a virtual network by going to the virtual network's "DDoS Protection" blade and selecting the plan. - View metrics and alerts under "Monitor" > "Metrics" for the virtual network.

Azure CLI:

# Create a DDoS Protection plan
az network ddos-protection create \
  --resource-group MyResourceGroup \
  --name MyDdosPlan \
  --location eastus

# Associate with a virtual network
az network vnet update \
  --resource-group MyResourceGroup \
  --name MyVNet \
  --ddos-protection true \
  --ddos-protection-plan MyDdosPlan

# List DDoS Protection plans
az network ddos-protection list

# Show metrics (example: packets per second)
az monitor metrics list \
  --resource /subscriptions/.../resourceGroups/.../providers/Microsoft.Network/virtualNetworks/MyVNet \
  --metric PacketsInDDoS

PowerShell:

# Create a DDoS Protection plan
New-AzDdosProtectionPlan -ResourceGroupName MyResourceGroup -Name MyDdosPlan -Location eastus

# Associate with a virtual network
$vnet = Get-AzVirtualNetwork -Name MyVNet -ResourceGroupName MyResourceGroup
$vnet.DdosProtectionPlan = (Get-AzDdosProtectionPlan -ResourceGroupName MyResourceGroup -Name MyDdosPlan).Id
$vnet.EnableDdosProtection = $true
Set-AzVirtualNetwork -VirtualNetwork $vnet

ARM Template (Bicep snippet):

resource ddosPlan 'Microsoft.Network/ddosProtectionPlans@2023-02-01' = {
  name: 'MyDdosPlan'
  location: resourceGroup().location
}

resource vnet 'Microsoft.Network/virtualNetworks@2023-02-01' = {
  name: 'MyVNet'
  location: resourceGroup().location
  properties: {
    ddosProtectionPlan: {
      id: ddosPlan.id
    }
    enableDdosProtection: true
    // other properties...
  }
}

A large online retailer runs its website on Azure VMs behind a load balancer. During Black Friday sales, the site experiences a massive influx of legitimate traffic. However, a competitor launches a DDoS attack using a botnet, flooding the site with SYN packets. Without Azure DDoS Protection Standard, the load balancer's CPU spikes, and the site becomes unresponsive to real customers. With DDoS Protection Standard enabled, Azure detects the abnormal traffic pattern within minutes. The service scrubs the malicious SYN flood at the network edge, allowing legitimate shopping traffic to pass through. The retailer sees no downtime and continues to process orders. The cost of the DDoS Protection plan (~$3,000/month) is negligible compared to the revenue loss of even an hour of downtime. The team configures alerts to notify the security operations center (SOC) during the attack, and after the event, they use the DDoS Protection report to analyze the attack and adjust their WAF rules for future protection.

A gaming company deploys its multiplayer game servers on Azure virtual machines with public IPs. During the launch week, the game attracts millions of players, but also becomes a target for DDoS attacks aimed at disrupting the game experience. The company enables DDoS Protection Standard on the virtual network hosting the game servers. During an attack, Azure's global network absorbs the traffic, and the game remains playable. The company also uses Azure Application Gateway with WAF to protect against application-layer attacks like HTTP floods. The DDoS Protection plan costs $2,944 per month plus data processing, but the company considers it a necessary insurance policy. Without it, a successful attack could ruin the launch and drive players to competitors.

A bank processes transactions through an Azure-hosted API. Regulatory requirements mandate that the bank must have DDoS protection in place. The bank enables Azure DDoS Protection Standard and integrates it with Azure Security Center for continuous compliance monitoring. During a volumetric attack, the bank's security team receives automated alerts and can view real-time metrics in Azure Monitor. The attack is mitigated without impacting transaction processing. The bank also uses DDoS Protection reports for audit evidence. A common mistake is failing to associate the DDoS Protection plan with all VNets that host critical resources, leaving some endpoints unprotected. The bank mitigates this by using Azure Policy to enforce DDoS Protection Standard on all VNets.