Most engineers think…
Most people picture DDoS defense as 'one big scrubbing service in the cloud that soaks up everything'. That mental model fails you in an interview and in production.
Radware's answer is a hybrid system: an on-prem DefensePro appliance that kills low-latency, Layer 7 and encrypted attacks in real time, a cloud DefensePipe scrubbing center that absorbs volumetric floods, and Defense Messaging (Cloud Signaling) that keeps the two in sync — detecting pipe saturation, auto-diverting traffic, and passing live attack context so the cloud mitigates faster. Understanding that split is what lets you set thresholds correctly, choose BGP vs DNS diversion, and keep legitimate users online when a flood exceeds your pipe.
① Why one layer isn't enough — the case for hybrid
The single most important idea: no one layer covers every DDoS attack. A cloud-only scrubbing service is great for sheer volume but adds latency and struggles with short, low-volume Layer 7 and encrypted attacks — sending every request out to the cloud and back is expensive and slow. An on-prem-only appliance is fast and precise, but it cannot survive a flood larger than your internet pipe: once the link saturates upstream, even a perfect box behind it is starved of bandwidth.
Hybrid covers both. The on-prem appliance handles what needs to be near the application — instant, precise, low-latency mitigation — while the cloud absorbs the giant volumetric floods before they reach your link. The trick is keeping the two coordinated, which is exactly what Cloud Signaling does.
Why can't an on-prem-only appliance stop every DDoS attack?
② Division of labor — on-prem speed, cloud scale
Two halves, each doing what it is best at. DefensePro, the on-prem CPE at the data-center edge, owns low-latency defense. Its Behavioral DoS engine builds a real-time signature for a zero-day or unknown flood in about 18 seconds, with no human intervention. It mitigates encrypted (TLS/SSL) Layer 7 Web DDoS using behavioral TLS fingerprinting without decryption, and handles burst, pulse, DNS, IoT/Mirai and multi-vector attacks at line rate with minimal false positives.
The cloud half
The cloud DefensePipe / Radware Cloud DDoS service brings massive, scalable scrubbing capacity to absorb high-volume volumetric floods. It engages only when the customer's pipe is about to saturate, keeping the attack distant from the protected network. On-prem speed, cloud scale — neither alone is enough.
Radware's on-prem appliance for real-time, low-latency app-layer and encrypted DDoS mitigation — builds a zero-day signature in about 18 seconds.
Radware's cloud scrubbing service that absorbs huge volumetric floods, engaging only when the customer's pipe is about to saturate.
Defense Messaging — the channel that auto-triggers cloud diversion and shares live attack context (stats, signatures, baselines, policies).
When attack volume fills the internet link and chokes legitimate traffic — the trigger condition signaling watches for.
In an interview, separate the on-prem fast layer (DefensePro — low-latency L7, encrypted and zero-day defense at the edge) from the cloud big layer (DefensePipe — volumetric scrubbing at scale). The value of hybrid is using each where it wins, with Cloud Signaling tying them together.
Which layer is best at low-latency Layer 7 and encrypted DDoS defense?
③ Cloud Signaling in action — detect, divert, share context
Defense Messaging — Radware's Cloud Signaling channel — is what makes the two halves act as one. DefensePro continuously watches predefined pipe-saturation thresholds and security alerts. When bandwidth nears the limit, it automatically signals the cloud scrubbing center to take over (a manual trigger is also possible).
Crucially, it does not just say 'help' — it sends live attack context: traffic statistics, attack info, signatures, floating policies and baselines. Because the cloud receives this context, it mitigates faster instead of re-learning the attack from scratch. The interview line: Cloud Signaling diverts the flood and hands over the playbook, so the scrubber starts where the appliance left off.
If the pipe-saturation threshold is set higher than your actual link capacity, the pipe chokes before signaling ever fires and the cloud never engages. Always set the trigger comfortably below link capacity (e.g. 8 Gbps on a 10 Gbps link) and confirm automatic diversion is enabled.
▶ Watch a volumetric flood get diverted and scrubbed
How a pipe-saturating flood is handled end-to-end. Press Play for the healthy diversion path, then Break it to see the classic failure.
Bandwidth is climbing toward your link limit during an attack. What makes Cloud Signaling divert traffic automatically?
④ Diversion plumbing & the single-vendor win
When diversion engages, suspicious traffic is rerouted to the Radware scrubbing center one of two ways. BGP diversion is per-network: the appliance changes route advertisements (smaller-prefix, AS-path prepend, or advertise/withdraw) so the whole network's traffic flows to the scrubber. DNS diversion is per-service: DNS records repoint a single service to the cloud VIP. After scrubbing, clean traffic returns to the origin through a GRE tunnel, while on-prem DefensePro keeps handling residual L7 and encrypted vectors.
