Huawei AntiDDoS8000 DDoS Protection SystemTerabit-level Capacity, Second-level Response, Precise Protection, Value-added Operation

Product Appearances

As the Internet and IoT thrive, DDoS attacks are developing new characteristics:

• Attacksareincreasingbothintermsoffrequencyandtrafficvolume,withpeakattacktrafficupto1.7

Tbit/sin2018.

• Reflectionamplificationattacksspreadacrosstheworld,congestinglinks.

• Low-rateapplication-layerattackstargetpreciselyatservicesystemslikee-financeorgaming.

Reflectionamplificationandlow-rateapplication-layerattacksaregainingmomentum,andlayereddefense

becomesthefirstchoice inanti-DDoS.HuaweiAntiDDoS8000employsbigdataanalysis toconduct

modelingfor60+typesoftraffic,offeringTerabit-levelprotection,second-levelresponse,andcomprehensive

defenseagainst100+typesofattacks. ItworkswithHuaweicloudcleaningcentertodeliver layered

cleaning,providingfull-fledgedprotectionthatcoversnetworklinkbandwidthsandonlineservices.

AntiDDoS8030 AntiDDoS8080 AntiDDoS8160

Solution Function

Defense against high-volume DDoS attacks

• Multi-core distributed architecture and big data-based intelligent protection engine to offer Terabit-level

protectionperformance.

• Second-levelattackresponsetorapidlyblockattacktraffic.

Defense against application-layer DDoS attacks

• Collectionofalltraffic,Layer3~7per-packetanalysis,andmodelingfor60+typesofnetworktrafficto

providethemostpreciseandcomprehensiveattackdetection.

• All-round reputation system of local session behavior reputation, location reputation, and Botnet IP

reputation to precisely defend against application-layer DDoS attacks launched from Botnets, reducing

falsepositivesandimprovinguserexperience.

• Comprehensivedefenseagainst100+typesofattackstoprotectkeyservicesystems,suchasWeb,DNS,

DHCP,andVoIP.

Anti-DDoS operation

• Tenant-specificautomaticandmanualdefensepoliciesforcomprehensiveprotection.

• Tenant-specificreportstatisticsandreportsendingviaemailtosimplifymanagement.

• Differentiatedoperationfor100,000tenants.

Dual-stack (IPv4/IPv6) DDoS attack defense

• Defenseagainstdual-stack(IPv4/IPv6)DDoSattacks.

On-premise + Cloud layered anti-DDoS

• Theon-premisedeviceisonlineinrealtimetoprotectuserservices.

• Whena link iscongested, theon-premisedevicecanautomaticallysendcloudsignals tostartcloud

cleaningandprotectuserlinks.

• 2Tbps+cloudmitigationcapacity.10+cloudscrubbingcenterwithglobal scheduling.Minute-level

defenseresponse.

Typical Scenarios

Scenario 1: MAN Attack Defense

Ametropolitanareanetwork (MAN)providesaplatformonwhichcomprehensiveservicesofacityare

transmitted.MANsoftenapplyto largeandmedium-sizedcities.TheMANsprovidecommonandpublic

network architecture and allow data, voice, images, and videos to be effectively transmitted at high speeds,

meetingchangeableInternetapplicationrequirements.

Onthenetworkshown inabovefigure,anetflowdetectiondevicecollects the logsfromrouters inreal

timetodeterminewhetherthetrafficinthenetworkisabnormal.Whentrafficisabnormal,cleaningdevice

isnotifiedtostartthecleaning.Thecleaningdevice isattachedtothecorerouterRouter1tocleantraffic

destinedfortheZone.Aftercleaningtraffic,thecleaningdeviceinjectsnormaltrafficbacktotheoriginallink

inMPLSLSPinjectionmode.Router2thenforwardsthetraffictotheZone.

Thecleaningdevice isdirectlyconnectedtoRouter1onlythroughone interface.Traffic isdivertedtothe

cleaningdevicethroughthemaininterface,whileinjectedbackthroughasub-interface.Thetrafficcanalso

beinjectedbackthroughanotherinterfaceifthereareenoughinterfaces.

