Advanced Anti-DDoS. User Guide. Issue 17 Date HUAWEI TECHNOLOGIES CO., LTD.

Transcription

1 Issue 17 Date HUAWEI TECHNOLOGIES CO., LTD.

2 Copyright Huawei Technologies Co., Ltd All rights reserved. No part of this document may be reproduced or transmitted in any form or by any means without prior written consent of Huawei Technologies Co., Ltd. Trademarks and Permissions and other Huawei trademarks are trademarks of Huawei Technologies Co., Ltd. All other trademarks and trade names mentioned in this document are the property of their respective holders. Notice The purchased products, services and features are stipulated by the contract made between Huawei and the customer. All or part of the products, services and features described in this document may not be within the purchase scope or the usage scope. Unless otherwise specified in the contract, all statements, information, and recommendations in this document are provided "AS IS" without warranties, guarantees or representations of any kind, either express or implied. The information in this document is subject to change without notice. Every effort has been made in the preparation of this document to ensure accuracy of the contents, but all statements, information, and recommendations in this document do not constitute a warranty of any kind, express or implied. Huawei Technologies Co., Ltd. Address: Website: Huawei Industrial Base Bantian, Longgang Shenzhen People's Republic of China Issue 17 ( ) Copyright Huawei Technologies Co., Ltd. i

3 Contents Contents 1 Configuring a Forwarding Rule Connecting a Website Service to AAD Connecting a Non-website Service to AAD Configuring a Protection Policy Modifying DNS Resolution Configuring Alarm Notification Managing an Instance Viewing Information About an Instance Changing the Name of an AAD Instance Changing the Elastic Protection Bandwidth Renewing an Instance Upgrading Specifications Managing a Forwarding Rule Viewing Information About a Forwarding Rule Modifying an Origin Server IP Address Deleting a Forwarding Rule Exporting a Forwarding Rule Managing a Domain Name Viewing the Information About a Domain Name Enabling WAF and CC Attack Prevention Disabling Domain Name Resolution, Adding a Resolution Line, and Deleting a Resolution Line for a Domain Name Changing the Service Configuration of a Domain Name Deleting a Domain Name Viewing a Retrieval IP Address Segment Viewing a Protection Report (Optional) Managing Enterprise Projects Creating an Enterprise Project Disabling an Enterprise Project Issue 17 ( ) Copyright Huawei Technologies Co., Ltd. ii

4 Contents 12.3 Managing Resources for an Enterprise Project Managing a User Group Viewing the Expenditures of an Enterprise Project Unsubscribing from an Enterprise Project...62 A Change History Issue 17 ( ) Copyright Huawei Technologies Co., Ltd. iii

5 1 Configuring a Forwarding Rule 1 Configuring a Forwarding Rule Scenario If your service is a non-website service, you need to configure forwarding rules for the instance. By default, you can add a maximum of 50 forwarding rules to each instance. To add more rules, contact Huawei technical support (hotline: ). After configuring the rules, change domain names based on the connection method. AAD will automatically forward traffic to your origin server IP addresses. Prerequisites You have obtained a username and password for logging in to the management console. You have purchased an AAD instance. Procedure Step 1 Step 2 Step 3 Log in to the management console. Choose Security >. The page is displayed. In the row containing the desired instance, click Configure. Step 4 Choose IP Address Configuration in the navigation tree to add a forwarding rule. NOTE An origin server IP address can be added to multiple forwarding rules. Different forwarding rules cannot have the same forwarding protocol and forwarding port. You can enter the forwarding protocol or port to search for the specified rule in the search box at the upper right corner of the page. Adding a forwarding rule Issue 17 ( ) Copyright Huawei Technologies Co., Ltd. 1

6 1 Configuring a Forwarding Rule a. Click Add. b. In the Add Forwarding Rule dialog box, enter the forwarding rule information. Table 1-1 describes the parameters. Click OK. Table 1-1 Adding a forwarding rule Parameter Forwarding Protocol Description This parameter indicates the protocol used by your service for its users. tcp: TCP is a reliable transmission-layer protocol oriented to connections and based on byte streams. udp: UDP is a connectionless transmission-layer protocol that provides transaction-oriented transmission service of simple but unreliable information. Issue 17 ( ) Copyright Huawei Technologies Co., Ltd. 2

7 1 Configuring a Forwarding Rule Parameter Forwarding Port Origin Server Port Origin Server IP Address Description This parameter indicates the port used for traffic diversion. The port number ranges from 1 to NOTICE In one high-defense line, website services and non-network services cannot use the same port number. This parameter indicates the port used by your service for its users. The port number ranges from 1 to This parameter indicates the public IP address used by your service for its users. If you have changed the domain name for your service, AAD will forward access traffic to this IP address. You can add a maximum of 20 such IP addresses. Separate them with commas (,). NOTICE Enter a valid public IP address. Batch adding forwarding rules a. Click Batch Add. b. In the Batch Add Forwarding Rule dialog box, click and select a file. Then click Import. NOTE Only a.txt file can be imported. Enter the following information from left to right in the file: forwarding protocol, forwarding port, origin server port, and origin server IP address. Use space in between to separate them. Use commas (,) to separate origin server IP addresses. You can enter only one forwarding rule in a line. #cad_01_0016/table describes each field. The number of forwarding rule entries added in the file cannot exceed the quota limit. Within the quota limit, a maximum of 200 entries can be imported at a time. Issue 17 ( ) Copyright Huawei Technologies Co., Ltd. 3

8 1 Configuring a Forwarding Rule Step 5 (Optional) Configure gaming gateway protection. NOTE The gaming gateway is used for gaming services under frequent CC attacks. When you enable this function, the AAD system starts to learn the behavioral characteristics of gaming users to identify bad traffic and defend against CC attacks. Perform the following steps: 1. In the row containing the desired forwarding rule, click Set Protection in the Status column. The Set Protection page is displayed. 2. Click to set Gaming Gateway Protection to. Issue 17 ( ) Copyright Huawei Technologies Co., Ltd. 4

9 1 Configuring a Forwarding Rule 3. Click Add Whitelist to configure the whitelist for gaming gateway protection. 4. Click OK. ----End Follow-up Procedure To change the origin server IP address of a forwarding rule, perform Modifying an Origin Server IP Address. If you do not need a forwarding rule, perform Deleting a Forwarding Rule. To back up a forwarding rule or quickly modify its configuration information, perform Exporting a Forwarding Rule. Issue 17 ( ) Copyright Huawei Technologies Co., Ltd. 5

