Lumen uses multiple layers of defense including our global internet backbone, intelligent scrubbing centers, extensive peering and Black Lotus Labs® threat intelligence. All of this works together to proactively block threats before they become attacks.

Customers can choose between two models of mitigation:

1. On-Demand mitigation – traffic is only scrubbed when an attack is detected, or mitigation is activated. Your network is still constantly monitored.
2. Always-On mitigation – traffic is continually scrubbed and monitored

See what mitigation is ideal for your business.

• On-Demand or Always-On DDoS attack mitigation
• Clean traffic return via Internet Direct for Lumen DIA customers and/or via a GRE tunnel for over-the-top protection on third-party internet services
• Up to 100 Gbps of clean traffic return with up to 10 clean traffic return paths (CTRP) and 10 Flow-Based Monitoring (FBM) instances. Up to 50 CTRPs and FBM instances are available for an additional charge.
• Real-time portal access to analyze performance during peacetime, day two management with event reporting and extensive attack visibility, historical threat data and the ability to make changes to your solution.
• Optional services:
  • SOC Advanced Support provides run book development, analysis and reporting tailored to your business needs.
  • Web Application Firewall (WAF) provides web application firewall, API protection and Bot Risk Management for additional layer 7 defense.

Lumen DDoS Hyper can be ordered online using Lumen Marketplace (self‑service portal) or through the Lumen Control Center (for existing Lumen customers) or by contacting your Lumen sales representative. We will invoice your order. No credit card is required.

Once you accept the quote and terms of the service you will be redirected to Control Center where the technical parameters to provision your service will be gathered. This includes the IP address space that needs to be protected, the IP address(es) of the GRE tunnel(s) or Lumen Internet circuits and information needed to collect Netflow from your router or Lumen edge router.

Lumen has developed a solution that can protect the wide spectrum of our customers’ needs.

If your internet is NOT provided by Lumen:

• You must have a router* (CPE) capable of GRE tunnel termination and able to support the GRE throughput requirement for your service, BGP advertisements, NetFlow generation and IP address space of at least /24 or larger.
• You will also need a public ASN.

If your internet IS provided by Lumen:

• You must have a qualified Lumen Internet circuit on AS3356
• Note that this configuration can protect subnets smaller than /24 and can protect a single host IP at a time

*Support for DDoS Hyper with the Lumen Managed router is available only with On‑Demand DDoS Hyper service using Internet Direct clean traffic return with either BGP or static WAN IP routing configuration.

There are some Lumen Internet services that may require additional configuration in order to work with DDoS Hyper. We have two models in which we can support Lumen network customers.

Internet Direct:

• Must be a Lumen DIA/HSIP service on AS3356
• BGP; or static routing; or no routing protocols with WAN IP up to a /27.
• DDoS protection type must be On‑Demand if there is a Lumen Managed Router
• Multiport circuits not supported (combination DIA/MPLS circuits on different VLANs)

GRE:

• Customer must be able to configure a GRE tunnel with BGP peering

Non‑Lumen Internet service customers can use a GRE tunnel for clean traffic return with BGP peering.

Once you accept the quote and terms of the service you will be redirected to Control Center where the technical parameters to provision your service will be gathered. This includes the IP address space that needs to be protected, the IP address(es) of the GRE tunnel(s) or Lumen Internet circuits and information needed to collect Netflow from your router or Lumen edge router.

You can track the status of your order in our portal, Control Center. The service is provisioned in near real-time. Once the service is provisioned, we will notify you and provide you with configuration parameters, if applicable, for your CPE to make it work with the Lumen DDoS Hyper service.

If you have questions while you’re purchasing DDoS Hyper there is dedicated chat support. This can be found in the bottom right side of your screen when going through the purchase process.

Once you have purchased there is dedicated support with chat and call options available in our portal, Control Center. The portal will provide regular updates, and our support team is available to guide you through the process.

Lumen Web Application Firewall (WAF) provides layer 7 defenses designed to protect your web-facing assets and APIs against web manipulation and bot attacks, and more. By bundling WAF with your Lumen DDoS Hyper service, you enable holistic web protection.

For additional information, view our DDoS Hyper + Application Protection Brochure.

You can add security consultant hours to your DDoS Hyper service on a monthly basis. This designated security consultant can:

• Walk-through pre-activation
• Assist with portal enrollment and training
• Develop custom runbooks
• Help with reviews and policy verifications for analysis and optimal configuration
• Write reports containing analysis, advice and recommendations. 

You must call the Lumen SOC to finalize the activation of your service before any mitigation can begin. You can contact the SOC by calling them directly: (866) 254-5210 – menu option 2 for DDoS Mitigation activation. 

The service is monitored 24/7 by Lumen global SOCs with most known forms of attacks being mitigated in seconds after the traffic hits the scrubbing centers.

It depends on what mitigation model you’ve purchased.

On‑Demand customers options:

• SOC‑assisted: The Lumen SOC automatically detects the attack, notifies the customer and begins mitigating the attack once customer approval is given.
• Auto‑mitigation: The Lumen SOC, subject to customer pre‑approval, sets up auto‑mitigation, which allows mitigation to occur when an attack is detected. 
• Customer‑requested: You may choose the option to contact the Lumen SOC when under attack to request the start of mitigation. 

Always‑On Customers:

• Always scrubbed: your traffic is always routed through Lumen Mitigation infrastructure. There is no need to request a mitigation since the traffic is always being cleaned. Attack notifications can be set up with our SOC.
• Customer‑initiated: mitigation is in your hands. Customers have complete control over initiating mitigation. You can still contact the Lumen SOC if you need additional help. 

The Lumen SOC can be contacted directly by calling: 866-254-5210 – menu option 2 for DDoS Mitigation activation.

If there is a need to escalate a potential DDoS attack or issue a trouble ticket to the Lumen Security Operations Center management team, the escalation path can be found on page 2 of the “Managed Security” section in the Lumen Service Assurance Escalation Matrix website: https://repairescalations.lumen.com/