About Network Protect
Fastly Network Protect helps protect your network infrastructure and IP address space.
Unlike Fastly DDoS Protection, which protects the applications and APIs you deliver through Fastly services, Fastly Network Protect works with the networks you own and operate. Fastly advertises your IP address prefixes from its network, filters traffic at Fastly's network edge using the firewall rules you've configured, and then delivers the remaining traffic back to your infrastructure through Generic Routing Encapsulation (GRE) tunnels.
Before you begin
Keep in mind the following when working with Fastly Network Protect:
- Fastly Network Protect must be purchased for your account. To get started, contact sales@fastly.com.
- You must own the IP address prefixes you want to protect and be able to prove ownership. Before Fastly can advertise a prefix on your behalf, you must provide a Letter of Authorization (LOA). You must also create a Route Origin Authorization (ROA) record with your Regional Internet Registry (RIR) that authorizes Fastly's Autonomous System Number (AS394192) to originate your prefix.
- Check if your upstream ISPs use uRPF filtering. If they do, ensure it is set to loose mode rather than strict mode, as strict mode will cause packet loss when shifting your prefix advertisements to a new provider. Additionally, note that if uRPF loose mode is active and your prefix is not currently announced, Fastly cannot run pre-flight checks on the tunnel endpoint.
- Your network must be able to accept and decapsulate the GRE traffic that Fastly delivers through your tunnels, and it must respond to the Internet Control Message Protocol (ICMP) health checks that Fastly sends through them.
- Because GRE encapsulation adds overhead, the maximum deliverable packet size through the tunnel is reduced to 1476 bytes for IPv4 endpoints and 1456 bytes for IPv6. To ensure traffic flows smoothly without relying on ICMP Path MTU Discovery, configure TCP MSS clamping for reply packets. Specifically, adjust the MSS to 1436 bytes for IPv4 and 1396 bytes for IPv6. This ensures the original TCP sender receives the adjusted MSS during the handshake and scales down their segment size to fit within the tunnel limits.
How it works
Fastly Network Protect routes your inbound internet traffic through Fastly's network before it reaches your infrastructure. Fastly announces your IP address prefixes using anycast, so traffic destined for your network enters Fastly's network at the point of presence (POP) closest to its source.
Fastly's network filters traffic using the firewall rules you've configured and then delivers the remaining traffic to your network through a GRE tunnel. Your router decapsulates the traffic and forwards it to your applications with the original source IP addresses intact. Return traffic doesn't pass through Fastly's network. Instead, your applications respond directly to end users.
Enabling Fastly Network Protect
After Fastly Network Protect has been purchased for your account, enable it by completing the following steps:
- Log in to the Fastly control panel.
- Go to Security > Network Protect.
- Click Enable. The setup window appears.
- Define the network you want to protect:
- In the Network name field, enter a human-readable name for the network.
- In the Network prefix (CIDR) field, enter your internet-routable IP address prefix. This is the prefix that Fastly advertises via Border Gateway Protocol (BGP).
- (Optional) In the Health check IP field, enter an IP address to use as a target for health checks. When a health check fails, Network Protect will fail over to the next specified route.
- Click Continue.
- Configure the tunnel endpoint that Fastly uses to deliver the network's traffic. Select New tunnel, enter a name for the tunnel in the Tunnel name field, and enter the IP address on your network that the tunnel delivers traffic to in the Tunnel IP Address field. Alternatively, select Existing tunnel to use a tunnel you've already created. You can create additional tunnels after you complete the setup steps.
- Click Continue.
- Create the network's default routing policy. From the Tunnel menu, select the tunnel you just configured, then review the Region and Preference fields. A default route is required before Fastly can advertise your prefix. You can set up regional routing after you complete the setup steps.
- Click Continue.
- From the Default action menu, select what happens to traffic that doesn't match any of your firewall rules. We recommend selecting Block all, which delivers only the traffic that your firewall rules explicitly allow.
- Click Finish setup.
Security products note
No security product, such as a WAF or DDoS mitigation product, including those security services offered by Fastly, will detect or prevent all possible attacks or threats. As a subscriber, you should maintain appropriate security controls on all web applications and origins. The use of Fastly's security products does not relieve you of this obligation. As a subscriber, you should test and validate the effectiveness of Fastly's security services to the extent possible prior to deploying these services in production, continuously monitor their performance, and adjust these services as appropriate to address changes in your web applications, origin services, and configurations of the other aspects of your Fastly services.