Scenario 2: Data Center Protection and Managed Security Service

AnInternetDataCenter(IDC)isapartofbasicnetworkresources.Itprovideslarge-scale,high-quality,secure,

and reliable data transmission services and high-speed access services for Internet content providers, enterprises,

media,andeachtypesofwebsites.TheIDCprovidesDNSservers,Webservers,gameservers,andotherservices.

Inrecentyears,moreandmoreInternet-initiatedDDoSattackstargetIDCs.Asaresult, importantserversare

attacked;datacenterlinkbandwidthisoccupied;videosandgamesarecompromisedbyapplication-layerattacks.

Cleaning device

Switch

Netflow

Legitimate PC Legitimate PC

Botnet

ATICManagement center

RegionalNetwork

RegionalNetwork

BackboneNetwork

Router2

Router1

Attackedtarget

Legitimate traffic

Attack traffic

Netflow traffic

Management traffic

Onthenetworkshowninabovefigure,acleaningdevice isattachedtothecorerouter1androuter2to

detectandcleanthetrafficdestinedfortheZone.Thetrafficmustbedivertedtothecleaningdeviceusing

BGPinrealtime.Aftertrafficiscleaned,normaltrafficisinjectedbacktotheoriginallinkthroughPBRand

finallyforwardedtotheZone.

ATICmanagementcentersupportsmanagedsecurityservice.ATICmanagementcentercanbeconfigured

withcustomizeddefensepoliciesbasedon the tenant's service features.Whenattackhappened,ATIC

management center can initiate automatic protection and send alarm information by email or other

methods.Datacenteroperatorscandesignbusinessmodelsbasedontenantsandexpandbusinessrevenue.

Defense against the following protocol anomaly attacks:

Land,Fraggle,Smurf,WinNuke,PingofDeath,Teardrop,

andTCPerrorflagattacks

DNSapplicationprotectionagainstthefollowingattacks:

• DNSqueryflood,DNSreplyflood,andDNSspoofing

• Source rate limiting and domain name rate limiting

Defense against the following network attacks:

SYNflood,ACKflood,FIN flood,RST flood,TCP

fragment flood, UDP flood, UDP fragment flood, IP

flood,ICMPflood,TCPconnectionflood,sockstress,

TCP retransmission, and TCP empty connection attacks

SIP application protection against the following attacks:

SIP flood and SIP method flood attacks, including

registerflood,deregistrationflood,authenticationflood,

andcallfloodattacks

Source rate limiting

Specifications

DDoS Defense Specifications

Attack TargetNormal traffic

Attack traffic

Split traffic

Management traffic

Normalnetwork

Opticalspliter

Detecting device

Cleaningdevice

ATIC managementcenter

DCInternet

access area

SwitchRouter1

Router2

Firewall

Core switch

gameZone dnsZone

webZone

Game server Web server DNS server

Botner

Management functions:

• Account management and permission allocation

• Defensepolicyconfigurationandreportsbasedon

Zones(tenants),atascaleofupto100,000Zones

• Device performance monitoring

• Source tracing and fingerprint extraction by

capturing packets

• Email, short message, and audio alarms

• Log dumping

• Dynamic baseline learning

• Policy interworking and log interworking APIs

Report functions:

• Trafficcomparisonbeforeandaftercleaning

• TopNtrafficstatistics

• Application-layertrafficcomparisonanddistribution

• Protocol distribution

• Trafficstatisticsbasedonthesourcelocation

• Attack event details

• TopNattackevents(bydurationornumberofpackets)

• Distribution of attacks by category

• Attacktraffictrends

• DNSresolutionsuccessratio

• TopNtrafficstatistics for theapplication layer

(bysourceIPaddress,HTTPURI,HTTPHOST,and

domain name)

• DownloadingofreportsinHTML,PDF,orExcelformat

• Report pushing via email

Management and Report

DefenseagainstthefollowingUDP-basedreflection

andamplificationattacks:

NTP,DNS,SSDP,Chargen,TFTP,SNMP,NetBIOS,

QOTD,QuakeNetwork Protocol, Portmapper,

MicrosoftSQLResolutionService,RIPv1,andSteam

Protocolreflectionandamplificationattacks

Filters:

IP,TCP,UDP,ICMP,DNS,SIP,andHTTPpacketfilters

Location-basedfiltering:

Traffic isblockedor limitedbasedonthe location

ofthesourceIPaddress.

