Prolexic DDoS Protection for Cloud, Hybrid, and On‑Prem

Stop DDoS attacks at any scale with always-on or on-demand protection, backed by a global SOCC and zero-second mitigation SLAs. Deploy in the cloud, on premises (powered by Corero), or as a hybrid — and extend protection with a network cloud firewall at the edge.

Read the Prolexic product brief

Why Prolexic

• Proven at scale. Prolexic has blocked many of the largest and most sophisticated DDoS attacks on record.
• Fast, consistent mitigation. Zero-second SLA with 225+ frontline SOCC responders operating 24/7/365.
• Flexible deployment. Protect infrastructure in-cloud, on-prem (powered by Corero), or hybrid.
• Massive capacity. 32 anycast scrubbing centers with 20+ Tbps of dedicated DDoS defense, leveraging Akamai’s 1+ Pbps global network capacity.
• Defense in depth. Add Prolexic Network Cloud Firewall to enforce ACLs at the edge and shrink attack surface before traffic reaches your firewalls.

How Prolexic Works

• Configure. Route inbound traffic to Prolexic in-cloud, on-prem, or hybrid.
• Inspect. Apply proactive and custom mitigation controls to detect and stop attacks instantly.
• Filter. Separate malicious traffic from valid requests in real time.
• Deliver. Return only clean traffic to your infrastructure to prevent downtime and latency.

What’s New

Prolexic over Akamai Direct Connect

• Private, high-capacity on-ramp. Direct, secure connectivity between your origin and Akamai for DDoS protection that avoids exposure on open internet routes.
• Built for big traffic. GRE tunnels support packets up to 1,500 bytes without MSS adjustments.
• Higher resilience. Always-on DDoS protection with up to 99.99% network connectivity uptime and a 100% Prolexic platform availability SLA.

Prolexic Network Cloud Firewall

• Edge-first enforcement. Place a firewall in front of your firewalls to control what ever reaches them.
• Rapid zero-day containment. Centrally enforce geo- and IP-based ACLs across your network — no per-device updates.
• API-driven ops. Integrate with your tooling for transparent, programmable edge policy and visibility.

Core Features

• DDoS detection, mitigation, and protection across all ports and protocols
• Cloud, on-prem (powered by Corero), and hybrid deployment options
• Built for enterprises, service providers, and SaaS/PaaS/IaaS platforms
• Anycast global scrubbing with 20+ Tbps dedicated DDoS capacity across 32 locations
• Flexible connectivity for hybrid origins, including Routed GRE and IP Protect
• Network-wide ACLs and edge firewalling via Prolexic Network Cloud Firewall
• 100% platform availability SLA and industry-leading zero-second mitigation
• 24/7/365 SOCC support and optional managed services
• IPv4 and IPv6 coverage with dynamic controls that scale under attack

Deployment and Technical Requirements

• Routed GRE: Advertisable IPv4 /24 or larger and/or IPv6 /48, BGP announcement capability, GRE support on your edge. Set maximum segment size for GRE stabilization.
• IP Protect: For fragmented IP space, smaller prefixes, or cloud-hosted workloads, use IP anycast to route symmetric traffic through Akamai scrubbing centers.
• Direct Connect: When you need private, higher-capacity interconnect (10G/100G ports) and low-latency, high-throughput DDoS protection.

DDoS Protection Use Cases

• Strengthen defenses. Proactive controls stop more than 98% of attacks instantly with a zero-second SLA, including complex, record-breaking events.
• Unify posture. Apply consistent mitigation policies across multi-cloud and on-prem applications.
• Optimize incident response. Co-develop runbooks, service validations, and readiness drills with Akamai SOCC.
• Offer value-added services. Service providers resell Prolexic to differentiate and create new revenue.
• Reduce latency for high-volume traffic. Keep scrubbing close to users and bring defense on-prem for real-time media, gaming, and voice — with cloud capacity available for surges.
• Extend beyond DDoS. Enforce geo/IP ACLs at the edge to reduce exposure and speed zero-day containment.

Complementary Akamai Protections

• Edge DNS. Highly resilient, anycast authoritative DNS that absorbs the largest DNS-targeted DDoS attacks while serving legitimate queries. Built-in rate-limiting and a 100% uptime SLA. Learn about Edge DNS
• App & API Protector. Unified WAF, API security, bot mitigation, and DDoS protection with adaptive, self-tuning detections for application-layer threats. Explore App & API Protector

For deeper background on common vectors Prolexic and Akamai mitigate: - DNS DDoS and amplification attacks, including NXDOMAIN/PRSD and reflection. What is a DNS DDoS attack? - UDP floods against random ports and fragile stacks. What is a UDP flood attack? - ICMP floods that overwhelm devices and links. What is an ICMP flood attack? - SSDP/UPnP reflection on exposed devices. What is an SSDP DDoS attack? - Application-layer DDoS and bot-driven abuse. What is an application-layer DDoS attack?