10 2 Connecting a Website Service to AAD 2 Connecting a Website Service to AAD Scenario You can use domain names for user connection. Access traffic is directed to the high-defense IP address by way of CNAME resolution. You can specify a maximum of 50 domain names. Prerequisites You have obtained a username and password for logging in to the management console. You have purchased an AAD instance. Procedure Step 1 Configure domain name access. 1. Log in to the management console. 2. Choose Security >. The page is displayed. 3. In the navigation tree on the left, choose > Domain Name Configuration. The Domain Dame Configuration page is displayed. 4. In the upper right corner, click Configure Domain Name Access. The Configure Domain Name Access page is displayed. 5. Enter the domain name information and click Next. For a non-enterprise project, Table 2-1 describes the parameters. Issue 17 ( ) Copyright Huawei Technologies Co., Ltd. 6

11 2 Connecting a Website Service to AAD For an enterprise project: Select a project name from the Enterprise Project drop-down list. Table 2-1 describes other parameters. Table 2-1 Domain name information Parameter Protected Domain Name Protocol/ Port Origin Server Type Description Set this parameter to the domain name used by your server to provide services. Root domain names are supported, for example, *.domain.com. Select Website as the domain name type and HTTP/ WebSocket or HTTPS/WebSockets as the protocol. Select a port based on your needs. Available HTTP/WebSocket ports are 80, 81, 82, 83, 84, 8080, NOTE Available HTTPS/WebSockets ports are 443, 7443, and To configure a port other than 80, 81, 82, 83, 84, 8080, 8081, 443, 7443, and 8443, contact Huawei technical support at In one high-defense line, website services and non-network services cannot use the same port number. Options are: IP address Domain name NOTE If you want a domain name to share a high-defense IP address and port with another domain name, ensure that they have the same Origin Server Type value. If you want a domain name to share a high-defense IP address and port with another domain name and the current domain name's Origin Server Type value is IP address, you must enable basic web protection for the other domain name first. Issue 17 ( ) Copyright Huawei Technologies Co., Ltd. 7

12 2 Connecting a Website Service to AAD Parameter Origin Server IP Address/ Domain name Description If the Origin Server Type value is IP address: This parameter indicates the public IP address used by your service for its users. If you have changed the domain name for your service, AAD will forward access traffic to this IP address. You can add a maximum of 20 such IP addresses. Separate them with commas (,). NOTICE Set the origin server IP address to a valid public IP address. If the Origin Server Type value is Domain name: Currently, this parameter supports only HUAWEI CLOUD's WAF CNAME. Format: 27c8a2f ea1b404d4a6e87cbe.waf.huaweicloud.com or 27c8a2f ea1b404d4a6e87cbe.waf.huaweicloud.com. NOTICE Before connecting your service to AAD using HUAWEI CLOUD's WAF CNAME, ensure that it is using a proxy to prevent connection failure. If you want a domain name to share a high-defense IP address and port with another domain name, ensure that they are using the same WAF zone. After WAF is connected with AAD, if you do not want WAF for your service, disconnect your service from AAD first. 6. Select the instance and line and click Submit and Continue. You can select multiple lines (high-defense IP addresses) for a domain name. However, the IP addresses must have the same number of forwarding rules, the same forwarding protocols, ports, and the same service type. HUAWEI CLOUD provides multiple carrier lines for each instance to avoid cross-carrier access from your users. You are advised to select a complete set of lines, which includes all carriers, when selecting lines for your instance. Issue 17 ( ) Copyright Huawei Technologies Co., Ltd. 8

13 2 Connecting a Website Service to AAD 7. Record the CNAME information of the domain name and add the information to DNS. Then click Next. For details about modifying DNS resolution, see Adding a CNAME Record. 8. Add the high-defense IP address to the whitelist. If no firewall has been configured for the origin server, click Finish. If a firewall has been configured for the origin server, add the retrieval IP address segment to the whitelist of the firewall. Then click Finish. The Domain Name Configuration page is displayed. On the page, the newly added domain name is displayed in the list. 9. (Optional) Enable CNAME-based automatic scheduling. This function diverts traffic to other lines when a line is in a black hole to ensure normal service running. 10. (Optional) If the Origin Server Type value is IP address, in the row containing the domain name, click Basic Web Protection in the Security Protection column. If you do not enable the basic web protection feature, AAD does not provide seven-layer protection for your traffic. Issue 17 ( ) Copyright Huawei Technologies Co., Ltd. 9

14 2 Connecting a Website Service to AAD Step 2 (Optional) Upload a certificate. If HTTPS/WebSockets is selected for the domain name access configuration and the Origin Server Type value is IP address, you need to perform the following steps to upload a certificate: If no certificate has been uploaded, perform the following steps: a. In the row containing the domain name, click Upload in the Service Type column. b. In the Upload Certificate and Private Key dialog box, select Manually upload, and paste the certificate and private key content. Then click OK. NOTE Currently, only TLS 1.0, TLS 1.1, and TLS 1.2 certificates can be uploaded. You can also select an existing certificate. Each certificate name of a user must be unique. The Select an existing certificate feature supports fuzzy search. If a certificate has been uploaded, perform the following steps: 1. In the row containing the domain name, click Change in the Service Type column. Issue 17 ( ) Copyright Huawei Technologies Co., Ltd. 10

