Internet Leased Line (ILL): DDoS Protection, Dual Last Mile, Firewall and Burstable Bandwidth Explained

Quick Answer

An Internet Leased Line (ILL) is a dedicated internet connectivity service generally designed for businesses that require consistent bandwidth, symmetrical upload and download speeds, and a defined Service Level Agreement (SLA). Enterprise ILL services may also include DDoS protection, firewall security, Dual Last Mile connectivity and burstable bandwidth.

These features address different requirements: DDoS protection helps mitigate malicious traffic intended to disrupt internet services, a firewall controls network traffic according to security policies, Dual Last Mile provides an alternative physical connection path, and burstable bandwidth allows temporary usage above the committed bandwidth under agreed service conditions.

1. What Is an Internet Leased Line (ILL)?

An Internet Leased Line (ILL), also called Dedicated Internet Access, is a business internet connection provisioned through an ISP (Internet Service Provider) for a particular customer or business location.

Unlike conventional shared broadband services, a dedicated leased line is provisioned with a committed bandwidth allocation. Business-grade ILL services generally provide symmetrical bandwidth, meaning the upload and download bandwidth are equal, subject to the service agreement.

For example, an organisation subscribing to a 100 Mbps symmetrical ILL generally receives a committed upload and download capacity of 100 Mbps each.

Key Characteristics of an ILL Connection

• Dedicated bandwidth: A defined bandwidth commitment for the customer.
• Symmetrical speed: Equal committed upload and download speeds when included in the service plan.
• Static public IP addresses: Public IP allocation may be provided according to the subscribed plan.
• Service Level Agreement: Contractual commitments may cover uptime, latency, packet loss, jitter and fault restoration.
• Scalability: Bandwidth can generally be upgraded according to technical feasibility and provider offerings.
• Enterprise support: Business-oriented monitoring, fault management and technical assistance.

Where Is an ILL Connection Used?

• Corporate offices and enterprise networks.
• Data centres and server hosting facilities.
• Cloud-based applications and services.
• Video conferencing and VoIP communication.
• Banking, financial and business-critical applications.
• VPN connectivity between offices and remote locations.
• Organisations requiring reliable internet access for multiple users.

2. What Is DDoS Protection?

DDoS stands for Distributed Denial of Service. A DDoS attack occurs when multiple compromised devices or systems generate excessive traffic or requests towards a target network, server or online service, with the intention of exhausting its resources or disrupting its availability.

For example, a company hosting its website, application or customer portal on its premises may experience unusually high incoming traffic during a DDoS attack. The attack can consume available network bandwidth or server resources, making legitimate users unable to access the service.

How DDoS Protection Works

DDoS protection identifies and mitigates malicious or abnormal traffic before it overwhelms the protected network or service. Depending on the ISP's solution, mitigation may be performed within the provider's network, through a scrubbing centre, or through a cloud-based protection platform.

1. Traffic monitoring: Network traffic is monitored for unusual traffic patterns, unexpected traffic volumes and attack indicators.
2. Attack detection: Detection systems identify traffic that may represent a DDoS attack.
3. Traffic filtering: Malicious or unwanted traffic is identified and filtered using the provider's mitigation policies.
4. Legitimate traffic forwarding: Valid traffic is allowed to reach the intended destination as far as the mitigation system can distinguish it.
5. Continuous monitoring: Traffic is monitored during the incident and mitigation policies are adjusted when necessary.

Types of DDoS Attacks

Why Is DDoS Protection Important for an ILL?

A dedicated internet connection does not automatically prevent DDoS attacks. Even when an organisation has dedicated bandwidth, a sufficiently large incoming attack can overwhelm the available link or connected infrastructure.

ISP-level DDoS mitigation can help protect the connection before malicious traffic reaches the customer's network. However, the actual protection depends on the mitigation capacity, detection methods, supported attack types, protected IP addresses and service coverage.

Important: Confirm whether DDoS protection is included in the ILL subscription or offered as an additional service. Also verify the committed mitigation capacity, attack notification procedure, exclusions and escalation arrangements.

3. What Is Dual Last Mile Connectivity?

Last mile refers to the network segment connecting an ISP's distribution network to the customer's premises. In an ILL connection, this is the access portion through which the internet service reaches the business location.

Dual Last Mile means providing two last-mile connectivity paths to the same customer location. The objective is to maintain internet connectivity when one access path experiences a failure, such as a fibre cut or an access-network fault.

How Dual Last Mile Works

A typical Dual Last Mile arrangement uses two separate access paths between the ISP network and the customer premises. Depending on the service design, both connections may use fibre, or one may use fibre while the other uses an alternative medium such as wireless connectivity.

