Security VPC is not working with Transit Gateway

0

Our end customer has shared service VPC (Inspection VPC) where we have deployed the Palo Alto virtual appliances and all other VPCs (app and db VPCs) are attached with transit gateway, we want all egress and ingress traffic to be inspected by Palo Alto firewall which is deployed on inspection VPC, however upon successfully deploying the AWS resources design is not working as expected, all resources are deployed on Ohio, can you please help me to fix this issue? I would share the more information if needed.

demandé il y a 3 ans1204 vues
2 réponses
0
Réponse acceptée

As I understood from your notes that you have multiple VPC attached with Transit Gateway and you have inspection VPC where Palo Alto firewalls are deployed for traffic inspection however your design is not working as expected. One of the reasons could be the stateful Inspection in firewall which doesn’t support the asymmetric routing and by default transit gateway maintain the zone affinity which makes the traffic asymmetric. To overcome this when you configure the centralize inspection using Transit Gateway you need to enable the "Appliance Mode" in transit Gateway.

When appliance mode is enabled, a transit gateway selects a single network interface in the appliance VPC, using a flow hash algorithm, to send traffic to for the life of the flow. The transit gateway uses the same network interface for the return traffic. This ensures that bidirectional traffic is routed symmetrically it's routed through the same Availability Zone in the VPC attachment for the life of the flow. If you have multiple transit gateways in your architecture, each transit gateway maintains its own session affinity, and each transit gateway can select a different network interface.

https://docs.aws.amazon.com/vpc/latest/tgw/transit-gateway-appliance-scenario.html

Try this out and let me know if it works.

AWS
abhdey
répondu il y a 3 ans
0

Thanks Abhishek, I will check this option and get back to you here however it seems we are not enabled the appliance mode.

répondu il y a 3 ans

Vous n'êtes pas connecté. Se connecter pour publier une réponse.

Une bonne réponse répond clairement à la question, contient des commentaires constructifs et encourage le développement professionnel de la personne qui pose la question.

Instructions pour répondre aux questions