> For the complete documentation index, see [llms.txt](https://docs.link11.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.link11.com/product-guides/network-ddos/architecture-and-setup-options.md). # Architecture and Setup Options Network DDoS Protection is based upon BGP Sessions. Each BGP Session announces a public Link11 IP address for a protected prefix (a range of customer IPs). Traffic sent to the protected IPs is routed through a Link11 Scrubbing Center for processing. ## Responsibility Link11 acts as an upstream provider for the customer AS and is responsible for ensuring high availability from the Internet and DDoS mitigation. Link11’s responsibility ends at the Link11 edge router port in the datacenter cabinet. All other services must be provided by the customer or its service providers e.g. Router-, BGP-configuration, direct connects, or datacenter cross-connects.
## Architectural Options The system can be configured in multiple ways, depending on the customer’s needs. There are two types of decisions to make: * Routing traffic from external clients into Network DDoS * Routing traffic from Network DDoS to customer origins. ## Routing traffic into Network DDoS ### The recommended option: Always-On Setup The Link11 solution uses Machine Learning mechanisms, which require a baseline of traffic from which to form insights. The system works best when live traffic runs through it in both ‘normal’ operations and during attacks. If only a subset of traffic is available for analysis, attack detection will not be as accurate compared to a setup where all traffic flows through the Network DDoS service and its deep packet inspection infrastructure. Therefore, we recommend that customers use an always-on setup, where all traffic is processed through the system. In this scenario, Link11 acts as the upstream provider for its customers. The customer announces all their IP prefixes via Link11, and all incoming and outgoing traffic is seen by Link11. ### Other options Besides the “Always-on” setup, two other approaches are possible, described below: * In a “[Standby](#standby-setup-part-time-filtering)” setup, Link11 doesn’t receive any inbound traffic until an attack occurs. * In a “[Multi-ISP](#multi-isp-setup-partial-filtering)” setup, Link11 only receives and inspects some of the customer’s inbound traffic, until an attack occurs. Both of these approaches require [Link11 Netflow DDoS Detector](/product-guides/netflow-ddos-detector/introduction.md) (an optional extension to Network DDoS). This service receives Netflow data from customers and analyzes the recent traffic. When an attack is detected, Network DDoS can then begin receiving all inbound requests, filtering out attack traffic. Then, when the attack is over, the “peacetime” routing of traffic is restored. {% hint style="info" %} Netflow DDoS Detector can be used to notify admins when an attack begins and ends, so that admins can choose to manually trigger Network DDoS’ traffic filtering. Or, Netflow DDoS Detector can be configured to automatically route traffic into Network DDoS at attack inception, then release it again after the attack is over. {% endhint %} #### Standby Setup (part-time filtering) This configuration is usually used if the customer's data center is not close to a Link11 datacenter, or the customer facilitates their own on-premise DDoS monitoring and mitigation systems and only wants to use the Network DDoS Protection service in case of larger attacks. In this setup Link11 establishes a BGP session with its customers, but the customer does not primarily announce IP prefixes via this path. For monitoring and detecting DDoS attacks on all uplinks to other upstream providers, the customer can configure a Netflow export into Link11 Netflow DDoS Detector. The Netflow service analyzes the flow data for possible DDoS attacks, and offers the customer the benefit of additional statistical data and reporting functionality in the Link11 WebGUI. For information about analyzing flow data on the main uplink, see Multi-ISP Setup, below. #### Multi-ISP Setup (partial filtering) In this scenario, Link11 acts as one of the available upstream providers for the customers. The customer decides their preferred routing paths locally. The Link11 infrastructure only sees traffic where the local path is the shortest for sending and receiving traffic. If an attack is detected via Netflow DDoS Detector, customers have the option to be informed via email about the attack and can choose to manually start rerouting of the attack traffic via local routing decisions, or rerouting can be triggered automatically by Link11 via announcing a most-specific route on the customers behalf. Most-specific route announcements should not be revoked during daily traffic peaks as this can result in traffic loss if public routers do not release the route, e.g. due to high resource utilization. To avoid routing issues, customers must also ensure that the most-specific announcement made by Link11 is the only /24 announced for the prefix range. Customers need to limit announcements to other providers to /23s as the smallest routed range. #### Additional consideration: Asynchronous Routing (incoming traffic only) In cases where the customer data center has higher latency than the closest Link11 data center, or the customer uses [a setup based on GRE tunnels](/product-guides/network-ddos-v3/faq/setting-up-gre.md), asynchronous routing allows incoming traffic to flow through the Link11 scrubbing center and outgoing traffic to be sent to Local ISPs. ## Routing traffic out of Network DDoS There are several options for sending clean traffic from Link11 to the customer origin. {% hint style="info" %} In the interface, this option is specified in the [BGP Sessions / Type](/product-guides/network-ddos-v3/interface/bgp-sessions.md#type) parameter. {% endhint %} ### The recommended option: Layer 2 The optimal connection between Network DDoS and the origin is Layer 2. For instructions on setting this up, [go here](/product-guides/network-ddos-v3/faq/establishing-layer-2-connections.md). ### Other options The connection can be setup through routers, or using GRE tunnels. Here are [instructions for setting up GRE](/product-guides/network-ddos-v3/faq/setting-up-gre.md). ## Setup instructions Details on setup can be found in the [FAQ](/product-guides/network-ddos-v3/faq.md).