Why one vendor matters
Because both ends come from Radware, signatures, baselines and policies are shared end-to-end. Context transfers cleanly between appliance and cloud, so mitigation is faster and more accurate than stitching together two vendors. When the flood subsides, diversion is withdrawn and traffic flows directly again.
Vikram Rao at a Pune ISP/host faces this
During a customer's product launch, a 40 Gbps UDP flood saturates the 10 Gbps upstream link; DefensePro shows the attack but the pipe is congested and legitimate users time out.
The volumetric flood exceeds the internet pipe — beyond on-prem capacity — and cloud diversion never engaged.
In APSolute Vision, open Configuration ▸ Network Protection ▸ Cloud Signaling / Defense Messaging — the pipe-saturation threshold was set far above the 10 Gbps link, so signaling never fired, and BGP diversion was left on manual.
APSolute Vision ▸ Configuration ▸ Network Protection ▸ Cloud Signaling / Defense MessagingSet the saturation threshold below link capacity (e.g. 8 Gbps), enable automatic Cloud Signaling, and configure BGP 'smaller-prefix' diversion with the GRE return tunnel.
Run a controlled volumetric test: confirm in Vision that signaling triggered, traffic diverted to the scrubbing center, the GRE tunnel returned clean traffic, and latency and availability recovered.
Never assume signaling works. Run a controlled volumetric test and confirm in APSolute Vision that signaling fired, BGP/DNS diversion engaged, the GRE tunnel returned clean traffic, and availability recovered. That single test answers most 'is hybrid wired correctly?' questions.
You need to divert traffic for an entire network, not just one service. Which diversion method fits?
🤖 Ask the AI Tutor
Tap any question — instant, scoped to this lesson. No login, no waiting.
Pre-curated from vendor docs + community Q&A, scoped to this lesson. For a live prod issue, paste your export into chat.techclick.in.
📝 Wrap-up assessment — six more
You've answered 4 inline. Six left. 70% (7 of 10) marks the lesson complete on your profile. Tap Submit all answers at the end.
🧠 In your own words
Type one line: why is Radware's model called 'hybrid' rather than just 'cloud DDoS protection'? Then compare with the expert version.
🗣 Teach a friend
Best way to lock it in — explain it in one line to a teammate. Tap to generate a paste-ready summary.
📖 Glossary
- DefensePro
- Radware's on-prem appliance for real-time, low-latency application-layer and encrypted DDoS mitigation at the data-center edge.
- DefensePipe / Cloud DDoS
- Radware's cloud scrubbing service that absorbs volumetric floods, engaging when the customer's pipe is about to saturate.
- Cloud Signaling (Defense Messaging)
- The channel that auto-triggers cloud diversion and shares live attack context — stats, signatures, baselines and policies.
- Pipe saturation
- When attack volume fills the internet link and chokes legitimate traffic — the trigger condition signaling watches for.
- Behavioral DoS
- Detection that baselines normal traffic and auto-generates a real-time zero-day signature in about 18 seconds with no human intervention.
- BGP diversion
- Per-network rerouting that changes route advertisements (smaller-prefix, AS-path prepend, advertise/withdraw) to send traffic to the scrubber.
- DNS diversion
- Per-service rerouting that repoints a single service's DNS records to the cloud VIP.
- GRE tunnel
- An encapsulated link (publicly routable endpoint, MTU 1500) used to return scrubbed, clean traffic to the origin.
- Behavioral TLS fingerprinting
- Spotting malicious encrypted Layer 7 traffic by its behavior, so DefensePro mitigates encrypted DDoS without decryption.
📚 Sources
- Radware — DefensePro: Advanced DDoS Defense and Attack Mitigation (product page). radware.com
- Radware / PR Newswire — Radware Introduces Cloud-Based Mitigation Against Internet Pipe Saturation (DefensePipe). prnewswire.com
- Radware Support — Choosing the Best Diversion For Your Needs (BGP vs DNS, GRE return). support.radware.com
- Radware Support — BGP Configuration for Routing-Based Diversion. support.radware.com
- Radware — On-Premise, Cloud or Hybrid? Approaches to Mitigate DDoS (whitepaper). radware.com
- Radware — Radware Hybrid DDoS Attack Mitigation Service overview. radappliances.com
What's next?
Got the hybrid model? Next, go deep on DefensePro's Behavioral DoS engine — how it baselines normal traffic, builds real-time signatures for zero-day floods, and fingerprints encrypted Layer 7 attacks without ever decrypting them.