Windows Azure 是否有任何可用的方法来抵御拒绝服务攻击？
我们正在开发一个托管在 Windows Azure 中的 Web 服务。我们预计某些时候坏人会尝试对其进行 DDOS。我用谷歌搜索并没有找到任何新的和明确的内容（这个 相当模糊）关于 Windows Azure 是否具有一些抵御拒绝服务攻击的功能。
我们需要采取什么特别措施吗？ Windows Azure 提供什么来防止拒绝服务攻击？
We're developing a web service hosted in Windows Azure. We expect that at some moments bad guys try to DDOS it. I Googled and didn't find anything new and definitive (this one is rather vague) about whether Windows Azure has some features against denial of service attacks.
Do we need any special measures? What does Windows Azure offer to protect against denial of service attacks?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
Azure 负载均衡器提供了一些保护，但其详细信息尚未发布。
The Azure load balancer provides some protection, but the details of this are not published.
我认为没有一家服务提供商能够真正拥有抵御拒绝服务攻击的功能，因为说这意味着防止 DoS 攻击。唯一的方法是缓解 DoS 攻击，您可以采用多种技术。我知道 Windows Azure 可以部分缓解拒绝服务攻击，这是由于 Azure 环境中负载均衡器的性质所致。我知道可能有效的一种技术是部署一个廉价的角色实例（超小或小型），充当 Windows Azure 中实际生产角色实例（大型或超大型实例）上的实际 Web 应用程序的反向代理。要实现反向代理角色实例，只需启用 ARR，这是 IIS 中的一项功能。您可以使用启动任务来启用 ARR。这个反向代理角色实例还可能有一个规则，它检查某些指标，如果该指标超过预设阈值，它基本上只是停止接受或转发流量到实际的 Web 应用程序，或者如果实现了自动缩放，它只是停止扩展超出允许实例的最大数量。这也最大限度地减少了 DoS 攻击造成的经济影响。然后，您只需依赖 Windows Azure 如何缓解任何拒绝服务攻击，即当它检测到从一个 Windows Azure 角色实例到另一角色实例的任何攻击模式时。因为它将阻止对您的实际 Web 应用程序的任何攻击。
I reckon no one service provider could truly have a feature against denial of service attacks, because by saying that it means preventing DoS attacks. The only way is by migitating DoS attacks, which you can employ a number of techniques. I know that Windows Azure partially mitigates Denial of Service attacks, and this is due to the nature of the Load Balancer within the Azure environment. One technique that I know may work is to deploy an inexpensive role instance (Extra Small or Small)that acts as a reverse proxy to the actual web application which is sitting on the actual production role instance (Large or Extra Large instance)in Windows Azure. To implement the reverse proxy role instance, just enable ARR which is a feature within IIS. You can use startup tasks to enable ARR. This reverse proxy role instance may also have a rule in it that it checks for certain metrics, and if that metric has exceeded the preset threshold, it basically just stops accepting or forwarding the traffic onto the actual web app, or if automatic scaling is implemented, it just stops scaling beyond a maximum # of allowed instances. This minimized the economic impact from a DoS attack too. Then you just rely on how Windows Azure mitigates any Denial of Service attacks, which is when it detects any attack patterns from one Windows Azure role instance to another role instance. In that it will stop any attacks onto your actual web application.
关于此的博客文章有点过时，但仍然相关：
http://blogs.blackmarble.co.uk/blogs/sspencer/post/2011/02/14/denial-of-service-and-windows-azure.aspx
A bit outdated blogpost about this but still relevant:
http://blogs.blackmarble.co.uk/blogs/sspencer/post/2011/02/14/denial-of-service-and-windows-azure.aspx