Configure DDoS Detection

Published April 5, 2023 | Last modified November 9, 2026

Overview

L7 DDoS Detection continuously monitors application traffic on each F5 Distributed Cloud Regional Edge (RE) to identify conditions that indicate potential degradation of the protected origin.

Detection is based on deviations from dynamically learned traffic baselines. Each RE continuously monitors the following application health metrics:

HTTP error responses returned by the origin
Upstream connectivity failures
Request latency

When an anomaly is detected, the RE sends a detection event to the centralized controller. The controller aggregates detection events from all Regional Edges and evaluates the aggregated traffic against the configured request rate threshold.

An L7 DDoS event is declared only when both of the following conditions are met:

Detection signals indicate degradation of the protected application.
The configured requests-per-second (RPS) threshold is exceeded.

Automatic L7 DDoS Mitigation

When an L7 DDoS event is declared, automatic mitigation is initiated.

To maximize mitigation precision, the system identifies clients using one or more of the following attributes:

Source IP address
Source IP metadata (for example, geographic location)
Targeted HTTP endpoint
TLS fingerprint (JA3/JA4)

Automatic mitigation actions are applied only to the client populations identified as the primary contributors to the detected degradation.

Note: If your application is deployed behind a CDN, reverse proxy, or another trusted intermediary that forwards the original client IP address, enable Trusted Client IP Headers. This ensures that L7 DDoS Detection evaluates the original client IP address (for example, from the X-Forwarded-For header) instead of the intermediary's IP address.

Depending on how a client is identified, automatic mitigation generates dynamic access control lists (ACLs):

Clients identified only by IP address are blocked using Fast ACL at Layer 3/Layer 4.
Clients identified using additional attributes are blocked using a Service Policy at Layer 7.

Automatic mitigation is iterative. If degradation persists after the initial mitigation actions, additional ACLs are generated until application health returns to normal.

Automatically generated mitigation ACLs remain active for 20 minutes.

Note: When Trusted Client IP Headers is enabled, automatic mitigation rules are enforced only at Layer 7.

Monitor L7 DDoS Events

You can monitor L7 DDoS activity from the Distributed Cloud Console.

During and after an L7 DDoS event, the Distributed Cloud Console provides visibility into detected attacks, mitigation activity, and traffic trends. This information helps you understand when an attack is detected and how automatic mitigation protects the application.

Configure L7 DDoS Protection

Configure L7 DDoS Detection and Mitigation from your HTTP Load Balancer:

Navigate to Manage > HTTP load balancers in the Distributed Cloud Console.
Click Edit on your target HTTP load balancer configuration.
Scroll to the L7 DDoS Protection section.
Configure the Mitigation Settings and Protection Settings as needed.

Setting	Description	Default
Mitigation Action	Enforcement action automatically applied to identified clients during an L7 DDoS event. Options: Block, JavaScript Challenge, or CAPTCHA Challenge.	Block
RPS Threshold	Minimum HTTP request rate that must be exceeded before an L7 DDoS event is declared.	10,000 requests per second

Protection Settings

Protection Settings allow administrators to configure additional protections that are activated during an L7 DDoS event. These settings complement automatic mitigation and apply to clients that aren't automatically mitigated.