Application Hosting Configuration Guide for Cisco 8000 Series Routers, Cisco IOS XR Releases

PDF

Application Hosting Configuration Guide for Cisco 8000 Series Routers, Cisco IOS XR Releases

Cisco Secure DDoS Edge Protection

Updated: June 12, 2026

Want to summarize with AI?

Describes how Cisco Secure DDoS Edge Protection identifies and mitigates distributed denial-of-service (DDoS) attacks at the network edge, enhancing overall security and minimizing impact on core bandwidth.

A Cisco Secure DDoS Edge Protection feature is a network security mechanism that

enables routers to respond immediately to DDoS threats at the network edge
allows malicious traffic to be identified and counteracted directly on the router, and
minimizes network and application impact without affecting core bandwidth by avoiding backhaul of malicious traffic.

A centralized controller manages DDoS mitigation using information from detectors deployed on routers. These detectors analyze IPv4 and IPv6 traffic in real time to identify DDoS attacks. Upon detection, the controller enforces deny ACLs to block malicious traffic while allowing legitimate traffic.

Feature history

This table provides the feature history for Cisco Secure DDoS Edge Protection:

Table 1. Feature history table
Feature name	Release information	Description
Cisco Secure DDoS Edge Protection	Release 25.4.1	Introduced in this release on: Fixed Systems (8010 [ASIC: A100]) (select variants only) This feature is supported on: 8011-32Y8L2H2FH 8011-12G12X4Y-A/D
Cisco Secure DDoS Edge Protection	Release 25.2.1	Introduced in this release on: Fixed Systems (8200 [ASIC: Q200, P100], 8700 [ASIC: P100, K100], 8010 [ASIC: A100]) (select variants only); Centralized Systems (8600 [ASIC: Q200]); Modular Systems (8800 [LC ASIC: Q100, Q200, P100]) (select variants only) You can now enable the router to detect DDoS attacks targeting MPLS traffic using DDoS edge protection. The router analyzes MPLS flows to identify malicious traffic patterns, ensuring the availability and performance of services traversing MPLS networks.
Cisco Secure DDoS Edge Protection	Release 25.1.1	Introduced in this release on: Fixed Systems (8700 [ASIC: K100], 8010 [ASIC: A100]) (select variants only) This feature is supported on: 8712-MOD-M 8011-4G24Y4H-I
Cisco Secure DDoS Edge Protection	Release 24.4.1	Introduced in this release on: Fixed Systems (8200 [ASIC: P100], 8700 [ASIC: P100]) (select variants only); Modular Systems (8800 [LC ASIC: P100]) (select variants only) *This feature is now supported on: 8212-48FH-M 8711-32FH-M 88-LC1-36EH 88-LC1-12TH24FH-E 88-LC1-52Y8H-EM
Cisco Secure DDoS Edge Protection	Release 24.1.1	You can now efficiently block malicious traffic, safeguarding your network's performance and availability. Protection against DDoS attacks is implemented at the network edge, deployed at the ingress point where external network traffic enters. A centralized controller manages DDoS mitigation using information from detectors deployed on the routers. These detectors analyze IPv4 and IPv6 traffic in real time to identify DDoS attacks. Upon detection, the controller enforces deny ACLs to block malicious traffic while allowing legitimate traffic.

Key components and advantages of Cisco Secure DDoS Edge Protection

Cisco Secure DDoS Edge Protection uses a centralized controller and detectors deployed on routers to identify DDoS attacks at the network edge and mitigate malicious traffic at the ingress point.

Cisco Secure DDoS Edge Protection consists of these components:

Table 2. Cisco Secure DDoS Edge Protection components
Component	Description
Centralized controller	A highly available centralized controller, cloud-based or on-premises, that manages a collection of detectors deployed on routers. Key functions include: Managing the container lifecycle for detectors Configuring and editing detector profiles and security settings Checking detector health, displaying real-time attack forensics and threat intelligence analyses Controlling DDoS attack mitigation at the network ingress point Providing real-time and historical event reporting Operational control and incident response
Detector	A resource-efficient application container for real-time DDoS detection, deployed on edge or peering routers and managed by the centralized controller. It analyzes IPv4 and IPv6 traffic on each ingress interface to identify DDoS attacks as they occur. Starting from Cisco IOS XR Release 25.2.1, MPLS traffic is also analyzed using extracted information from the IPv4 and IPv6 payload to detect DDoS attacks accurately.

Upon detecting a DDoS attack, the centralized controller promptly enforces a deny ACL to block the attack traffic while still allowing legitimate traffic to pass through.

Cisco Secure DDoS Edge Protection provides these benefits:

Stops DDoS attacks at the network ingress.
Requires no additional hardware or facilities such as power, rack space, and cooling.
Requires no changes to the network architecture.
Avoids overprovisioning facilities such as links and routers to account for attack traffic.
Prevents backhauling of malicious traffic.
Minimizes network outages and optimizes the end-user experience.
Meets low-latency application requirements.

Need help?

Open a support case

(Requires a Cisco Service Contract)

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.