Experiences with affordable DDoS protection in locations outside the US and EU

Cybr

Anyone have good/bad experiences with protection in locations like Asia, South America, Africa, or anywhere else outside the US and EU?

stefeman

Only considerable ones with enough capacity but still affordable in Asia are OVH and StreamLineServers and PhoenixNAP.

For Africa, the only one is Psychz and its super weak.

For South America, its Psychz and MaxiHost.

Then theres X4B but they are reseller that builded their own anti-ddos system over other providers as far as I know. Basically a remote tunnel.

SplitIce

We operate in Brazil, Singapore and Japan. With more locations coming soon.

We arent a reseller we work with DDoS protected networks to realize our product which we develop in-house.

Asia and South America are really complex locations to offer service in with complex domestic relationships. To give you an example, this is a ticket reply we made recently (warning: long) detailing an issue with a regional service provider.

Hi,

We received a response from senior engineers at GTT last night. Unfortunately it was not positive.

---

yes this is something designed on purpose to avoid to black-hole traffic in case the destination network is our client and it has GTT as single upstream provider.
AS4230 (CLARO S.A.) is our direct client and this is the reason why that community doesn't work .

---

After hours of investigation today we have learnt that at this stage we can not influence this route. Downstreams of AS4230 (such as AS28573 "Virtua") are transited exclusively in the US via GTT in Miami. There is no official way for us to influence this directly.

The route for this looks similar to this:

1 192.168.0.1 2.449ms 0.969ms 0.808ms
2 10.11.128.1 17.262ms 13.755ms 13.907ms
3 191.187.32.2 bfbb2002.virtua.com.br AS28573 13.87ms 12.892ms 11.914ms
4 200.179.231.1 AS4230 16.248ms 10.835ms 12.381ms
5 200.244.25.253 ebt-P4-2-2-core01.cem.embratel.net.br AS4230 15.91ms 15.77ms 17.715ms
6 200.230.220.82 ebt-B3102-intl04.mianap.embratel.net.br AS4230 132.008ms 135.666ms 129.509ms
7 200.230.252.201 ebt-B101-intl03.mianap.embratel.net.br AS4230 131.828ms 133.429ms 133.809ms
8 209.120.131.129 ae21.cr6-mia1.ip4.gtt.net AS3257 145.839ms 143.64ms 143.651ms

Virtua's owner / singular upstream Embratel does peer at IX.br (as do we) this means that any route to a location we are peered at will take a better route, directly to us in Brazil. Embratel does not backhaul routes between IX.br PoPs. I'm unsure if this is something they can enable (I am not optimistic) however I have contacted them (presently without response).

With IX.br We are peered in Sao Paulo, but not Rio. Meaning locations close to SP will get a good route currently.

CTBC telecom our primary domestic upstream is not well connected to Embratel subsidiaries and child ASNs.

In summary -
1. AS4230 (Embratel aka CLARO) reaches us over CTBC
2. AS28573 (Virtua "CLARO") reaches us over IX.br SP or GTT Miami otherwise
3. AS16735 (Algar) reaches us over CTBC
4. Any downstream of AS4230 (Embratel aka CLARO) reaches us via GTT Miami, unless of course they have IX.br SP peering

We are lighting up an additional transit provider (Lumen aka Level3) in Brazil (replacing NTT, and in the future possibly Sparkle). Exact dates are not available at this time however there is the possibility we may be able to begin their integration within a fortnight. We hope this may give us some options in regards to this route. At this time however I think we have done everything out our disposal.

Currently if we are to take immediate action to resolve your route we have a few options:
[...]

That being said the environment is getting better. Cases like this getting rarer (for example we no longer have any cases like this in Singapore, previously we had a big one between Singapore and PLDT in Philippines)/

Fortunately in this case we hope to resolve it with an upcoming new transit provider. However it's frustrating when eyeball network greed creates a bad situation for everyone and it's something thats unfortunately far to common in the developing world.

CConner

@stefeman said: Only considerable ones with enough capacity but still affordable in Asia are OVH and StreamLineServers and PhoenixNAP.

We're currently working with Streamline aka GSL Networks on the deployment of their network in Equinix Amsterdam and Frankfurt. As with all of their POPs they are deploying inline, always-on Corero devices. Might be worth considering as they are able to offer some great pricing there.