15 2 Connecting a Website Service to AAD 2. Change the certificate. See 2. Paramete r Name Certificate File Private Key File Description The format in which you input your certificate is as follows: -----BEGIN CERTIFICATE----- MIIDljCCAv+gAwIBAgIJAMD2jG2tYGQ6MA0GCSqGSIb3DQEBBQUAMIGPMQswCQYD VQQGEwJDSDELMAkGA1UECBMCWkoxCzAJBgNVBAcTAkhaMQ8wDQYDVQQKEwZodWF3 ZWkxDzANBgNVBAsTBmh1YXdlaTEPMA0GA1UEAxMGaHVhd2VpMQ8wDQYDVQQpEwZz ZXJ2ZXIxIjAgBgkqhkiG9w0BCQEWE3p3YW5nd2VpZGtkQDE2My5jb20wHhcNMTUw MzE4MDMzNjU5WhcNMjUwMzE1MDMzNjU5WjCBjzELMAkGA1UEBhMCQ0gxCzAJBgNV BAgTAlpKMQswCQYDVQQHEwJIWjEPMA0GA1UEChMGaHVhda2VpMQ8wDQY END CERTIFICATE----- How to copy the content of your certificate: For a.pem certificate: Use a text editor to open your certificate file and copy the certificate content. For other certificates: Convert your certificate to a.pem one. Then open it with a text editor and copy the private key content. NOTE For details about how to convert a certificate, see FAQ "How Do I Convert a Non-PEM Certificate into a PEM One?" The format in which you input your private key is as follows: -----BEGIN RSA PRIVATE KEY----- Proc-Type: 4,ENCRYPTED DEK-Info:DES-EDE3-CBC,616D33712E1DBD34 MIIDljCCAv+gAwIBAgIJAMD2jG2tYGQ6MA0GCSqGSIb3DQEBBQUAMIGPMQswCQYDVQQG EwJDSDELMAkGA1UECBMCWkoxCzAJBgNVBAcTAkhaMQ8wDQYDVQQKEwZodWF3ZWkxDzAN BgNVBAsTBmh1YXdlaTEPMA0GA1UEAxMGaHVhd2VpMQ8wDQYDVQQpEwZzZXJ2ZXIxIjAg BgkqhkiG9w0BCQEWE3poYW5nd2VpZGtkQDE2My5jb20wHhcNMTUwMzE4MDMzNjU5WhcN MjUwMzE1MDMzNjU5WjCBjzELMAkGA1UEBhMCQ0gxCzAJBgNVBAgTAlpKMQswCQYDVQQH EwJIWjEPMA0GA1UEChMGaHVhd2VpMQ8wDQYDVQQLEwZ -----END RSA PRIVATE KEY----- How to copy the content of your private key: For a.pem certificate: Use a text editor to open your certificate file and copy the certificate content. For other certificates: Convert your certificate to a.pem one. Then open it with a text editor and copy the private key content. NOTE For details about how to convert a certificate, see FAQ "How Do I Convert a Non-PEM Certificate into a PEM One?" Step 3 Add the proxy IP address range to the whitelist. Reason: Full Network Address Translation (Full-NAT) is adopted by AAD, that is, your users' actual IP addresses will be replaced and their access traffic will be converged to retrieval IP addresses. When AAD is not enabled, clients' IP addresses are scattered (from the perspective of origin servers) and each IP address typically has few requests. Issue 17 ( ) Copyright Huawei Technologies Co., Ltd. 11

16 2 Connecting a Website Service to AAD After AAD is enabled: Because a proxy IP address range is fixed and has limited IP addresses, all requests are from the retrieval IP address segment (from the perspective of origin servers). Therefore, each proxy IP address has a lot more requests and may even be mistaken for initiating an attack on the origin server. Now, if an anti-ddos security policy is working on the origin server, requests from proxy IP addresses are likely to be intercepted or limited. Consequently, errors such as the common 502 error are reported. Procedure: a. View the proxy IP address range. For details, see Viewing a Retrieval IP Address Segment. b. Add the IP address range to the whitelist of the firewall, ACL, or any other security software on your origin server to ensure that the retrieval IP addresses are not affected by the security policies on the origin server. Step 4 Check that the configuration takes effect. To ensure service stability, you are advised to perform local tests before switching services. AAD is expected to forward packets destined for the high-defense IP address or AAD CNAME to the origin server. The test is as follows: Assumed parameter value: CNAME: 5dc728e1769ad666.huaweisafedns.com Procedure: a. Telnet 80 If the connection succeeds, the Telnet public IP address can be used on the local network. If the connection fails, you need to replace the network environment of the local test computer because internal network restrictions may have been configured by some enterprises. For example, you can connect to the Wi-Fi hotspot of your phone to switch to the carrier's network. b. After confirming that the network is available, you can run the Telnet command to access port 80 of the AAD CNAME. If the Telnet command is executed successfully, the configuration is successful. If the connection fails, check whether the preceding steps are complete. If the fault persists, contact HUAWEI CLOUD technical support. Step 5 Modify DNS resolution. For details, see Adding a CNAME Record. The DNS configuration takes effect after a while. You can test the domain name resolution by using some online test tools such as 17ce and China Webmaster. ----End Follow-up Procedure If resolution to a high-defense IP address is not required for the domain name, click View details in the Instance and Line column in the row containing the domain name. Issue 17 ( ) Copyright Huawei Technologies Co., Ltd. 12

17 2 Connecting a Website Service to AAD Select the high-defense IP address of the domain name and click to set Enable DNS to. If you do not want to protect the domain name, click Delete in the Operation column in the row containing the domain name. Issue 17 ( ) Copyright Huawei Technologies Co., Ltd. 13

18 3 Connecting a Non-website Service to AAD 3 Connecting a Non-website Service to AAD Scenario Non-website services include Apps and PC client services. For such services, customers can configure CNAME records on DNS servers or directly configure high-defense IP addresses to clients to use AAD. Prerequisites You have obtained a username and password for logging in to the management console. You have purchased an AAD instance. Procedure Step 1 (Optional) Configure the domain name access. This step is required if smart resolution of domain name is required. 1. Log in to the management console. 2. Choose Security >. The page is displayed. 3. In the navigation tree on the left, choose > Domain Name Configuration. The Domain Dame Configuration page is displayed. 4. In the upper right corner, click Configure Domain Name Access. The Configure Domain Name Access page is displayed. 5. Enter the domain name information and click Next. For a non-enterprise project, Table 3-1 describes the parameters. Issue 17 ( ) Copyright Huawei Technologies Co., Ltd. 14

19 3 Connecting a Non-website Service to AAD For an enterprise project: Select a project name from the Enterprise Project drop-down list. Table 3-1 describes other parameters. Table 3-1 Domain name information Parameter Protected Domain Name Domain Name Type/ Port Description Set this parameter to the domain name used by your server to provide services. Root domain names are supported, for example, for example, *.domain.com. Select Non-website. 6. Select the instance and line and click Submit and Continue. You can select multiple lines (high-defense IP addresses) for a domain name. However, the IP addresses must have the same number of forwarding rules, the same forwarding protocols, ports, and the same service type. HUAWEI CLOUD provides multiple carrier lines for each instance to avoid cross-carrier access from your users. You are advised to select a complete set of lines, which includes all carriers, when selecting lines for your instance. Issue 17 ( ) Copyright Huawei Technologies Co., Ltd. 15

20 3 Connecting a Non-website Service to AAD 7. Copy and save the AAD CNAME and click Next. 8. Add the high-defense IP address to the whitelist. If no firewall has been configured for the origin server, click Finish. If a firewall has been configured for the origin server, add the retrieval IP address segment to the whitelist of the firewall. Then click Finish. The Domain Name Configuration page is displayed. On the page, the newly added domain name is displayed in the list. 9. (Optional) If your service needs to provide services through the domain name, you are advised to enable CNAME-based Auto Scheduling. This function diverts traffic to other lines when a line is in a black hole to ensure normal service running. Step 2 Add a forwarding rule. For details, see Configuring a Forwarding Rule. Step 3 Add the proxy IP address range to the whitelist. Reason: Full Network Address Translation (Full-NAT) is adopted by AAD, that is, your users' actual IP addresses will be replaced and their access traffic will be converged to retrieval IP addresses. When AAD is not enabled, clients' IP addresses are scattered (from the perspective of origin servers) and each IP address typically has few requests. After AAD is enabled: Because a proxy IP address range is fixed and has limited IP addresses, all requests are from the retrieval IP address segment (from the Issue 17 ( ) Copyright Huawei Technologies Co., Ltd. 16

