Ingress Protection limits the impact of Distributed Denial of Service (DDoS) attacks by automatically flagging excessive incoming traffic (so called "volumetric attacks") and blocking the sources of those attacks. This is applied to Layer 3 (IP) and Layer 4 (TCP and UDP) network protocols, but does not inspect content within packets to identify if this is a known attack or provide finer grained awareness of attacks.

All traffic which is directed towards resources hosted by Catalyst Cloud from the Internet is passed through this protection layer, it does not need to be activated specifically for your account or resources. As it applies to all Internet traffic, it is not possible to opt-out of the protection layer. Direct Connect traffic does not come via the Internet, and is not passed through the protection layer.

We strongly recommend that you purchase Premium Support to ensure you have access to our support channels should you experience any kind of attack.

The Ingress Protection service is powered by Cloudflare, the world-wide leaders in protecting services on the Internet and trusted by millions of Internet properties. Cloudflare can scrub traffic in more than 200 locations, ensuring that you are protected as early as possible from attack sources and at rates over 59Tbit/s. Mitigation will typically kick-in at under 3 seconds, ensuring that your service experiences as little disruption as possible when attacked.

As the service only looks at volumetric attacks in Layer 3 and Layer 4, any encrypted data is not accessible by CloudFlare.