Add-AzDdosCustomPolicyMitigationRule
Adds a mitigation rule to an in-memory DDoS custom policy.
Syntax
Default (Default)
Add-AzDdosCustomPolicyMitigationRule
-DdosCustomPolicy <PSDdosCustomPolicy>
-Name <String>
-TrafficScope <String>
[-TcpPacketsPerSecond <Int32>]
[-TcpConnectionsPerSecond <Int32>]
[-UdpPacketsPerSecond <Int32>]
[-DenyIpPrefix <String[]>]
[-DenyGeoMatch <String[]>]
[-PermitIpPrefix <String[]>]
[-PermitGeoMatch <String[]>]
[-DefaultProfile <IAzureContextContainer>]
[-WhatIf]
[-Confirm]
[-AcquirePolicyToken]
[-ChangeReference <String>]
[<CommonParameters>]
Description
The Add-AzDdosCustomPolicyMitigationRule cmdlet creates a mitigation rule and adds it to a DDoS custom policy object. Deny matches drop traffic from matching sources. Permit matches skip source-level mitigations for matching sources, while destination-level mitigations still apply. Within one action, IP prefixes and geographic matches use OR semantics.
Geographic matches use <Country>, <Continent>, or <Continent>.<Country> format, such as US, Africa, or Africa.ZM. The cmdlet does not update Azure. Pipe the returned policy to Set-AzDdosCustomPolicy to persist the change.
Examples
Example 1: Add and persist a UDP mitigation rule
$policy = Get-AzDdosCustomPolicy -ResourceGroupName "myRG" -Name "myPolicy"
$policy | Add-AzDdosCustomPolicyMitigationRule -Name "udpRule" -TrafficScope Udp -UdpPacketsPerSecond 90000 -DenyIpPrefix "192.0.2.0/24" | Set-AzDdosCustomPolicy
This example adds a UDP per-source packet rate limit with a prefix-specific Deny action and persists the updated policy.
Parameters
-AcquirePolicyToken
Acquire an Azure Policy token automatically for this resource operation.
Parameter properties
Type: SwitchParameter
Default value: None Supports wildcards: False DontShow: False
Parameter sets
(All)
Position: Named Mandatory: False Value from pipeline: False Value from pipeline by property name: False Value from remaining arguments: False
-ChangeReference
The change reference resource ID for this resource operation.
Parameter properties
Type: String
Default value: None Supports wildcards: False DontShow: False
Parameter sets
(All)
Position: Named Mandatory: False Value from pipeline: False Value from pipeline by property name: False Value from remaining arguments: False
-Confirm
Prompts you for confirmation before running the cmdlet.
Parameter properties
Type: SwitchParameter
Default value: None Supports wildcards: False DontShow: False Aliases: cf
Parameter sets
(All)
Position: Named Mandatory: False Value from pipeline: False Value from pipeline by property name: False Value from remaining arguments: False
-DdosCustomPolicy
Specifies the DDoS custom policy object to modify.
Parameter properties
Parameter sets
(All)
Position: Named Mandatory: True Value from pipeline: True Value from pipeline by property name: True Value from remaining arguments: False
-DefaultProfile
The credentials, account, tenant, and subscription used for communication with Azure.
Parameter properties
Type: IAzureContextContainer
Default value: None Supports wildcards: False DontShow: False Aliases: AzContext, AzureRmContext, AzureCredential
Parameter sets
(All)
Position: Named Mandatory: False Value from pipeline: False Value from pipeline by property name: False Value from remaining arguments: False
-DenyGeoMatch
Specifies geographic sources whose matching traffic is dropped. Use <Country>, <Continent>, or <Continent>.<Country> format. Deny IP prefixes and geographic matches use OR semantics.
Parameter properties
Type: String [ ]
Default value: None Supports wildcards: False DontShow: False
Parameter sets
(All)
Position: Named Mandatory: False Value from pipeline: False Value from pipeline by property name: False Value from remaining arguments: False
-DenyIpPrefix
Specifies IPv4 or IPv6 CIDR prefixes whose matching traffic is dropped. Deny IP prefixes and geographic matches use OR semantics.
Parameter properties
Type: String [ ]
Default value: None Supports wildcards: False DontShow: False
Parameter sets
(All)
Position: Named Mandatory: False Value from pipeline: False Value from pipeline by property name: False Value from remaining arguments: False
-Name
Specifies the unique name of the mitigation rule.
Parameter properties
Type: String
Default value: None Supports wildcards: False DontShow: False
Parameter sets
(All)
Position: Named Mandatory: True Value from pipeline: False Value from pipeline by property name: False Value from remaining arguments: False
-PermitGeoMatch
Specifies geographic sources that skip source-level mitigations. Destination-level mitigations still apply. Use <Country>, <Continent>, or <Continent>.<Country> format. Permit IP prefixes and geographic matches use OR semantics.
Parameter properties
Type: String [ ]
Default value: None Supports wildcards: False DontShow: False
Parameter sets
(All)
Position: Named Mandatory: False Value from pipeline: False Value from pipeline by property name: False Value from remaining arguments: False
-PermitIpPrefix
Specifies IPv4 or IPv6 CIDR prefixes that skip source-level mitigations. Destination-level mitigations still apply. Permit IP prefixes and geographic matches use OR semantics.
Parameter properties
Type: String [ ]
Default value: None Supports wildcards: False DontShow: False
Parameter sets
(All)
Position: Named Mandatory: False Value from pipeline: False Value from pipeline by property name: False Value from remaining arguments: False
-TcpConnectionsPerSecond
Specifies the maximum new TCP connection rate per source IP address.
Parameter properties
Type: Nullable<T> [ Int32 ]
Default value: None Supports wildcards: False DontShow: False
Parameter sets
(All)
Position: Named Mandatory: False Value from pipeline: False Value from pipeline by property name: False Value from remaining arguments: False
-TcpPacketsPerSecond
Specifies the maximum TCP packet rate per source IP address.
Parameter properties
Type: Nullable<T> [ Int32 ]
Default value: None Supports wildcards: False DontShow: False
Parameter sets
(All)
Position: Named Mandatory: False Value from pipeline: False Value from pipeline by property name: False Value from remaining arguments: False
-TrafficScope
Specifies the traffic protocol to which the rule applies. Common values are Tcp and Udp.
Parameter properties
Type: String
Default value: None Supports wildcards: False DontShow: False
Parameter sets
(All)
Position: Named Mandatory: True Value from pipeline: False Value from pipeline by property name: False Value from remaining arguments: False
-UdpPacketsPerSecond
Specifies the maximum UDP packet rate per source IP address.
Parameter properties
Type: Nullable<T> [ Int32 ]
Default value: None Supports wildcards: False DontShow: False
Parameter sets
(All)
Position: Named Mandatory: False Value from pipeline: False Value from pipeline by property name: False Value from remaining arguments: False
-WhatIf
Shows what would happen if the cmdlet runs.
The cmdlet is not run.
Parameter properties
Type: SwitchParameter
Default value: None Supports wildcards: False DontShow: False Aliases: wi
Parameter sets
(All)
Position: Named Mandatory: False Value from pipeline: False Value from pipeline by property name: False Value from remaining arguments: False
CommonParameters
This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable,
-InformationAction, -InformationVariable, -OutBuffer, -OutVariable, -PipelineVariable,
-ProgressAction, -Verbose, -WarningAction, and -WarningVariable. For more information, see
about_CommonParameters .
Outputs
