DDoS Connector
Link self-hosted management to the Solarius edge without confusing local controls with traffic routing.
The Connector links a self-hosted Guard organization to the Solarius edge for DDoS mitigation. It provides the management relationship; traffic protection also requires the protected service's admitted routing path.
For resource mappings and information exchange with Infra, see the Connector documentation. Edge enrollment remains separate from the Infra–Guard product connection.
Enroll and grant
At Network protection → Connector → Create enrollment, authenticate the hosted organization and approve the local installation identity, allowed services, and edge entitlement. Install the signed Connector component from the same deployment release, mount its identity credential, and configure the values in worker and Connector settings.
The Connector uses outbound HTTPS. It does not need arbitrary inbound access to the local management API. Its grant covers the reviewed edge services; it does not confer access to all local endpoint evidence or organization administration.
Open Connector → Health and inspect credential validity, last sync, admitted services, policy revision acknowledgements, and routing readiness. Then complete service onboarding. A healthy Connector without routed traffic cannot scrub packets arriving directly at the origin.
Outages and revocation
On a management connection outage, the edge retains its last admitted configuration according to the service agreement; new policy changes and onboarding remain pending. Check edge traffic and backend health through an independent path. Do not withdraw a working route merely because a local status poll failed.
Feed sync, scanners, agents, local firewalls, and local investigations have separate health. They do not stop solely because the DDoS Connector is disconnected. Remote SOC visibility requires its own collaboration connection.
To revoke, open Connector → Disconnect after migrating protected routes or transferring management to a reviewed replacement. Revoking the grant blocks future management; it does not prove cached DNS or route state has changed. Confirm traffic routing and edge service retirement before removing the Connector identity from its host.
Rotate at Connector → Identity → Rotate, deploy the replacement credential, verify continuity, then revoke the old identity. A copied database does not authorize two installations to manage one Connector; reconcile identity before restoring a clone.