Anti DDoS Tunnel for Networks

Any Network that has its own AS number located anywhere in the world.

Avoids upstream congestion which results in 'quality degradation' events by filtering attacks up to 1 Tbps.
Protect the investment in your dedicated DDoS hardware by dramatically enhancing your capacity to absorb attacks.
Use the tunnel as main mitigation tool, including Layer 7 against HTTPS and HTTP bot attacks.

The Anti-DDoS Tunnel is a standard GRE or L2TP tunnel established over public Internet between your edge routers and our infrastructure. Inside the tunnel, a BGP session is setup to allow you to control which prefixes will be advertised in Internet via our network. It works like any other upstream connection, but instead of a physical wire, a tunnel is used.
When an attack starts, inbound traffic is automatically captured simultaneously in all our many DDoS scrubbing centers around the globe from where it is sent through the tunnel to you. It has an option configurable per IP to not do reverse proxy or similar ('layer7 protection off'). It also allows to upload certificates for HTTPS services.
To work, you either advertise a more specific prefix (e.g. /24) through the tunnel, either you prepend or stop advertising the prefix to your regular upstream providers. We recommend to permanently advertise the high-risk prefixes (those that are frequently attacked) through tunnel.
Filters are asymmetric, which means you can send the outbound traffic through your regular upstream providers.
For full redundancy, we recommend ordering a second Anti-DDoS Tunnel for Occasional Use that would be delivered from a different equipment or datacenter. Alternatively, you can also choose to request a second tunnel on top of the same service, although this would make the service redundant at your end only.