New-AzDdosCustomPolicyMitigationRule

Module:

Az.Network Module

Creates a DDoS custom policy mitigation rule.

Syntax

Default (Default)

New-AzDdosCustomPolicyMitigationRule
    -Name <String>
    -TrafficScope <String>
    [-TcpPacketsPerSecond <Int32>]
    [-TcpConnectionsPerSecond <Int32>]
    [-UdpPacketsPerSecond <Int32>]
    [-DenyIpPrefix <String[]>]
    [-DenyGeoMatch <String[]>]
    [-PermitIpPrefix <String[]>]
    [-PermitGeoMatch <String[]>]
    [-DefaultProfile <IAzureContextContainer>]
    [-WhatIf]
    [-Confirm]
    [-AcquirePolicyToken]
    [-ChangeReference <String>]
    [<CommonParameters>]

Description

The New-AzDdosCustomPolicyMitigationRule cmdlet creates an in-memory mitigation rule for TCP or UDP traffic. Deny matches drop traffic from matching sources. Permit matches skip source-level mitigations for matching sources, while destination-level mitigations still apply. Within one action, IP prefixes and geographic matches use OR semantics, so a source matches if it matches any entry.

Geographic matches use <Country>, <Continent>, or <Continent>.<Country> format, such as US, Africa, or Africa.ZM. Pass the rule to New-AzDdosCustomPolicy or add it to an existing policy object.

Examples

Example 1: Create a TCP mitigation rule

$rule = New-AzDdosCustomPolicyMitigationRule -Name "tcpRule" -TrafficScope Tcp -TcpPacketsPerSecond 100000 -TcpConnectionsPerSecond 10000

This example creates a TCP rule with per-source packet and new-connection rate limits.

Example 2: Create a UDP rule with source actions

$rule = New-AzDdosCustomPolicyMitigationRule -Name "udpRule" -TrafficScope Udp -UdpPacketsPerSecond 90000 -DenyIpPrefix "192.0.2.0/24" -PermitGeoMatch "US", "Africa.ZM"

This example creates a UDP rule that drops traffic from the specified IP prefix and skips source-level mitigations for traffic from the specified geographic sources.

Parameters

-AcquirePolicyToken

Acquire an Azure Policy token automatically for this resource operation.

Parameter properties

Type:	SwitchParameter
Default value:	None
Supports wildcards:	False
DontShow:	False

Parameter sets

(All)

Position:	Named
Mandatory:	False
Value from pipeline:	False
Value from pipeline by property name:	False
Value from remaining arguments:	False

-ChangeReference

The change reference resource ID for this resource operation.

Parameter properties

Type:	String
Default value:	None
Supports wildcards:	False
DontShow:	False

Parameter sets

(All)

Position:	Named
Mandatory:	False
Value from pipeline:	False
Value from pipeline by property name:	False
Value from remaining arguments:	False

-Confirm

Prompts you for confirmation before running the cmdlet.

Parameter properties

Type:	SwitchParameter
Default value:	None
Supports wildcards:	False
DontShow:	False
Aliases:	cf

Parameter sets

(All)

Position:	Named
Mandatory:	False
Value from pipeline:	False
Value from pipeline by property name:	False
Value from remaining arguments:	False

-DefaultProfile

The credentials, account, tenant, and subscription used for communication with Azure.

Parameter properties

Type:	IAzureContextContainer
Default value:	None
Supports wildcards:	False
DontShow:	False
Aliases:	AzContext, AzureRmContext, AzureCredential

Parameter sets

(All)

Position:	Named
Mandatory:	False
Value from pipeline:	False
Value from pipeline by property name:	False
Value from remaining arguments:	False

-DenyGeoMatch

Specifies geographic sources whose matching traffic is dropped. Use <Country>, <Continent>, or <Continent>.<Country> format. Deny IP prefixes and geographic matches use OR semantics.