Active-Passive Configuration

In an Active-Passive configuration, the primary connection carries normal network traffic while the secondary connection remains available as a backup.

If the primary link fails, the network routing or failover mechanism switches traffic to the secondary connection. The time required for failover depends on the routing configuration, failure detection and service-provider implementation.

Active-Active Configuration

In an Active-Active configuration, both connections can carry traffic simultaneously. Traffic distribution may be implemented through routing protocols, policy-based routing or other supported network mechanisms.

If one connection fails, traffic can be redirected through the remaining connection, subject to its available capacity and the configured failover behaviour.

Benefits of Dual Last Mile

• Fibre-cut resilience: An alternative access path may maintain connectivity when the primary fibre route is damaged.
• Reduced single-link dependency: The business does not have to depend entirely on one last-mile connection.
• Improved availability: A backup path can reduce the impact of certain access-network failures.
• Business continuity: Critical applications and communication services may continue operating during a primary-link outage.
• Flexible routing: Supported configurations can provide automatic or policy-controlled traffic switching.

Important Considerations When Purchasing Dual Last Mile

Having two connections does not automatically guarantee complete redundancy. Both links may still depend on common infrastructure.

• Whether both connections use physically separate fibre routes.
• Whether they terminate at different distribution points or network equipment.
• Whether separate ducts, poles or building entry routes are used.
• Whether the two connections have independent power and termination equipment where required.
• Whether both links use the same upstream network or ISP infrastructure.
• Whether automatic failover is included and how it is tested.
• Whether the backup connection has the same bandwidth as the primary connection.
• Whether public IP addresses and existing sessions remain available after failover.

4. What Is Firewall Protection?

A firewall is a network security system that monitors and controls incoming and outgoing network traffic according to configured security rules.

In a business ILL setup, a firewall is generally installed between the ISP's internet connection and the organisation's internal network. It helps control which devices, services, applications and network connections are permitted to communicate.

How a Firewall Works

A firewall examines network traffic and applies configured policies to determine whether traffic should be allowed, blocked or otherwise handled.

For example, a company may configure firewall rules to:

• Allow employees to access approved internet services.
• Block unauthorised incoming connections.
• Allow remote employees to connect through an approved VPN service.
• Restrict access to internal servers and network devices.
• Control communication between different internal network segments.
• Log suspicious connections and security events.

Types of Firewalls

Firewall and DDoS Protection: What Is the Difference?

Firewall protection and DDoS mitigation serve different security purposes. A firewall controls network traffic according to security policies, whereas DDoS protection focuses on identifying and mitigating traffic intended to overwhelm a network or service.

A conventional firewall alone may not be sufficient to handle a large volumetric DDoS attack because the attack traffic can consume the internet connection's bandwidth before reaching the firewall.

For this reason, organisations hosting publicly accessible services may benefit from combining ISP-level DDoS mitigation with properly configured firewall protection.

Important Firewall Considerations for an ILL

• Check whether the ISP provides a managed firewall or only internet connectivity.
• Confirm whether the firewall hardware or virtual appliance is included in the subscription.
• Understand whether configuration, monitoring, firmware updates and technical support are included.
• Confirm throughput capacity, especially when security inspection features are enabled.
• Review VPN, NAT, public IP and application-access requirements.
• Maintain appropriate firewall rules and regularly review access permissions.

5. What Is Burstable Bandwidth?

Burstable bandwidth is a connectivity feature that allows a customer to use bandwidth above the committed or subscribed rate when additional network capacity is available and the service agreement permits it.

It is useful for businesses whose internet usage varies throughout the day. Instead of permanently subscribing to the maximum bandwidth required during occasional busy periods, an organisation can subscribe to a lower committed bandwidth and use additional capacity during temporary traffic spikes.

How Burstable Bandwidth Works

Consider a company subscribing to an ILL with 100 Mbps committed bandwidth and an additional burst allowance up to 200 Mbps.

• 100 Mbps is the committed bandwidth.
• Additional bandwidth may be available when required, up to the agreed burst limit.
• The additional capacity is subject to the provider's network availability and traffic-management policy.
• Billing may depend on peak usage, average usage, time intervals or another agreed measurement method.

The exact meaning of burstable bandwidth varies between providers. Some services use a fixed committed rate with an additional best-effort allowance, while others offer a defined peak rate and usage-based billing.

Understanding CIR, EIR and PIR

For example, consider the following illustrative bandwidth profile:

In this example, the committed rate is 100 Mbps, while the configured peak rate is 200 Mbps. The availability and treatment of excess traffic depend on the provider's service profile and SLA. Excess traffic should not automatically be assumed to have the same guarantee as committed traffic.

