Lumen uses multiple layers of defense including our global internet backbone, intelligent scrubbing centers, extensive peering and Black Lotus Labs® threat intelligence. All of this works together to proactively block threats before they become attacks.

Customers can choose between two models of mitigation:

1. On-Demand mitigation: traffic is only scrubbed when an attack is detected, or mitigation is activated. Your network is still constantly monitored.
2. Always-On mitigation: traffic is continually scrubbed and monitored.

• On-Demand or Always-On DDoS attack mitigation
• Clean-traffic return over Lumen® Dedicated Internet Access (DIA), providing a direct internet path to the customer
• Up to 100 Gbps of clean traffic return with up to 10 clean traffic return paths (CTRP) and 10 Flow-Based Monitoring (FBM) instances; Up to 50 CTRPs and FBM instances are available for an additional charge 
• Real-time portal access to analyze performance during peacetime, day two management with event reporting and extensive attack visibility, historical threat data and the ability to make changes to your solution
• Optional services:
  • SOC Advanced Support provides run book development, analysis and reporting tailored to your business needs
  • Web Application Firewall (WAF) provides web application firewall, API protection and Bot Risk Management for additional layer 7 defense

Lumen DDoS Hyper can be ordered online through Lumen Connect℠ (for existing Lumen customers) or by contacting your Lumen Sales Representative. We will invoice your order. No credit card is required.  

Once you accept the quote and terms of the service you will be redirected to Lumen Connect℠ where the technical parameters to provision your service will be gathered. This includes the IP address space that needs to be protected, the IP address(es) of the GRE tunnel(s) or Lumen internet circuits and information needed to collect NetFlow from your router or Lumen edge router.

Lumen has developed a solution that can protect the wide spectrum of our customers’ needs.

If your internet is NOT provided by Lumen:

• You must have a router (CPE) capable of GRE tunnel termination and able to support the GRE throughput requirement for your service, BGP advertisements, NetFlow generation and IP address space of at least /24 or larger.***

• You will also need a public ASN. 

If your internet IS provided by Lumen:

• You must have a qualified Lumen internet circuit on AS3356.

• Note that this configuration can protect subnets smaller than /24 and can protect a single host IP at a time.

There are some Lumen internet services that may require additional configuration to work with DDoS Hyper. We have two models in which we can support Lumen network customers.

Internet Direct:

• Must be a Lumen DIA/HSIP service on AS3356 
• BGP; or static routing; or no routing protocols with WAN IP up to a /27
• DDoS protection type must be On-Demand if there is a Lumen managed router 
• Multiport circuits not supported (combination DIA/MPLS circuits on different VLANs) 

GRE:

• Customer must be able to configure a GRE tunnel with BGP peering 
• Non-Lumen internet service customers can use a GRE tunnel for clean traffic return with BGP peering.

Once you accept the quote and terms of the service you will be redirected to Lumen Connect℠ where the technical parameters to provision your service will be gathered. This includes the IP address space that needs to be protected, the IP address(es) of the GRE tunnel(s) or Lumen Internet circuits and information needed to collect NetFlow from your router or Lumen edge router. 

You can track the status of your order in our portal, Lumen Connect℠. The service is provisioned in near real-time. Once the service is provisioned, we will notify you and provide you with configuration parameters, if applicable, for your CPE to make it work with the Lumen DDoS Hyper service.

You can add security consultant hours to your DDoS Hyper service on a monthly basis. This designated security consultant can: 

• Walk-through pre-activation 

• Assist with portal enrollment and training 

• Develop custom runbooks 

• Help with reviews and policy verifications for analysis and optimal configuration 

• Write reports containing analysis, advice and recommendations.  

It depends on what mitigation model you’ve purchased. 

On-Demand customer options:

• SOC-assisted: The Lumen SOC automatically detects the attack, notifies the customer and begins mitigating the attack once customer approval is given. 

• Auto-mitigation: The Lumen SOC, subject to customer pre-approval, sets up auto-mitigation, which allows mitigation to occur when an attack is detected.  

• Customer-requested: You may choose the option to contact the Lumen SOC when under attack to request the start of mitigation.  

Always‑On customer options:

• Always scrubbed: Your traffic is always routed through Lumen mitigation infrastructure. There is no need to request mitigation since the traffic is always being cleaned. Attack notifications can be set up with our SOC. 

• Customer-initiated: Mitigation is in your hands. Customers have complete control over initiating mitigation. You can contact the Lumen SOC if you need additional help.