Azure DDoS Protection Standard mitigates distributed denial-of-service attacks against public IP addresses associated with a virtual network. It helps keep public-facing applications available and can limit unwanted autoscaling costs during attack traffic. section 3.4 section 3.4.1
The service distinguishes usual traffic from potentially malicious traffic with thresholds for inbound SYN, TCP, and UDP packets. Standard sets thresholds dynamically from each public IP address’s observed traffic pattern; suspected malicious traffic is analyzed and dropped, while legitimate traffic is inspected but allowed through. section 3.4.1 section 3.7
Deploy Standard through a DDoS Protection plan:
- Create a plan by supplying its resource group and name. section 3.4.2
- Associate the plan with the VNet containing the public IP addresses to protect. section 3.4.2
- Validate the plan and VNet association; use logs and metrics for further attack analysis and threshold behavior. section 3.4.2
Create and attach a plan
Use Azure CLI to create MyDdosProtectionPlan in MyResourceGroup, then update that plan with --vnets MyVnet. A successful result lists the associated virtual network under virtualNetworks. section 3.4.2
The command shows the two required creation inputs: the resource group that holds the plan and the plan name. section 3.4.2
