Infrastructure DDOS Protection
With Generic Routing Encapsulation (GRE) tunneling and leveraging Border Gateway Protocol (BGP) routing, infrastructure protection is an on-demand security service that safeguards critical network infrastructure from volumetric and protocol-based DDOS attacks, such as UDP, SMTP or SYN Floods, executed directly or via DNS/NTP amplification. Infrastructure protection complements Incapsula’s other CDN-based services to provide web ops with a comprehensive solution that complete protection from all DDOS threats.
- Complete DDOS protection for all types of services (UDP/TCP, SMTP, FTP, SSH, VoIP, etc.)
- GRE tunneling for smooth on-demand onboarding
- DDOS protection for entire subnets or Individual IP addresses
- Complete protection against direct-to-IP DDOS attacks
- Enabled by Incapsula’s Behemoth scrubbing servers
How It Works
Infrastructure Protection for Subnets
Infrastructure protection helps you protect all elements of your critical infrastructure (e.g., web, email, FTP) across entire subnet ranges.
In the event of an attack, traffic is rerouted through Incapsula’s scrubbing centers using BGP announcements. From that point on, Incapsula acts as the “ISP” and advertises all protected IP range announcements.
All incoming network traffic is inspected and filtered, and only legitimate traffic is securely forwarded to the enterprise network via GRE tunneling.
Infrastructure Protection for Individual IP Addresses
Individual IP address protection is ideal for gaming servers and SaaS applications, which have high-traffic, critical non-HTTP assets with low IP counts, as well as cloud deployments looking for direct-to-IP attack prevention.
Using this unique deployment model, Incapsula brings the benefits of infrastructure protection to customers who do not have an entire Class C subnet. This feature enables smaller organizations to protect multiple service types and protocols, even for a single IP address, without using BGP routing. Customers receive a “protected IP address” from Incapsula, which inspects and filters all incoming traffic. A redundant, secure, two-way GRE tunnel is used to forward clean traffic to the origin IP and to return outbound traffic from the application to the users.
The Infrastructure Protection service is built on top of Incapsula’s global network of high-powered data centers. Route advertisements are propagated from all data centers to create a “many-to-many” defense for incoming DDOS attacks.
Quick and Easy Implementation
Protection can be enabled on-demand for entire subnets. With the GRE tunnel in place, BGP routing is used to activate and deactivate the service on-the-fly, letting you quickly and easily respond to any type of DDOS attack. Protecting individual IP addresses is fully automated as traffic is persistently routed through Incapsula, ensuring immediate DDOS protection for your network infrastructure.
Legitimate incoming traffic passing through the Incapsula network is unaltered, ensuring that source IP address visibility remains intact. At the same time, all outgoing traffic is forwarded as normal to the ISP, minimizing the chance for any impact to your regular traffic flow.
Infrastructure Protection is fully compatible with Incapsula’s web application and DNS protection services. Together these form the most robust DDOS defense offering on the market, able to deal with highly-sophisticated threats and any possible DDOS-related security scenario.