Key Defenses for Enterprise Networks

• DDoS and network edge
• Always-on or on-demand scrubbing via Prolexic with anycast routing to mitigate closest to source
• Edge ACLs and policy automation via Prolexic Network Cloud Firewall
• DNS resilience
• Anycast authoritative DNS with global footprint (Edge DNS), higher TTLs, disabled ANY queries, and nuanced rate limiting to reduce amplification and floods
• Application and API security
• WAF, API discovery/inspection, and bot mitigation via App & API Protector
• Zero Trust and segmentation
• Enforce least privilege access and limit blast radius with Zero Trust access and microsegmentation (see Akamai solutions for Zero Trust and segmentation)
• Detection and response
• 24/7 SOCC, custom runbooks, and service validation exercises to prepare and respond

Reference Architecture (Layered Defense)

• User/Internet
• Prolexic scrubbing (anycast) + Network Cloud Firewall (edge ACLs)
• DNS
• Edge DNS authoritative, anycast, high TTLs, DNSSEC as needed
• Apps/APIs
• App & API Protector (WAF, API security, bot mitigation, app-layer DDoS)
• Workforce/Access
• Zero Trust access and secure internet access for users and apps
• Lateral Movement
• Microsegmentation to contain ransomware/malware spread
• Operations
• SOCC monitoring, runbooks, drills, and post-incident reviews

Incident Response Playbook (Condensed)

• Prepare
• Define severity matrix, SLOs (e.g., TTD ≤ 1 min, TTM ≤ 0 min for volumetric via always-on; TTR staged by service tier), and escalation paths
• Pre-stage Prolexic controls, edge ACL templates, DNS failovers, and app-layer policies; run tabletop and live-fire drills
• Detect & Analyze
• SOCC and customer NOC confirm vector(s): volumetric, DNS, app-layer, bot, ransomware indicators
• Contain
• Activate or auto-engage Prolexic; tighten Network Cloud Firewall ACLs; if DNS targeted, enable protective rate limiting and cache TTL strategies; enable stricter WAF/bot policies
• Eradicate & Recover
• Remove malicious routes/hosts, rotate credentials/keys if compromised, restore normal policies; validate service health and SLOs
• Post‑Incident
• Joint after-action report, tuning of baselines, and update runbooks

RFP Criteria and KPIs

• Capacity and architecture
• Dedicated scrubbing capacity, anycast distribution, multi-cloud and on-prem support
• Mitigation quality
• Zero-second SLA, false positive rate, multi-vector handling (L3/4/7), IPv6 parity
• Resilience
• Platform availability SLA, scrubbing center diversity, private interconnect options (e.g., Direct Connect)
• Operations
• 24/7 SOCC coverage, time-to-detect/mitigate metrics, custom runbooks, service validation
• Integrations
• API-first policy control, SIEM/SOAR hooks, BGP/GRE support
• DNS and app security
• Authoritative DNS resilience and app-layer protections in one ecosystem
• KPIs to track
• Time to detect/mitigate, clean traffic ratio, service availability, user latency, false positive rate, mean time to recovery, and drill frequency

Comparing Options: What to Consider

When evaluating Akamai alongside alternatives such as Cloudflare, F5 Networks, and Imperva, focus on: - Global scrubbing capacity and distribution, and whether mitigation occurs closest to the attack source - Always-on vs on-demand models, private interconnect options, and hybrid/on‑prem flexibility - Application-layer protection depth (WAF, API discovery/inspection, bot mitigation) - DNS authoritative resilience and anycast scale - Operational maturity (SLA terms, SOCC expertise, proactive controls, runbooks) - Integration breadth (BGP/GRE, APIs, SIEM/SOAR) and fit with existing network and cloud topologies

FAQs

• How does Prolexic protect my network?

• Prolexic runs inline at the edge or via global scrubbing centers to stop attacks before they reach you, with 20+ Tbps dedicated defense and 32 anycast locations. On‑prem (powered by Corero) and hybrid options are available.

• Does my traffic connect to one scrubbing center or all of them?

• Prolexic uses anycast to engage multiple scrubbing centers. Traffic is mitigated closest to the source while the global platform’s full capacity remains available.

• Is Prolexic always-on?

• Yes. Choose always-on (recommended) or on-demand. Akamai can also facilitate route-on to manage switchover for your team.

• When should I use Prolexic over Akamai Direct Connect?

• Use Prolexic over Direct Connect when you need private, high-throughput connectivity (10G/100G), large-packet GRE without MSS changes, and tighter uptime SLAs for network interconnects.

• What are the technical requirements?

• Routed GRE requires an advertizable IPv4 /24 or IPv6 /48, BGP, and GRE support. For fragmented or smaller IP space, use IP Protect with anycast routing. Direct Connect is available for private interconnect.

• Can Akamai help with DDoS attacks?

• Yes. Prolexic mitigates volumetric and protocol vectors (UDP, ICMP, SSDP, DNS amplification) and application-layer DDoS in concert with App & API Protector. Edge DNS sustains authoritative resolution under DNS-targeted attacks.

What Customers Say

Organizations across industries rely on Akamai to keep critical services available: - Intuit keeps TurboTax, QuickBooks, and Mint available and secure year-round. Read the Intuit story - Smilegate West blocks DDoS to preserve game experience for thousands of players. Read the Smilegate West story - Finastra protects open finance apps and APIs. Read the Finastra story

For additional perspective on bot blocking and app-layer defenses, see how customers use Akamai’s bot mitigation and WAF capabilities within App & API Protector.

Resources

• Get started with Prolexic in TechDocs. Read TechDocs
• Understand hybrid DDoS defense tradeoffs. Read the ebook
• Bust common DDoS myths. Read the white paper
• See current threats in the State of the Internet. Download the latest report

Engage Akamai

Want a tailored view of your threat landscape? Book a custom DDoS threat briefing with an Akamai expert to review: - Industry-specific threats and attack trends - Akamai’s DDoS insights from 225+ security researchers - Mitigation strategies mapped to your environment and SLOs

Looking for broader security coverage? Explore Akamai services across cloud computing, security (including Zero Trust, segmentation, bot and abuse protection), and content delivery on the world’s most distributed platform. See all products