21 3 Connecting a Non-website Service to AAD Procedure: perspective of origin servers). Therefore, each proxy IP address has a lot more requests and may even be mistaken for initiating an attack on the origin server. Now, if an anti-ddos security policy is working on the origin server, requests from proxy IP addresses are likely to be intercepted or limited. Consequently, errors such as the common 502 error are reported. a. View the proxy IP address range. For details, see Viewing a Retrieval IP Address Segment. b. Add the IP address range to the whitelist of the firewall, ACL, or any other security software on your origin server to ensure that the retrieval IP addresses are not affected by the security policies on the origin server. Step 4 Check that the configuration takes effect. To ensure service stability, you are advised to perform local tests before switching services. AAD is expected to forward packets destined for the high-defense IP address or AAD CNAME to the origin server. The test is as follows: Assumed parameter values: Line package: CTCC, CUCC, and CMCC IP address of the CTCC line: IP address of the CUCC line: IP address of the CMCC line: CNAME: 5dc728e1769ad666.huaweisafedns.com Port used by AAD to provide external services: 1234 Protected domain name: Origin server IP address: Port used by the origin server to provide external services: 1234 Procedure: a. Telnet 80 If the connection succeeds, the Telnet public IP address can be used on the local network. If the connection fails, you need to replace the network environment of the local test computer because internal network restrictions may have been configured by some enterprises. For example, you can connect to the Wi-Fi hotspot of your phone to switch to the carrier's network. b. After confirming that the network is available, you can run the Telnet command to access each carrier's line and port 1234 of the AAD CNAME. If the Telnet command is executed successfully, the configuration is successful. If the connection fails, check whether the preceding steps are complete. If the fault persists, contact HUAWEI CLOUD technical support. Step 5 (Optional) Modify DNS resolution. You need to modify DNS resolution only when you need to provide services through a domain name. Issue 17 ( ) Copyright Huawei Technologies Co., Ltd. 17

22 3 Connecting a Non-website Service to AAD If you select Configure Domain Name Access, you obtain a CNAME record from AAD. Perform Adding a CNAME Record. If you select Add Forwarding Rule, perform Adding an A Record. The DNS configuration takes effect after a while. You can test the domain name resolution by using some online test tools such as 17ce and China Webmaster. ----End Follow-up Procedure If resolution to a high-defense IP address is not required for the domain name, click View details in the Instance and Line column in the row containing the domain name. Select the high-defense IP address of the domain name and click to set Enable DNS to. If you do not want to protect the domain name, click Delete in the Operation column in the row containing the domain name. Issue 17 ( ) Copyright Huawei Technologies Co., Ltd. 18

23 4 Configuring a Protection Policy 4 Configuring a Protection Policy Scenario This section describes how to configure protection policies for protected domain names. Protection policies take effect only for forwarding rules that enable Basic Web Protection. Prerequisites The protected domain name has been successfully connected, and its Service Type value is Website. Procedure Step 1 Step 2 Step 3 Step 4 Log in to the management console. Choose Security >. The page is displayed. In the navigation tree on the left, choose > Protection Policies. The Protection Policies page is displayed. On the Protection Policies page, select the domain name for which you want to configure a protection policy. Step 5 Set CC Attack Protection from to to enable CC Attack Protection. Issue 17 ( ) Copyright Huawei Technologies Co., Ltd. 19

24 4 Configuring a Protection Policy NOTE Protection policies take effect only for forwarding rules that enable Basic Web Protection. Traffic Attack Protection is enabled by default. Before enabling CC Attack Protection, you need to enable Basic Web Protection. ----End Issue 17 ( ) Copyright Huawei Technologies Co., Ltd. 20

25 5 Modifying DNS Resolution 5 Modifying DNS Resolution Adding a CNAME Record The configuration is similar for each DNS service provider, with small difference in steps. This section uses the Domain Name Service (DNS) on HUAWEI CLOUD as an example. If you select Configure Domain Name Access, you obtain a CNAME record from AAD. Add the CNAME record to DNS. Step 1 Step 2 Step 3 Step 4 Log in to the management console and choose Service List > Network > Domain Name Service. On the Domain Name Service page, select Public Zones. Then click the desired domain name in the list. Delete the A record or CNAME record from the original DNS resolution; otherwise, you will fail to add new resolution because conflicts will occur if the line is Default for both the original and new resolution. Click Add Record Set. Step 5 Add the CNAME record. For details, see Table 5-1. Issue 17 ( ) Copyright Huawei Technologies Co., Ltd. 21

26 5 Modifying DNS Resolution Table 5-1 Parameters for adding a CNAME record Parameter Name Type Description Enter the protected domain name for which DNS resolution is to be modified. Select CNAME-Map one domain to another. Issue 17 ( ) Copyright Huawei Technologies Co., Ltd. 22

27 5 Modifying DNS Resolution Parameter Line Value Description Select Default. Enter the CNAME record obtained from AAD. Step 6 Click OK. ----End Adding an A Record The DNS configuration takes effect after a while. You can test the domain name resolution by using some online test tools such as 17ce and China Webmaster. If you select Add Forwarding Rule, add an A record. This section uses China Telecom, China Unicom, and China Mobile as examples. Step 1 Step 2 Step 3 Step 4 Log in to the management console and choose Service List > Network > Domain Name Service. On the Domain Name Service page, select Public Zones. Then click the desired domain name in the list. Delete the A record or CNAME record from the original DNS resolution; otherwise, you will fail to add new resolution because conflicts will occur if the line is Default for both the original and new resolution. Click Add Record Set. Step 5 Add an A record. For details, see Table 5-2. Issue 17 ( ) Copyright Huawei Technologies Co., Ltd. 23

28 5 Modifying DNS Resolution Table 5-2 Parameters for adding an A record - China Telecom Parameter Name Type Description Enter the protected domain name for which DNS resolution is to be modified. Select A-Map domains to IPv4 addresses. Issue 17 ( ) Copyright Huawei Technologies Co., Ltd. 24

