AWS re:Post을(를) 사용하면 다음에 동의하게 됩니다. AWS re:Post 이용 약관
AWS re:Postre:Post

Seeking Advice on AWS Direct Connect - Firewall Setup

0

Hello everyone, I need some advice on our current setup, which is based on a Hub & Spoke architecture in AWS. Our setup involves: - Utilizing Direct Connect via a transit VIF in the central Network account. - Sharing the DX connection with multiple spoke VPCs on different AWS accounts within our organization through a Transit Gateway.

We have a security requirement to inspect all the Direct Connect traffic by passing it through a firewall in AWS. Our main idea is to deploy an AWS firewall or a third-party solution like a Palo Alto VM in the Central network account to monitor all inbound and outbound traffic.

I would greatly appreciate your insights and guidance on whether this setup is the best approach. If you can provide any documentation links, best practices, or personal experiences related to this kind of setup, it would be incredibly helpful.

Thank you in advance for your assistance!

주제
네트워킹 및 콘텐츠 전송보안, 신원 및 규정 준수
태그
AWS Direct ConnectAWS 방화벽 관리자네트워킹 및 콘텐츠 전송
언어
English
Ali Md
질문됨 6달 전1590회 조회
2개 답변
1
수락된 답변

Funnily enough, I was reviewing that kind of setup today. Please take a look at https://aws.amazon.com/blogs/networking-and-content-delivery/deployment-models-for-aws-network-firewall/

The deployment model: 2) North-South: Centralized on-premises egress & ingress via Transit Gateway and Transit VIF/Direct Connect gateway/AWS Site-to-Site VPN seems to be what you are looking for.

This way all traffic from On Prem VIA DX will use the TGW Route table 0.0.0.0/0 to send all traffic via an inspection VPC. After passing through AWS or 3rd Party firewall, the traffic is passed back to TGW to route to the correct VPCs etc

profile picture
전문가
Gary Mclean
답변함 6달 전
profile picture
전문가
Oleksii Bebych
검토됨 2일 전
profile pictureAWS
전문가
Didier_Durand
검토됨 6달 전
  • Ali Md
    6달 전

    Thank you for your response Gary! I will take a look at the link and get back to you incase of any questions. Thanks again.

0

Are you considering using Gateway Load Balancer in your architecture? This will simplify the architecture and routing design for your inspection VPC.

You can also check this blog which discusses Hybrid Inspection Architecture which can apply to both Gateway Load Balancer and AWS Firewall: https://aws.amazon.com/blogs/apn/centralized-traffic-inspection-with-gateway-load-balancer-on-aws/

If you are considering deploying gateway load balancer endpoints using Geneve protocol, you can review this Gateway Load Balancer Workshop which deploys Palo Alto in an inspection VPC: https://catalog.us-east-1.prod.workshops.aws/workshops/ae291640-10fe-4c0b-982f-9b9a61dbad26/en-US

profile pictureAWS
AmerO
답변함 6달 전
  • Ali Md
    6달 전

    Thank you for your response Amer! Yes, we are indeed considering using Gateway Load Balancer in our architecture to achieve high availability for the firewall. This approach seems promising in simplifying our routing design. I appreciate the links you provided, The Gateway Load Balancer Workshop deploying Palo Alto in an inspection VPC looks interesting. I'll definitely take a closer look at it to see how it aligns with our requirements. If you have any more insights or tips related to our setup, please feel free to share. Thanks again!

로그인하지 않았습니다. 로그인해야 답변을 게시할 수 있습니다.

좋은 답변은 질문에 명확하게 답하고 건설적인 피드백을 제공하며 질문자의 전문적인 성장을 장려합니다.

질문 답변하기에 대한 가이드라인

관련 콘텐츠