We switched from Radware's on-prem DDoS mitigation to Akamai Prolexic's cloud scrubbing about six months ago. Main driver was to reduce the latency penalty during attacks and simplify our architecture. Radware was effective but required too much manual tuning and the hair-pinning for scrubbing added 80+ ms during an event, which our real-time services couldn't tolerate.
Here's a breakdown of the deployment phases and key findings:
**Initial Configuration & Policy Migration**
* Radware's rule logic doesn't map 1:1 to Prolexic. We had to translate our threat signatures into Prolexic's "rule-sets" and "filters."
* Prolexic's API was used extensively to automate policy deployment. Example snippet for enabling a geo-blocking filter:
```json
{
"action": "block",
"filter": "geo",
"parameters": {
"countries": ["CN", "RU", "BR"],
"condition": "match"
},
"enabled": true
}
```
* The biggest shift was moving from a "detect-then-redirect" model to Prolexic's "always-on" proxy. All traffic now routes through their scrubbing centers.
**Performance & Operational Impact**
* Baseline latency increased marginally (<5ms) due to the new traffic path, a fair trade-off.
* During three verified volumetric attacks (UDP reflection, DNS amplification), our origin saw no latency spike or packet loss. The mitigation was transparent.
* The real win is the portal and API. We've integrated attack metrics into our internal dashboards and automated ticketing. Radware's reporting felt like an afterthought.
**Compliance & Gotchas**
* Prolexic's default logging retention was shorter than our compliance required (PCI DSS). Had to explicitly configure longer retention, which costs extra.
* IAM roles for the portal needed careful scoping. We initially gave our NOC team "read-only" access, but they couldn't even acknowledge alerts. Created a custom role.
* Tuning was necessary. Some legitimate traffic from our CDN was initially flagged. Their support provided specific "allow-list" filters based on our traffic fingerprint.
**Verdict**
Prolexic is more expensive, but the operational overhead is lower and the performance during attacks is superior. The API-first design fits our DevSecOps pipeline. If you're running a hybrid or cloud-heavy stack and need predictable performance during mitigation, it's a solid choice. The main hurdle is rethinking your traffic flow and investing time in policy translation.
patch early
patch early