29 5 Modifying DNS Resolution Parameter Line Value Description Select China Telecom. Enter the high-defense IP address of a China Telecom line. Step 6 Click OK. Step 7 Repeat steps 4 to 6 for China Unicom. For parameter details, see Table 5-3. Table 5-3 Parameters for adding an A record - China Unicom Parameter Name Type Line Value Description Enter the protected domain name for which DNS resolution is to be modified. Select A-Map domains to IPv4 addresses. Select China Unicom. Enter the high-defense IP address of a China Unicom line. Step 8 Repeat steps 4 to 6 for China Mobile. For parameter details, see Table 5-4. Table 5-4 Parameters for adding an A record - China Mobile Parameter Name Type Line Value Description Enter the protected domain name for which DNS resolution is to be modified. Select A-Map domains to IPv4 addresses. Select China Mobile. Enter the high-defense IP address of a China Mobile line. Step 9 Repeat steps 4 to 6 for all lines. For parameter details, see Table 5-5. Table 5-5 Parameters for adding an A record - all lines Parameter Name Type Line Value Description Enter the protected domain name for which DNS resolution is to be modified. Select A-Map domains to IPv4 addresses. Select Default. Enter the high-defense IP address of a China Telecom line. Issue 17 ( ) Copyright Huawei Technologies Co., Ltd. 25

30 5 Modifying DNS Resolution ----End The DNS configuration takes effect after a while. You can test the domain name resolution by using some online test tools such as 17ce and China Webmaster. Issue 17 ( ) Copyright Huawei Technologies Co., Ltd. 26

31 6 Configuring Alarm Notification 6 Configuring Alarm Notification Scenario This section describes how to enable alarm notification for AAD. When alarm notification is enabled, you will receive notification messages (SMS messages or s) when: your IP addresses are under DDoS attacks. when the peak attack traffic of a DDoS attack has exceeded the basic protection bandwidth and fees are about to be charged on elastic protection bandwidth (you will receive SMS messages or s in the next morning) Prerequisites You have obtained a username and password for logging in to the management console. You have purchased an AAD instance. Procedure Step 1 Step 2 Step 3 Step 4 Log in to the management console. Choose Security >. The page is displayed. In the upper right corner of the page, click Configure Alarm Notification. In the displayed Configure Alarm Notification dialog box, select DDoS Attack. Issue 17 ( ) Copyright Huawei Technologies Co., Ltd. 27

32 6 Configuring Alarm Notification Figure 6-1 The Configure Alarm Notification dialog box Select an SMN topic from existing topics. If there is no existing topic, create and configure one in the following procedure: For details about the Simple Message Notification (SMN) service, see the Simple Message Notification. a. Create an SMN topic. i. Click Check SMN topics. ii. iii. The SMN service page is displayed. In the upper right corner of the Topic page, click Create Topic. In the displayed Create Topic dialog box, enter a name for the topic to be created. iv. Click OK. Issue 17 ( ) Copyright Huawei Technologies Co., Ltd. 28

33 6 Configuring Alarm Notification b. Add subscription information to the topic. i. In the navigation tree on the left, choose Topic Management > Subscription. ii. In the upper right corner of the Subscription page, click Add Subscription. iii. In the displayed Add Subscription dialog box, add subscription information. iv. Click. In the displayed Select Topic dialog box, select the topic created in Step 4.a. v. In the Protocol drop-down box, select a protocol supported by your terminal, for example, SMS or . vi. In the Endpoint text box, enter phone numbers or addresses to receive alarm notifications. vii. Click OK. c. Modify the access policy for the topic. i. In the navigation tree on the left, choose Topic Management > Topic. ii. iii. In the row containing the topic, choose More > Configure Topic Policy in the Operation column. In the displayed Configure Topic Policy dialog box, set the access policy. Issue 17 ( ) Copyright Huawei Technologies Co., Ltd. 29

34 6 Configuring Alarm Notification iv. In the Users who can publish messages area, select users who you allow to publish messages. v. In the Services that can publish messages area, select AAD. vi. Click OK. d. Request subscribed information of the topic. i. In the navigation tree on the left, choose Topic Management > Subscription. ii. iii. In the row containing the topic, click Request Confirmation in the Operation column. In the displayed dialog box, click OK. e. In the upper left corner, click Console. f. Choose Security >. The page is displayed. g. In the upper right corner, click Configure Alarm Notification. h. In the displayed Configure Alarm Notification dialog box, select DDoS Attack. i. Select the created SMN topic. Step 5 Click OK. ----End Issue 17 ( ) Copyright Huawei Technologies Co., Ltd. 30

35 7 Managing an Instance 7 Managing an Instance 7.1 Viewing Information About an Instance Scenario This section describes how to view information about an instance. Prerequisites You have obtained an account and its password to log in to the management console. You have purchased an instance. Procedure Step 1 Step 2 Step 3 Log in to the management console. Choose Security >. The page is displayed. View the information about your instance on the page. Figure 7-1 shows an example of the information about an instance of a non-enterprise project. Figure 7-1 Viewing the information about an instance of a non-enterprise project Figure 7-2 shows an example of the information about an instance of an enterprise project. a. Click the instance name. Issue 17 ( ) Copyright Huawei Technologies Co., Ltd. 31

36 7 Managing an Instance Figure 7-2 Viewing the information about an instance of an enterprise project b. On the View AAD Instance Details page, you can view the instance name, enterprise project name, and instance expiration time. Table 7-1 Parameter description Parameter Instance Name Line Protection Information Security Statistics Description Name of an AAD instance. You can click change the name. Time when the instance expires Recharge button of the instance on the right to Service bandwidth and protection bandwidth statuses of the instance Line and IP address information about an instance Basic protection bandwidth, elastic protection bandwidth, number of protection ports, and number of protected domain names of the instance NOTE To change the elastic protection bandwidth, click Edit. Protection statistics about the instance, including: Peak attack traffic Number of attacks Issue 17 ( ) Copyright Huawei Technologies Co., Ltd. 32

37 7 Managing an Instance Parameter Operation Description Click View Report to view the normal traffic and attack traffic. Click Configure to configure forwarding rules for the instance. ----End 7.2 Changing the Name of an AAD Instance Scenario This section describes how to change an AAD instance name. Prerequisites You have obtained an account and its password to log in to the management console. You have purchased an instance. Procedure Step 1 Step 2 Log in to the management console. Choose Security >. The page is displayed. Step 3 In the row containing the desired instance, click next to the instance name. Step 4 Enter a new instance name in the text box and click. ----End 7.3 Changing the Elastic Protection Bandwidth Scenario You can change the elastic protection bandwidth if it is insufficient. This section describes how to change the elastic protection bandwidth for an AAD instance. Issue 17 ( ) Copyright Huawei Technologies Co., Ltd. 33

