Skip to content

Latest commit

 

History

History
67 lines (45 loc) · 4 KB

protect-with-ddos-protection.md

File metadata and controls

67 lines (45 loc) · 4 KB
titledescriptionservicesauthorms.servicems.topicms.datems.author
Defend API Management against DDoS attacks
Learn how to protect your API Management instance in an external virtual network against volumetric and protocol DDoS attacks by using Azure DDoS Protection.
api-management
dlepow
azure-api-management
how-to
01/24/2023
danlep

Defend your Azure API Management instance against DDoS attacks

[!INCLUDE premium-dev.md]

This article shows how to defend your Azure API Management instance against distributed denial of service (DDoS) attacks by enabling Azure DDoS Protection. Azure DDoS Protection provides enhanced DDoS mitigation features to defend against volumetric and protocol DDoS attacks.​

[!INCLUDE ddos-waf-recommendation]

Supported configurations

Enabling Azure DDoS Protection for API Management is supported only for instances deployed (injected) in a VNet in external mode or internal mode.

  • External mode - All API Management endpoints are protected
  • Internal mode - Only the management endpoint accessible on port 3443 is protected

Unsupported configurations

Prerequisites

  • An API Management instance
    • The instance must be deployed in an Azure VNet in external mode or internal mode.
    • The instance must be configured with an Azure public IP address resource, which is supported only on the API Management stv2compute platform.

      [!NOTE] If the instance is hosted on the stv1 platform, you must migrate to the stv2 platform.

  • An Azure DDoS Protection plan

    • The plan you select can be in the same, or different, subscription than the virtual network and the API Management instance. If the subscriptions differ, they must be associated to the same Microsoft Entra tenant.

    • You may use a plan created using either the Network DDoS protection SKU or IP DDoS Protection SKU. See Azure DDoS Protection SKU Comparison.

      [!NOTE] Azure DDoS Protection plans incur additional charges. For more information, see Pricing.

Enable DDoS Protection

Depending on the DDoS Protection plan you use, enable DDoS protection on the virtual network used for your API Management instance, or the IP address resource configured for your virtual network.

Enable DDoS Protection on the virtual network used for your API Management instance

  1. In the Azure portal, navigate to the VNet where your API Management is injected.

  2. In the left menu, under Settings, select DDoS protection.

  3. Select Enable, and then select your DDoS protection plan.

  4. Select Save.

    :::image type="content" source="media/protect-with-ddos-protection/enable-ddos-protection.png" alt-text="Screenshot of enabling a DDoS Protection plan on a VNet in the Azure portal.":::

Enable DDoS protection on the API Management public IP address

If your plan uses the IP DDoS Protection SKU, see Enable DDoS IP Protection for a public IP address.

Related content

close