Advantages of Burstable Bandwidth

• Provides additional capacity during temporary traffic peaks.
• Can reduce the need to permanently purchase higher committed bandwidth.
• Supports fluctuating internet usage patterns.
• Can help accommodate large file transfers, cloud backups and software updates.
• Provides flexibility when business internet requirements change.

What to Check Before Selecting Burstable Bandwidth

• Committed bandwidth and maximum burst bandwidth.
• Whether the burst allowance is guaranteed or best effort.
• Whether additional capacity is available at all times or only when the provider has spare capacity.
• How bandwidth utilisation is measured.
• Whether billing uses 95th-percentile usage, peak usage, average usage or another method.
• Whether burst usage has additional charges or predefined limits.
• Whether the burst limit applies to upload, download or both directions.

6. Difference Between DDoS Protection, Dual Last Mile, Firewall and Burstable Bandwidth

Although these features may be offered together with an enterprise Internet Leased Line, they solve different networking problems.

7. How to Select the Right ILL Configuration for a Business

The appropriate ILL configuration depends on the organisation's applications, number of users, traffic requirements, security needs and tolerance for downtime.

Small and Medium-Sized Businesses

A business using cloud applications, email, video meetings and routine file transfers may require a dedicated symmetrical ILL with an appropriate bandwidth commitment, static IP allocation where needed, and a properly configured firewall.

Businesses Hosting Servers or Public-Facing Applications

Organisations hosting websites, customer portals, remote-access services or other public-facing systems should evaluate ISP-level DDoS protection in addition to firewall and application security.

Businesses Requiring High Availability

Organisations that depend on uninterrupted internet access for business-critical applications should consider Dual Last Mile or an independently routed backup connection. They should also evaluate the ISP's uptime SLA, restoration commitments and physical route diversity.

Businesses with Fluctuating Internet Usage

Organisations experiencing occasional high traffic due to cloud backups, large file transfers or other temporary workloads may consider burstable bandwidth. The committed rate should still be sufficient for normal business operations.

8. ILL Procurement and ISP SLA Checklist

Before finalising an Internet Leased Line subscription, request a written technical proposal and SLA from the service provider. Check the following points:

Understanding the Uptime SLA

An uptime SLA defines the availability commitment for the internet service over a specified measurement period. For example, a 99.9% monthly uptime commitment allows a certain amount of downtime under the agreement's calculation method and exclusions.

The following figures are illustrative calculations for a 30-day month:

Actual SLA calculations may differ depending on the provider's measurement period, maintenance exclusions, force-majeure provisions and service-credit policy. Always refer to the signed SLA rather than relying only on advertised uptime figures.

9. Frequently Asked Questions

Is an Internet Leased Line better than normal broadband?

An ILL is generally more suitable for businesses requiring committed symmetrical bandwidth, predictable performance and contractual service commitments. Broadband may be more economical for locations with less demanding connectivity requirements.

Does an ILL connection automatically include DDoS protection?

No. DDoS protection is a separate service feature unless explicitly included in the ILL package or contract. Confirm the mitigation capacity and coverage with the ISP.

Does Dual Last Mile guarantee zero downtime?

No. Dual Last Mile reduces dependency on a single access path, but common upstream infrastructure, equipment failures, power problems and other shared failure points may still interrupt both connections.

Is a firewall the same as DDoS protection?

No. A firewall controls network traffic based on security policies. DDoS protection identifies and mitigates denial-of-service attack traffic. Both can be used together as part of a network security strategy.

Is burstable bandwidth guaranteed?

Not necessarily. Some providers offer excess bandwidth on a best-effort basis, while other services specify a defined peak rate. The guarantee and billing conditions must be checked in the service agreement.

Can two ILL connections be used together?

Yes. Two connections may be configured for Active-Passive failover or Active-Active traffic distribution, depending on ISP support, routing configuration, IP addressing and customer network equipment.

What is the difference between dedicated bandwidth and burstable bandwidth?

Dedicated or committed bandwidth is the rate specified as the customer's contracted bandwidth. Burstable bandwidth allows additional usage above that rate under the provider's traffic policy and capacity conditions.

Sources

• JioBusiness – Internet Leased Line and Enterprise Connectivity Features
• Airtel Business – Dedicated Internet Connectivity
• Verizon Business – Dedicated Internet Access
• Telecommunication Engineering Centre – Study Paper on IP Quality of Service
• IETF RFC 3133 – Terminology for Frame Relay Benchmarking
• Netsquad – Dual Last Mile Connectivity Architecture