38 7 Managing an Instance The elastic protection bandwidth of each instance can be changed for up to three times per day. Prerequisites You have obtained a username and password for logging in to the management console. You have purchased an AAD instance. Procedure Step 1 Step 2 Step 3 Log in to the management console. Choose Security >. The page is displayed. In the Protection Information column of the row containing the desired instance, click Edit. Step 4 In the dialog box that is displayed, set a new bandwidth and click OK. ----End 7.4 Renewing an Instance Scenario If your instance is about to expire, you can renew it to extend its validity period. Issue 17 ( ) Copyright Huawei Technologies Co., Ltd. 34

39 7 Managing an Instance Prerequisites You have obtained a username and password for logging in to the management console. You have purchased an AAD instance. Procedure Step 1 Step 2 Step 3 Log in to the management console. Choose Security >. The page is displayed. In the row containing the desired instance, click Renew. The Renewals page is displayed. Step 4 Step 5 On the Renewal page, set the time by which you want to renew the instance. Then click Submit Order. Click Pay. When the payment is successful, the Payment Successful page is displayed. ----End 7.5 Upgrading Specifications Scenario This section describes how to modify the basic protection bandwidth, elastic protection bandwidth, and service bandwidth for an AAD instance. Prerequisites Pricing Procedure NOTE Specifications can only be upgraded, but not downgraded. The lines cannot be changed during the upgrade. Expired instances do not support specifications upgrades. Frozen instances do not support specifications upgrades. You have obtained a username and password for logging in to the management console. New configuration will cause the change of fees. For details, see Pricing of a Changed Specification. Step 1 Step 2 Log in to the management console. Choose Security >. The page is displayed. Issue 17 ( ) Copyright Huawei Technologies Co., Ltd. 35

40 7 Managing an Instance Step 3 In the Instance Name column of the instance to be upgraded, click Upgrade. The Specifications page is displayed. Step 4 On the Specifications page, the Current Configuration area displays the information about the instance, including the instance name, line, billing mode, basic protection bandwidth, elastic protection bandwidth, and service bandwidth. Specifications that can be upgraded include basic protection bandwidth, elastic protection bandwidth, and service bandwidth. Set the basic protection bandwidth, elastic protection bandwidth, and service bandwidth, and click Submit. After you click Submit, the system will determine whether the new configuration is valid. If the new configuration does not change, the system displays a message indicating "Failed to upgrade specifications because selected specifications are the same as original specifications." If the new configuration is valid, the Details page is displayed. Step 5 Click Pay. When the payment is successful, the Payment Successful page is displayed. ----End Issue 17 ( ) Copyright Huawei Technologies Co., Ltd. 36

41 8 Managing a Forwarding Rule 8 Managing a Forwarding Rule 8.1 Viewing Information About a Forwarding Rule Scenario This section describes how to view information about a forwarding rule. Prerequisites You have obtained an account and its password to log in to the management console. You have configured forwarding rules for AAD instances. Procedure Step 1 Step 2 Step 3 Log in to the management console. Choose Security >. The page is displayed. In the row containing the desired instance, click Configure. Step 4 Viewing information about the desired forwarding rule. Issue 17 ( ) Copyright Huawei Technologies Co., Ltd. 37

42 8 Managing a Forwarding Rule Table 8-1 Parameter description Parameter Forwarding Protocol/Port Origin Server Protocol/Port LVS Forwarding Rule Origin Server IP Address Status Operation Description Forwarding protocol and port for the rule Origin server protocol and port for the rule Mode of forwarding rules of Linux Virtual Server (LVS) Origin server IP address added to the rule Click Edit if you need to change the origin server IP address. Running status of the forwarding rule The Set Protection button for the gaming gateway. You can click Delete to delete the forwarding rule. ----End 8.2 Modifying an Origin Server IP Address Scenario You can change the origin server IP address in the forwarding rule whenever necessary during defense. Prerequisites You have obtained an account and its password to log in to the management console. You have configured forwarding rules for AAD instances. Procedure Step 1 Step 2 Step 3 Log in to the management console. Choose Security >. The page is displayed. In the row containing the desired instance, click Configure. Step 4 In the Origin Server IP Address column of the row containing the desired instance, click Edit. Issue 17 ( ) Copyright Huawei Technologies Co., Ltd. 38

43 8 Managing a Forwarding Rule Step 5 In the displayed Change Origin Server IP Address dialog box, modify the origin server IP of the forwarding rule. Set the origin server IP address to a valid public IP address. Step 6 Click OK. ----End 8.3 Deleting a Forwarding Rule Scenario You can delete a specific forwarding rule if it is unnecessary. Prerequisites You have obtained an account and its password to log in to the management console. You have configured forwarding rules for AAD instances. Procedure Step 1 Step 2 Step 3 Log in to the management console. Choose Security >. The page is displayed. In the row containing the desired instance, click Configure. Step 4 Delete forwarding rules. Deleting one forwarding rule a. In the Operation column of the row containing the desired rule, click Delete. Issue 17 ( ) Copyright Huawei Technologies Co., Ltd. 39

44 8 Managing a Forwarding Rule b. Click OK in the displayed dialog box. Deleting multiple forwarding rules a. Select the forwarding rules to be deleted and click Batch Delete. NOTE A maximum of 50 forwarding rules can be deleted at a time. (A maximum of 50 forwarding rules are displayed on one page on the console.) ----End b. Click OK in the displayed dialog box. 8.4 Exporting a Forwarding Rule Scenario Prerequisites Back up all forwarding rules of an instance by exporting them. Using the exported file, modify forwarding rules quickly and batch add them to the console. You have obtained an account and its password to log in to the management console. You have configured forwarding rules for AAD instances. Procedure Step 1 Step 2 Step 3 Log in to the management console. Choose Security >. The page is displayed. In the row containing the desired instance, click Configure. Issue 17 ( ) Copyright Huawei Technologies Co., Ltd. 40

45 8 Managing a Forwarding Rule Step 4 On the IP Address Configuration page, click Export Rule. Step 5 View the file of exported forwarding rules rules.txt. ----End Issue 17 ( ) Copyright Huawei Technologies Co., Ltd. 41

46 9 Managing a Domain Name 9 Managing a Domain Name 9.1 Viewing the Information About a Domain Name Scenario This section describes how to view the information about a domain name. Prerequisites At least one domain name has been configured. Procedure Step 1 Step 2 Step 3 Step 4 Log in to the management console. Choose Security >. The page is displayed. In the navigation tree on the left, choose > Domain Name Configuration. The Domain Dame Configuration page is displayed. View the information about the domain name. Figure 9-1 Viewing the information about a domain name Issue 17 ( ) Copyright Huawei Technologies Co., Ltd. 42