Parameter properties

Type:	String[]
Default value:	None
Supports wildcards:	False
DontShow:	False

Parameter sets

(All)

Position:	Named
Mandatory:	False
Value from pipeline:	False
Value from pipeline by property name:	False
Value from remaining arguments:	False

-DenyIpPrefix

Specifies IPv4 or IPv6 CIDR prefixes whose matching traffic is dropped. Deny IP prefixes and geographic matches use OR semantics.

Parameter properties

Type:	String[]
Default value:	None
Supports wildcards:	False
DontShow:	False

Parameter sets

(All)

Position:	Named
Mandatory:	False
Value from pipeline:	False
Value from pipeline by property name:	False
Value from remaining arguments:	False

-Name

The mitigation rule name.

Parameter properties

Type:	String
Default value:	None
Supports wildcards:	False
DontShow:	False

Parameter sets

(All)

Position:	Named
Mandatory:	True
Value from pipeline:	False
Value from pipeline by property name:	False
Value from remaining arguments:	False

-PermitGeoMatch

Specifies geographic sources that skip source-level mitigations. Destination-level mitigations still apply. Use <Country>, <Continent>, or <Continent>.<Country> format. Permit IP prefixes and geographic matches use OR semantics.

Parameter properties

Type:	String[]
Default value:	None
Supports wildcards:	False
DontShow:	False

Parameter sets

(All)

Position:	Named
Mandatory:	False
Value from pipeline:	False
Value from pipeline by property name:	False
Value from remaining arguments:	False

-PermitIpPrefix

Specifies IPv4 or IPv6 CIDR prefixes that skip source-level mitigations. Destination-level mitigations still apply. Permit IP prefixes and geographic matches use OR semantics.

Parameter properties

Type:	String[]
Default value:	None
Supports wildcards:	False
DontShow:	False

Parameter sets

(All)

Position:	Named
Mandatory:	False
Value from pipeline:	False
Value from pipeline by property name:	False
Value from remaining arguments:	False

-TcpConnectionsPerSecond

The maximum new TCP connection rate per source IP.

Parameter properties

Type:	Nullable<T>[Int32]
Default value:	None
Supports wildcards:	False
DontShow:	False

Parameter sets

(All)

Position:	Named
Mandatory:	False
Value from pipeline:	False
Value from pipeline by property name:	False
Value from remaining arguments:	False

-TcpPacketsPerSecond

The maximum TCP packet rate per source IP.

Parameter properties

Type:	Nullable<T>[Int32]
Default value:	None
Supports wildcards:	False
DontShow:	False

Parameter sets

(All)

Position:	Named
Mandatory:	False
Value from pipeline:	False
Value from pipeline by property name:	False
Value from remaining arguments:	False

-TrafficScope

The traffic protocol to which the rule applies.

Parameter properties

Type:	String
Default value:	None
Supports wildcards:	False
DontShow:	False

Parameter sets

(All)

Position:	Named
Mandatory:	True
Value from pipeline:	False
Value from pipeline by property name:	False
Value from remaining arguments:	False

-UdpPacketsPerSecond

The maximum UDP packet rate per source IP.

Parameter properties

Type:	Nullable<T>[Int32]
Default value:	None
Supports wildcards:	False
DontShow:	False

Parameter sets

(All)

Position:	Named
Mandatory:	False
Value from pipeline:	False
Value from pipeline by property name:	False
Value from remaining arguments:	False

-WhatIf

Shows what would happen if the cmdlet runs. The cmdlet is not run.

Parameter properties

Type:	SwitchParameter
Default value:	None
Supports wildcards:	False
DontShow:	False
Aliases:	wi

Parameter sets

(All)

Position:	Named
Mandatory:	False
Value from pipeline:	False
Value from pipeline by property name:	False
Value from remaining arguments:	False

CommonParameters

This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutBuffer, -OutVariable, -PipelineVariable, -ProgressAction, -Verbose, -WarningAction, and -WarningVariable. For more information, see about_CommonParameters.

Inputs

None

Outputs

Microsoft.Azure.Commands.Network.Models.PSDdosCustomPolicyMitigationRule

Related Links

• New-AzDdosCustomPolicy
• Add-AzDdosCustomPolicyMitigationRule