Attack signature databases:

RUDY, slowhttptest, slowloris, LOIC, AnonCannon,

RefRef,ApacheKill,andApacheBenchattacksignature

databases, which are updated automatically each

week

Webapplicationprotectionagainst thefollowing

attacks:

• HTTPGet flood,HTTPPost flood,HTTP slow

header, HTTP slow post, HTTPS flood, SSL

(renegotiation) DoS/DDoS, WordPress

amplification,RUDY,andLOICattacks

• Packet validity check

IP reputation:

• Mostactive zombiesare tracked,and the IP

reputation database is updated automatically on

adailybasistoblockattacksfast.

• Localreputationrecordsareautomaticallylearned.

• The learning of local access IP reputations creates

dynamic IP reputation records based on local

service sessions, helping to forward service access

trafficquicklyandenhanceuserexperience.

Trafficdiversion:

Manual traffic diversion and automatic PBR- or

BGP-basedtrafficdiversion

Trafficinjection:

Static route,MPLSVPN,MPLSLSP,GRE tunnel,

Layer2,andPBR-basedinjection

Traffic Diversion and Injection

Model AntiDDoS8030 AntiDDoS8080 AntiDDoS8160

Interfaces and performance

Throughput Upto120Gbps Up to 960 Gbps Upto1920Gbps

Throughput/slot Upto120Gbps Up to 240 Gbps Up to 240 Gbps

Mitigation rate/slot Up to 60 Mpps Up to 60 Mpps Up to 60 Mpps

Latency 80μs 80μs 80μs

Expansion slot 3 8 16

Expansion interface

board

FW-LPUF-120,withtwo

sub-slots

FW-LPUF-120,withtwo

sub-slots

FW-LPUF-240,withtwo

sub-slots

FW-LPUF-120,withtwo

sub-slots

FW-LPUF-240,withtwo

sub-slots

Expansion card

• 24 × GE (SFP)

• 5×10GE(SFP+)

• 6×10GE(SFP+)

• 12×10GE(SFP+)

• 1×40GE(CFP)

• 1×100GE(CFP)

• 3×40GE(QSPF+)

Dimensions

Dimensions(W× D × H)

DC:442mm×650mm

×175mm(4U)

AC:442mm×650mm

×220mm(5U)

442mm×650mm×

620mm(14U)

Hardware Specifications

• Generation of daily, weekly, monthly, and yearly reports

• Self-service portal for tenants

• Creation, deletion, updating, and viewing of Zones,

and addition and deletion of protected IP addresses

• Creationanddeletionoftrafficdiversionpolicies

• Creation and deletion of blackhole routes

• TrafficandattacklogsforeachIPaddress

• Sending of logs in syslog format

442mm×650mm×

1420mm (32U)

Model AntiDDoS8030 AntiDDoS8080 AntiDDoS8160

Weight

DC:15kg(empty)or

30.7kg(fullyconfigured)

AC:25kg(empty)or

40.7kg(fullyconfigured)

43.2kg(empty)or112.9

kg(fullyconfigured)

94.4kg(empty)or233.9

kg(fullyconfigured)

Power and Environment

Power supply

Rated input voltage:

DC:-48V

AC:175Vto264V;

50/60Hz

Maximum input voltage

range:

DC:-72Vto-38V

AC:90Vto264V;

50/60Hz

Rated input voltage:

DC:-48V

AC:175Vto264V;

50/60Hz

Maximum input voltage

range:

DC:-72Vto-38V

AC:90Vto264V;

50/60Hz

Rated input voltage:

DC:-48V

AC:175Vto264V;