47 9 Managing a Domain Name Table 9-1 Parameter description Parameter Domain Name CNAME Description Protected domain name CNAME information about a domain name resolved based on a CNAME record Click to copy the CNAME record. Instance and Line Service Type Security Protection Operation The CNAME record based connection status of the domain name Click View details to view the details about the line of the domain name. Enable CNAME-based Auto Scheduling so that traffic can be automatically forwarded based on the DNS resolution when a black hole is triggered for the high-defense IP address. Service type of the domain name Click Change to modify the HTTPS/WebSockets certificate. Statuses (enabled or not) of traffic attack protection, WAF, and CC attack prevention For website services for which an origin server IP address is configured, you can enable the website protection function for your domain name. For website services for which an origin server domain name is configured, you do not need to enable the website protection function for your domain name. For non-website services, the traffic cleaning function is provided and enabled by default. You can click Edit to modify the domain name access configuration. You can click Delete to delete a domain name. ----End 9.2 Enabling WAF and CC Attack Prevention Scenario Prerequisites After adding a domain name, you can enable WAF and CC attack prevention for it. WAF and CC attack protection are provided only for forwarding rules whose Service Type is Website and Origin Server Type is IP address. At least one domain name has been configured. Issue 17 ( ) Copyright Huawei Technologies Co., Ltd. 43

48 9 Managing a Domain Name Procedure Step 1 Step 2 Step 3 Step 4 Log in to the management console. Choose Security >. The page is displayed. In the navigation tree on the left, choose > Domain Name Configuration. The Domain Dame Configuration page is displayed. (Optional) If HTTPS or WebSockets protocol is configured during domain name access configuration, you need to upload a certificate first. Step 5 Set CC Attack Protection from to, and also enable Basic Web Protection. NOTE ----End WAF and CC attack protection are provided only for forwarding rules whose Service Type is Website and Origin Server Type is IP address. Traffic Attack Protection is enabled by default. Before enabling CC attack prevention, you need to enable WAF. 9.3 Disabling Domain Name Resolution, Adding a Resolution Line, and Deleting a Resolution Line for a Domain Name Scenario Prerequisites Procedure This section describes how to: Disable the domain name resolution function of AAD. Add a resolution line for a domain name. Delete a resolution line for a domain name. At least one domain name has been configured. Step 1 Step 2 Step 3 Log in to the management console. Choose Security >. The page is displayed. In the navigation tree on the left, choose > Domain Name Configuration. The Domain Dame Configuration page is displayed. Issue 17 ( ) Copyright Huawei Technologies Co., Ltd. 44

49 9 Managing a Domain Name Step 4 In the row containing the desired instance, click View Details in the Instance and Line column. Step 5 The following describes procedures for the operations: Disabling the domain name resolution function for a domain name On the page, select the desired instance and line, and click to change the domain name resolution switch to to disable domain name resolution for the instance and line. After you disable the domain name resolution function, you can still use the A record method for the high-defense IP address. Adding a resolution line for a domain name a. On the page, click Add Line. b. In the Add Line dialog box, select a new instance and line, and click OK. Issue 17 ( ) Copyright Huawei Technologies Co., Ltd. 45

50 9 Managing a Domain Name c. Click to change the domain name resolution switch to to enable domain name resolution for the high-defense IP address of the added instance and line. Deleting a resolution line for a domain name a. Disable the domain name resolution function for the high-defense IP address that has a line to be deleted. For details, see Disabling the domain name resolution function for a domain name. b. Select an instance and a line, and click Delete Line. ----End c. Click OK. Issue 17 ( ) Copyright Huawei Technologies Co., Ltd. 46

51 9 Managing a Domain Name 9.4 Changing the Service Configuration of a Domain Name Scenario Prerequisites Procedure This section describes how to change the service configuration for a website service. The protected domain name has been successfully connected, and its Service Type value is Website. Step 1 Step 2 Step 3 Step 4 Log in to the management console. Choose Security >. The page is displayed. In the navigation tree on the left, choose > Domain Name Configuration. The Domain Dame Configuration page is displayed. In the row containing the desired domain name, click Edit in the Operation column. Step 5 In the Edit Domain Name dialog box that is displayed, change the service configuration. For details, see Connecting a Website Service to AAD. NOTE If you want a domain name to share a high-defense IP address and port with another domain name, ensure that they have the same Origin Server Type value. To change the Origin Server Type value from IP address to Domain name, ensure that Basic Web Protection is disabled for the domain name. Issue 17 ( ) Copyright Huawei Technologies Co., Ltd. 47

52 9 Managing a Domain Name Step 6 Click OK. ----End 9.5 Deleting a Domain Name Scenario You can delete domain names that you do not want to protect. Before deleting a domain name, you need to ensure that the DNS domain name provider has changed the CNAME record to the corresponding actual IP address. Otherwise, directly deleting the domain name will lead to service failure. Prerequisites Procedure At least one domain name has been configured. Step 1 Step 2 Step 3 Step 4 Log in to the management console. Choose Security >. The page is displayed. In the navigation tree on the left, choose > Domain Name Configuration. The Domain Dame Configuration page is displayed. In the Operation column of the row containing the desired domain name, click Delete. Step 5 Click OK in the displayed dialog box. ----End Issue 17 ( ) Copyright Huawei Technologies Co., Ltd. 48

53 10 Viewing a Retrieval IP Address Segment 10 Viewing a Retrieval IP Address Segment Scenario If a firewall has been configured for your origin server, add the retrieval IP address segment to the whitelist of the firewall (or another protection tool) of the origin server. This section describes how to view information about a retrieval IP address segment. Prerequisites You have obtained an account and its password to log in to the management console. You have purchased an AAD instance. Procedure Step 1 Step 2 Step 3 Log in to the management console. Choose Security >. The page is displayed. In the upper right corner of the instance list, click Anti-DDoS Retrieval IP Address Segment. Step 4 In the displayed Anti-DDoS Retrieval IP Address Segment dialog box, view the information about the segment and add it to the whitelist of the firewall or other protective software of the origin server. Issue 17 ( ) Copyright Huawei Technologies Co., Ltd. 49

54 10 Viewing a Retrieval IP Address Segment Figure 10-1 Viewing a retrieval IP address segment ----End Issue 17 ( ) Copyright Huawei Technologies Co., Ltd. 50

