Configure DDoS Protection on a virtual network using the Azure portal

Being responsible for Exceedlabs’s Network Security team, you are going to run a mock DDoS attack on the virtual network. The following steps walk you through creating a virtual network, configuring DDoS Protection, and creating an attack which you can observe and monitor with the help of telemetry and metrics.

In this lab, you will:

• Task 1: Create a resource group
• Task 2: Create a DDoS Protection plan
• Task 3: Enable DDoS Protection on a new virtual network
• Task 4: Configure DDoS telemetry
• Task 5: Configure DDoS diagnostic logs
• Task 6: Configure DDoS alerts
• Task 7: Submit a DDoS service request to run a DDoS attack

Task 1: Create a resource group

• Log in to your Azure account.
• On the Azure portal home page, select Resource groups.
• Select Create.
• On the Basics tab, in Resource group, enter ExceedlabsResourceGroup.
• In Region, select East US.
• Select Review + create.
• Select Create.

Task 2: Create a DDoS Protection plan

• On the Azure portal home page, in the search box type DDoS and select DDoS protection plan when it appears.

• Select + Create.
• On the Basics tab, in the Resource group list, select the resource group you just created.

In the Instance name box, type MyDdoSProtectionPlan, then select Review + create.

• Select Create.

Task 3: Enable DDoS Protection on a new virtual network

Here you will enable DDoS on a new virtual network rather than on an existing one, so first you need to create the new virtual network, then enable DDoS protection on it using the plan you created previously.

• On the Azure portal home page, select Create a resource, then in the search box, type Virtual Network, then select Virtual Network when it appears.
• On the Virtual Network page, select Create.
• On the Basics tab, select the resource group you created previously.
• In the Name box, type MyVirtualNetwork, then click the Security tab.

• On the Security tab, next to DDoS Protection Standard, select Enable.
• In the DDoS protection plan drop-down list, select MyDdosProtectionPlan.

Click Review + create.

• Click Create.

Task 4: Configure DDoS telemetry

You create a Public IP address, and then set up telemetry in the next steps.

• On the Azure portal home page, select Create a resource, then in the search box, type public ip, then click Public IP address when it appears.
• On the Public IP address page, click Create.

• On the Create public IP address page, under SKU, select Basic.
• In the Name box, type MyPublicIPAddress.
• Under IP address assignment, select Static.
• In DNS name label, type mypublicdnsmn12022022 (where xx is your initials to make this unique).
• Select your resource group from the list.

• Click Create.
• On the Azure home page, click All resources.
• In the list of your resources, click MyDdosProtectionPlan.
• Under Monitoring, select Metrics.
• Select the Scope box, then select the checkbox next to MyPublicIPAddress.

Click Apply.

• In the Metrics box, select Inbound packets dropped DDoS.
• In the Aggregation box, select Max.

Task 5: Configure DDoS diagnostic logs

• On the Azure home page, click All resources.
• In the list of your resources, click MyPublicIPAddress.
• Under Monitoring, select Diagnostic settings.

• Click Add diagnostic setting.
• On the Diagnostic setting page, in the Diagnostic setting name box, type MyDiagnosticSetting.
• Under Category details, select all 3 log checkboxes and the AllMetrics checkbox.
• Under Destination details, select the Send to Log Analytics workspace checkbox. Here, you could select a pre-existing Log Analytics workspace, but as you haven’t set up a destination for the diagnostic logs yet, you will just enter the settings, but then discard them in the next step in this lab.

• Normally you would now click Save to save your diagnostic settings. Note that this option is still grayed out as we cannot complete the setting configuration yet.
• Click Discard, then click Yes.

Task 6: Configure DDoS alerts

In this step you will create a virtual machine, assign a public IP address to it, and then configure DDoS alerts.

Create the VM

• On the Azure portal home page, select Create a resource, then in the search box, type virtual machine, then click Virtual machine when it appears.
• On the Virtual machine page, click Create.
• On the Basics tab, create a new VM using the information in the table below.

Setting	Value
Subscription	Select your subscription
Resource group	ExceedlabsResourceGroup
Virtual machine name	MyVirtualMachine
Region	Your region
Availability options	No infrastructure redundancy required
Image	Ubuntu Server 18.04 LTS – Gen 1 (Select Configure VM Generation link if needed)
Size	Select See all sizes, then choose B1ls in the list and choose Select (Standard_B1ls – 1 vcpu, 0.5 GiB memory
Authentication type	SSH public key
Username	azureuser
SSH public key source	Generate new key pair
Key pair name	myvirtualmachine-ssh-key

• Click Review + create.

• Click Create.
• In the Generate new key pair dialog box, click Download private key and create resource.

• Save the private key.
• When deployment is complete, click Go to resource.

Assign the Public IP address

• On the Overview page of the new virtual machine, under Settings, click Networking.
• Next to Network Interface, click myvirtualmachine-nic.
• Under Settings, click IP configurations.
• Select ipconfig1.
• In the Public IP address list, select MyPublicIPAddress.
• Click Save.

Configure DDoS alerts

• On the Azure home page, click All resources.
• In the list of your resources, click MyDdosProtectionPlan.
• Under Monitoring, select Alerts.
• Click New alert rule.

• On the Create alert rule page, under Scope, click Edit resource.
• In the Select a resource pane, in the Filter by resource type box, scroll down the list and select Public IP addresses.

• In the Resource list, select MyPublicIPAddress, then click Done.
• On the Create alert rule page, under Condition, click Add condition.

Select Under DDoS attack or not.

• In the Operator box select Greater than or equal to.
• In Threshold value, enter 1 (means under attack).
• Click Done

Back on the Create alert rule page, scroll down to the Alert rule details section and in Alert rule name, enter MyDdosAlert.

Click Create alert rule.

Task 7: Submit a DDoS service request to run a DDoS attack

• Create an account with BreakingPoint Cloud
• Set up your DDoS test as per the settings in the screenshot below (you may need to select the 100k pps test size with the trial account), but specifying the IP address of your own MyPublicIPAddress resource in the Target IP Address box (e.g., 10.90.186.108) 

• On the Azure portal home page, click All resources.
• In the resources list, click your MyPublicIPAddress resource, then under Monitoring, click Metrics.
• In the Metric box, select Under DDoS attack or not from the list.
• And here you can see DDoS attack as it happened. Note it may take the full 10 minutes before you see the results.

Congratulations! You have configured and tested DDoS Protection on a virtual network.

Reminder: Don’t forget to delete or shutdown all unused Azure resources after your labs for cost saving