50/60Hz

Maximum input voltage

range:

DC:-72Vto-38V

AC:90Vto264V;

50/60Hz

Power consumption

1×FW-LPUF-120+2×

ADS-SPUC-B + 2 × ADS-

SPC-80-01:

DC:1066W(avg),

1272W(max)

AC:1185W(avg),

1414W(max)

3×FW-LPUF-240+5

×ADS-SPUD-B+10×

ADS-SPC-80-01:

DC:4025W(avg),

4823W(max)

AC:4282W(avg),

5132W(max)

6×FW-LPUF-240+9

×ADS-SPUD-B+18×

ADS-SPC-80-01:

DC:7387W(avg),

8930W(max)

AC:7858W(avg),

9500W(max)

Power redundancy

DC: Double hot-

swappable power

modules

AC: Double hot-

swappable power

modules

DC: 4 hot-swappable

PEM modules

AC:4PEMmodules+1

external AC power

chassis

DC:8hot-swappable

PEM modules

AC:8PEMmodules+2

external AC power

chassises

Operating temperature 0°Cto45°C(long-term),-5°Cto50°C(short-term)

Storage temperature -40°Cto70°C

Operating humidity5%RHto85%RH,non-condensing(long-term),5%RHto95%RH,non-

condensing (short-term)

Storage humidity 0%RHto95%RH

Certifications

SecuritycertificationsElectromagnetic compatibility (EMC)

CB,RoHS,FCC,MET,C-Tick,andVCCI

About This PublicationThispublicationisforreferenceonlyanddoesnotconstituteanycommitmentsorguarantees.Alltrademarks,pictures,logos,andbrandsmentionedinthisdocumentarethepropertyofHuaweiTechnologiesCo.,Ltd.orathirdparty.

Copyright©2018 Huawei Technologies Co., Ltd. All rights reserved.

Model Description

Main Equipment

ADS8030-BASE-DC-01 AntiDDoS8030DCBasicConfiguration(includeX3DCChassis,2*MPU)

ADS8030-BASE-AC-01 AntiDDoS8030ACBasicConfiguration(includeX3ACChassis,2*MPU)

ADS8080-BASE-DC-01AntiDDoS8080200GDCBasicConfiguration(includeX8DCChassis,

2*SRU200A,1*SFU200C)

ADS8160-BASE-DC-01AntiDDoS8160200GDCBasicConfiguration(includeX16DCChassis,

2*MPU,4*SFU200B)

Service Processing Card Module

ADS-SPUC-B AntiDDoS8030ServiceProcessingUnit(BaseBoard)

ADS-SPUD-B AntiDDoS8080&AntiDDoS8160ServiceProcessingUnit(BaseBoard)

ADS-SPC-40-00 DDoSProtectionServiceCard(with1CPU)

ADS-SPC-80-00 DDoS Protection Service Card(with 2 CPUs)

ADS-SPC-60-00 DDoSProtectionServiceCardIV(with1CPU)

ADS-SPC-120-00 DDoSProtectionServiceCardV(with2CPU)

Line Processing Card Module

FW-LPUF-120 120GLineProcessingUnit

FW-LPUF-240 240G Line Processing Unit

FW-6X10G-SFP+ 6*10GESFP+DaughterCard

FW-1X100G-CFP 1*100GECFPDaughterCard

FW-12X10G-SFP+ 12*10GESFP+DaughterCard

FW-3X40G-QSFP+ 3-Port40GBase-QSFP+FlexibleCard

E8KE-X-101-5X10GE-SFP+5-Port10GBaseLAN/WAN-SFP+FlexibleCardA(P101,1/2wide,Occupy

two sub-slots)

E8KE-X-101-24XGE-SFP24-Port100/1000Base-X-SFPFlexibleCard(P101,1/2wide,Occupytwo

sub-slots)

E8KE-X-101-1X40GE-CFP 1-Port40GBaseLANCFPFlexibleCard(P101,1/2wide,Occupytwosub-slots)

Management Software

LIC-ADS-NOFA00 ATIC Basic Feature Summary

Order Information