Note:
The following instructions apply to customers onboarded after September 10, 2026.
This document describes how to quickly onboard EdgeOne (EO) resources, such as site domains and L4 proxy instances, to DDoS Defender, helping you maintain stable business operations during large-scale traffic attacks or CC attacks. The entire process includes four steps: subscribing to a DDoS plan, onboarding EO resources, adjusting the protection level, and configuring protection policies.
Workflow
|
Preparations | Register a Tencent Cloud account, complete identity verification, purchase the EdgeOne (EO) Standard or Enterprise plan, and complete site onboarding. |
Step 1: Subscribe to a plan | Select the DDoS Essential or Premium plan and complete the purchase. |
Step 2: Onboard an EO domain or L4 proxy | Onboard the domain or L4 proxy instance that requires protection to EO. |
Step 3: Adjust the protection level of EO resources | In the EO console, adjust the protection level of the domain or L4 proxy instance to Advanced Protection or Ultimate Protection. |
Step 4: Configure protection policies | In the EO console, configure L3/4 DDoS protection policies for L4 proxy instances and L7 (CC) protection policies for domains. |
Preparations
A Tencent Cloud account has been registered with identity verification completed.
You have purchased an EdgeOne (EO) Standard or Enterprise plan and completed site onboarding.
Step 1: Subscribing to a Plan
2. Select a plan edition (Essential or Premium) based on your business protection needs. If you have additional protection requirements, you can also select the corresponding protection-capacity add-on.
3. After selecting the service agreement, complete the payment.
Step 2: Onboarding an EdgeOne Domain or L4 Proxy
In the EdgeOne (EO) console, onboard the business that requires protection to EO. If it is already onboarded, you can skip this step.
Onboard an EO domain: On the site details page, click Domain Services > Domain Management to add and onboard the acceleration domain that requires protection. For detailed steps, see Adding an Acceleration Domain. Onboard an L4 proxy instance: On the site details page, click L4 Proxy > L4 Instance List, and then click Create L4 Proxy Instance. When creating the instance, you can directly set the protection level to Advanced Protection or Ultimate Protection in DDoS Protection Configuration, eliminating the need for later adjustments. For detailed steps, see Creating an L4 Proxy Instance. Step 3: Adjusting the Protection Level of EdgeOne Resources
In the EdgeOne (EO) console, adjust the DDoS protection level of the domain or L4 proxy instance that requires protection to Advanced Protection or Ultimate Protection. The system will automatically create or associate a corresponding protection for it. If the protection level was already set to Advanced Protection or Ultimate Protection during onboarding, you can skip this step. For detailed steps, see Associating EO Domains and L4 Proxy Instances. 1. Log in to the EdgeOne console, go to Service Overview in the left sidebar, and click the target site to enter the site details page.
2. Adjust the protection level of an EO domain: Click Domain Services > Domain Management, and change the DDoS protection level of the target domain to Advanced Protection or Ultimate Protection. Three methods are supported: individual domain configuration, batch domain configuration, and site-level configuration.
3. Adjust the protection level of an L4 proxy instance: Click L4 Proxy > L4 Instance List, and set the DDoS protection level to Advanced Protection or Ultimate Protection when creating an L4 proxy instance or in the Protection Method column of an existing instance.
Note:
You need to authorize EdgeOne to access your DDoS Protection service through the service role TEO_QCSLinkedRoleInDDoS. This authorization can be completed in the EdgeOne (EO) console as part of the configuration process.
Changing the protection level of a domain or L4 proxy instance involves reallocating underlying resources. It takes 5-10 minutes for the deployment to complete before the change takes effect. If local or ISP DNS caching exists, the actual effective time depends on the TTL configuration of the client DNS records.
Step 4: Configuring Protection Policies
Protection policies must be configured separately by resource type in the EdgeOne (EO) console:
L4 proxy instances: Support configuring L3/4 DDoS protection policies, such as IP address allowlists and blocklists. On the site details page, click L4 Proxy > L4 Instance List. In the operation column of the target instance, click Protection Policy Configuration to go to the protection policy configuration page and complete the configuration. For details, see L3/4 DDoS Protection Policies. Domains: Support configuring L7 (CC) protection policies. In the Web Protection module of the EdgeOne (EO) console, configure rate limiting, custom rules, and managed rules as needed. For details, see EO Web Security. Note:
L3/4 DDoS protection policies can only be configured for L4 proxy instances. L7 (CC) protection policies can only be configured for domains in Web Security.
Improper policy configuration may cause normal traffic to be mistakenly blocked. We recommend that you verify traffic characteristics based on Analytics and Web Security Analysis in the EdgeOne (EO) console before making adjustments, and prioritize policies with a smaller impact scope.
You have completed the basic configuration for onboarding EO resources to DDoS Defender.
Next Steps
1. L3/4 DDoS protection effectiveness: On the Analytics page in the EdgeOne (EO) console, view the L3/4 DDoS Attack Protection Bandwidth metric card to observe the protection bandwidth, packet rate, and number of attack events for network-layer and transport-layer DDoS attacks. 2. L7 (CC) protection effectiveness: On the Analytics page, check for abnormal fluctuations in request counts and traffic. Then, use Web Security Analysis to view details of requests that matched Web Security rules and determine whether policy adjustments are needed.