55 11 Viewing a Protection Report 11 Viewing a Protection Report Scenario AAD shows normal traffic and attack traffic in two dimensions: byte and packet. You can view the normal traffic and attack traffic to know your network security situation. This section describes how to view an AAD report. Prerequisites You have obtained an account and its password to log in to the management console. You have purchased an AAD instance. Procedure Step 1 Step 2 Step 3 Step 4 Log in to the management console. Choose Security >. The page is displayed. In the navigation tree on the left, choose > Protection Report. Select the instance and IP address for which you want to view the protection report. Set the time range for the report, which includes the following options: 24 hours: provides historical protection data of the last 24 hours. The minimum scale of the timeline is 10 seconds. 3 days: provides historical protection data of the last 3 days. The minimum scale of the timeline is 5 minutes. 7 days: provides historical protection data of the last 7 days. The minimum scale of the time axis is 1 hour. 30 days: provides historical protection data of the last 30 days. The minimum scale of the time axis is 1 hour. Customize: Click, select the start date and time and end date and time, and click OK. You can query historical protection data of the last 90 days. The minimum scale of the timeline is determined based on the time range set and has the following options: Time range 24 hours: The minimum scale is 10 seconds. Issue 17 ( ) Copyright Huawei Technologies Co., Ltd. 51

56 11 Viewing a Protection Report 24 hours < time range 3 days: The minimum scale is 5 minutes. 3 days < time range 90 days: The minimum scale is 1 hour. Step 5 Click the Traffic tab to view the traffic report. Step 6 Click the Packet tab to view the packet report. Step 7 View security events. Security event information can be queried by the attack type. ----End Issue 17 ( ) Copyright Huawei Technologies Co., Ltd. 52

57 12 (Optional) Managing Enterprise Projects 12 (Optional) Managing Enterprise Projects The enterprise project feature allows you to define your own projects. For each project, you can separately manage AAD resources. Each project has its own AAD instance bills. This section guides customers with enterprise project management rights through the management of enterprise projects Creating an Enterprise Project Scenario AAD supports multi-project management. Enterprises can manage AAD resources by project. Prerequisites You have obtained the username and password for logging in to the management console and have the permission to manage enterprise projects. Procedure Step 1 Step 2 Step 3 Log in to the management console. In the upper right corner of the page, click your username. In the upper right corner of the page, click Enterprise. The Enterprise Management console is displayed. Step 4 Choose Enterprise Project Management from the navigation tree on the left and click Create. Issue 17 ( ) Copyright Huawei Technologies Co., Ltd. 53

58 12 (Optional) Managing Enterprise Projects Step 5 In the Create Enterprise Project dialog box, enter the project name and description, and click OK. ----End 12.2 Disabling an Enterprise Project Scenario Prerequisites Procedure AAD supports multi-project management. Enterprises can manage AAD resources by project. You have obtained the username and password for logging in to the management console and have the permission to manage enterprise projects. Step 1 Step 2 Step 3 Log in to the management console. In the upper right corner of the page, click your username. In the upper right corner of the page, click Enterprise. The Enterprise Management console is displayed. Issue 17 ( ) Copyright Huawei Technologies Co., Ltd. 54

59 12 (Optional) Managing Enterprise Projects Step 4 Choose Enterprise Project Management from the navigation tree on the left. In the Operation column of the enterprise project to be disabled, choose More > Disable. Step 5 In the Disable Enterprise Project dialog box, click Disable. ----End 12.3 Managing Resources for an Enterprise Project Scenario Prerequisites Procedure AAD supports multi-project management. Enterprises can manage AAD resources by project. You have obtained the username and password for logging in to the management console and have the permission to manage enterprise projects. Step 1 Step 2 Step 3 Log in to the management console. In the upper right corner of the page, click your username. In the upper right corner of the page, click Enterprise. The Enterprise Management console is displayed. Issue 17 ( ) Copyright Huawei Technologies Co., Ltd. 55

60 12 (Optional) Managing Enterprise Projects Step 4 Choose Enterprise Project Management from the navigation tree on the left. Then click View Resources in the Operation column of the desired project. Step 5 Add an AAD instance from another enterprise project. 1. On the Resources tab page, set Resource Type to AAD-aadinstance and click Add. 2. In the Add Resource dialog box, select the project, region, and resource type. Select AAD-aadinstance and AAD instances to be added. NOTE You cannot change the enterprise project for an AAD instance to which a protected domain name is connected. 3. Click OK. Issue 17 ( ) Copyright Huawei Technologies Co., Ltd. 56

61 12 (Optional) Managing Enterprise Projects Step 6 Remove an AAD instance from the enterprise project. 1. On the Resources tab page, set Resource Type to AAD-aadinstance, select AAD instances to be removed, and click Remove. NOTE You cannot change the enterprise project for an AAD instance to which a protected domain name is connected. 2. In the Remove Resource dialog box, select the enterprise project to which instances will be removed and click OK. ----End 12.4 Managing a User Group Scenario Prerequisites Procedure AAD supports multi-project management. Enterprises can manage AAD resources by project. You have obtained the username and password for logging in to the management console and have the permission to manage enterprise projects. Step 1 Log in to the management console. Issue 17 ( ) Copyright Huawei Technologies Co., Ltd. 57

62 12 (Optional) Managing Enterprise Projects Step 2 Step 3 In the upper right corner of the page, click your username. In the upper right corner of the page, click Enterprise. The Enterprise Management console is displayed. Step 4 Choose Enterprise Project Management from the navigation tree on the left. Then click View User Groups in the Operation column of the desired project. Step 5 Add a user group. 1. Click Add User Group. 2. In the Available area, select the user groups that you want to add to the enterprise project. Issue 17 ( ) Copyright Huawei Technologies Co., Ltd. 58

63 12 (Optional) Managing Enterprise Projects 3. Click to move the selected user groups to the Selected area. Issue 17 ( ) Copyright Huawei Technologies Co., Ltd. 59

64 12 (Optional) Managing Enterprise Projects 4. Click OK. Step 6 Remove a user group. 1. You can remove user groups one by one or in batches. To remove one user group, click Remove in the Operation column of the desired user group. To remove user groups in batches, select user groups and click the Remove button. 2. In the Remove User Group dialog box, click OK. ----End Issue 17 ( ) Copyright Huawei Technologies Co., Ltd. 60

65 12 (Optional) Managing Enterprise Projects 12.5 Viewing the Expenditures of an Enterprise Project Scenario Prerequisites Procedure AAD supports multi-project management. Enterprises can manage AAD resources by project. You have obtained the username and password for logging in to the management console and have the permission to manage enterprise projects. Step 1 Step 2 Step 3 Log in to the management console. In the upper right corner of the page, click your username. In the upper right corner of the page, click Enterprise. The Enterprise Management console is displayed. Step 4 Choose Enterprise Project Management from the navigation tree on the left. Then click View Expenditures in the Operation column of the desired project. Step 5 On the xxx - Dashboard (xxx indicates a project) page, set the time range. Then you can view information in the Amount, Spending Information, and Refund Overview areas. Issue 17 ( ) Copyright Huawei Technologies Co., Ltd. 61