PaaS Bicep Azure Networking

Building Resilient Networks with Azure Networking Services Part 4: Implementing DDoS Protection

Resilient Networking in Azure - VNet Protection

Introduction

Distributed denial-of-service (DDoS) attacks have become increasingly sophisticated and pose a serious risk to the availability of online services. High-traffic events—whether driven by legitimate demand or malicious intent—can overwhelm network resources if not properly mitigated. Azure DDoS Protection Standard offers an enhanced defense mechanism by continuously monitoring traffic patterns, automatically applying mitigation strategies, and integrating seamlessly with Azure Monitor for alerting and analysis.

In this post, we’ll explore how to deploy and configure Azure DDoS Protection Standard using both the Azure Portal and Bicep templates. By leveraging these tools, you can preemptively protect your resources and ensure the uninterrupted availability of your applications and services.

Implementing DDoS Protection Using the Azure Portal

Step 1: Create a DDoS Protection Plan

  1. Sign in to the Azure Portal.
  2. Click on Create a resource and in the search box, type DDoS Protection Plan.
  3. Select DDoS Protection Plan from the results and click Create.
  4. In the Basics tab:
    • Name: Enter a unique name (e.g., MyDdosPlan).
    • Subscription and Resource Group: Choose your subscription and either select an existing resource group or create a new one.
    • Region: Select the region where you manage your network resources.
  5. Click Review + create after filling in the required fields and then Create once validation passes.

Step 2: Associate the DDoS Protection Plan with a Virtual Network

  1. Navigate to your existing Virtual Network resource.
  2. In the Settings section, select DDoS protection.
  3. Choose Configure and set DDoS Protection to Standard.
  4. Select the DDoS Protection Plan you created (e.g., MyDdosPlan).
  5. Click Save to associate the plan with your Virtual Network.

By enabling DDoS Protection Standard and associating it with your Virtual Network, your resources benefit from automatic traffic monitoring, mitigation strategies, and enhanced alerts during potential attacks.

Implementing DDoS Protection Using Bicep

For automated, repeatable deployments, the following Bicep template creates a DDoS Protection Plan and associates it with an existing Virtual Network.

Bicep Template: DDoS Protection Deployment 

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30

// Parameters for DDoS Protection setup
@description('Name of the DDoS Protection Plan')
param ddosPlanName string = 'MyDdosProtectionPlan'

@description('Location for all resources')
param location string = resourceGroup().location

@description('Name of the Virtual Network')
param vnetName string = 'MySecureVNet'

// Deploy the DDoS Protection Plan
resource ddosPlan 'Microsoft.Network/ddosProtectionPlans@2024-05-01' = {
  name: ddosPlanName
  location: location
}

// Reference the existing Virtual Network
resource vnet 'Microsoft.Network/virtualNetworks@2024-05-01' existing = {
  name: vnetName
}

// Associate the DDoS Protection Plan with the Virtual Network
resource vnetUpdate 'Microsoft.Network/virtualNetworks@2024-05-01' = {
  name: vnet.name
  properties: {
    ddosProtectionPlan: {
      id: ddosPlan.id
    }
  }
}

Deployment Instructions

  1. Save the Template:
    Save the above code as ddosProtectionDeployment.bicep.

  2. Deploy via Azure CLI: Open your terminal, log in, and execute the deployment command:

    1
2
3
4

    az login
az deployment group create \
  --resource-group MyResourceGroup \
  --template-file ddosProtectionDeployment.bicep

This Bicep template automates the process of creating a DDoS Protection Plan and associating it with your Virtual Network, ensuring that your infrastructure is protected against DDoS attacks as soon as it is deployed.

Conclusion

Ensuring service availability in the face of escalating DDoS threats is essential for modern network resilience. Azure DDoS Protection Standard provides an effective, automatic defense against such attacks, allowing you to maintain the performance and reliability of your services. Whether you utilize the Azure Portal for a guided setup or employ Bicep for automated deployments, integrating DDoS Protection is a proactive step toward securing your network environment.

By implementing these solutions, you fortify your infrastructure against volatile network conditions and unexpected surges in traffic, safeguarding critical applications and ensuring business continuity.

Learn More