By using AWS re:Post, you agree to the Terms of Use
/Routing network traffic between two EC2 instances in the same subnet to a firewall appliance in another VPC/

Routing network traffic between two EC2 instances in the same subnet to a firewall appliance in another VPC

0

Hi Team,

I have an application VPC with two private Subnets in the same Availability Zone. Subnet A contains multiple EC2 instances. Subnet B is a transit gateway subnet that connects to a firewall VPC that contains a firewall appliance to analyze and control network traffic. In this example the firewall VPC will be a hub and spoke model. To enhance security I would like all traffic that goes between EC2 instances inside Subnet A to be routed to the firewall VPC for inspection. The firewall appliance would need to remain inside the firewall VPC. Is this type of configuration possible?

2 Answers
1
Accepted Answer

No, this is not possible. You can insert inspection appliances between subnets, but not within the same subnet. More details here: https://aws.amazon.com/blogs/aws/inspect-subnet-to-subnet-traffic-with-amazon-vpc-more-specific-routing/

Can you create different subnets for different kind of workloads?

Also, you may want to consider a multi-AZ deployment for resiliency. Especially if this is for production workloads.

answered 5 months ago
EXPERT
reviewed 5 months ago
0

Good evening,

Could this be a possible solution for you?

Traffic Mirroring is an Amazon VPC feature that you can use to copy network traffic from an elastic network interface of Amazon EC2 instances. You can then send the traffic to out-of-band security and monitoring appliances for:

Content inspection Threat monitoring Troubleshooting

The security and monitoring appliances can be deployed as individual instances, or as a fleet of instances behind a Network Load Balancer with a UDP listener. Traffic Mirroring supports filters and packet truncation, so that you only extract the traffic of interest to monitor by using monitoring tools of your choice. https://docs.aws.amazon.com/vpc/latest/mirroring/what-is-traffic-mirroring.html https://aws.amazon.com/blogs/aws/new-vpc-traffic-mirroring/

answered 5 months ago

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Guidelines for Answering Questions