stackArmor Security MicroSummit - Next Generation Firewalls for AWS
Download as PPTX, PDF0 likes392 views
This document discusses deploying Palo Alto Networks' VM-Series firewalls in AWS environments, emphasizing automation through CloudFormation templates and CloudWatch for scaling and monitoring. Key components include bootstrapping firewalls, auto-scaling groups, and various AWS services to manage security and performance. It outlines the architecture for securing VPCs and managing interconnectivity between different applications and environments.
stackArmor Security MicroSummit - Next Generation Firewalls for AWS
- 1. Ed Caswell Consulting Engineer Palo Alto Networks Securing the Public Cloud AWS Deployment Scenarios
- 2. in
- 4. 4 | ©2014, Palo Alto Networks. Confidential and Proprietary. Region 1 Web farm Web farm Internal ELB AZ1 AZ2 External ELB
- 5. CloudFormation Template: Automates full use case deployments S3: AWS service where bootstrapping files are stored CloudWatch: Consumes metrics and makes intelligent scale in/out decisions Lambda: Code as a service pushes custom metrics to CloudWatch via XML API Auto Scale Groups (ASG): The firewalls are members of an ASG that scales in/out based on custom metrics PAN-OS Bootstrapping: Automates creation of fully configured firewall PAN-OS API: enables delivery of custom metric to CloudWacth Panorama: Optional but highly recommended to simplify VM-Series management Native AWS and PAN-OS/VM-Series Services Used 5 | © 2015, Palo Alto Networks. Confidential and Proprietary. AWS Services PAN-OS/VM-Series Services
- 6. Region 1 AZ1 External ELB AZ2 Internal ELB Web ASG 1 CFT deploys base topology ASG1 2 Initial firewalls are bootstrapped from S3 ASG2 Bootstrapping adds VM-Series firewalls to Panorama Auto Scaling the VM-Series on AWS 6 | © 2016, Palo Alto Networks. Confidential and Proprietary.
- 7. Region 1 AZ1 External ELB AZ2 Internal ELB Web ASG ASG1 3 Standard metrics sent to CloudWatch 4 Alarm triggers ASG scale out ASG2 Auto Scaling the VM-Series on AWS 7 | © 2016, Palo Alto Networks. Confidential and Proprietary.
- 8. Region 1 AZ1 External ELB AZ2 Internal ELB Web ASG ASG1 5 l function collects PAN-OS metrics via API Custom metrics sent to CloudWatch 6 7 Alarm triggers FW ASG scale events ASG2 Bootstrapping continues to add FWs to Panorama l Function removes FWs from Panorama Auto Scaling the VM-Series on AWS 8 | © 2016, Palo Alto Networks. Confidential and Proprietary.
- 9. Region 1 AZ1 IELB VIP 1 IELB VIP 2 AZ2 Web ASG ASG1 ASG2 8 l function monitors for ELB VIP changes IELB VIP 3 9 l function deploys new ASG with NAT rule for new VIP ASG3 IELB VIP 4 ASG4 External ELB Internal ELB Auto Scaling the VM-Series on AWS 9 | © 2016, Palo Alto Networks. Confidential and Proprietary.
- 10. InterVPC
- 11. Securing one VPC IPSec VPN DC-FW1 DC-FW2 AZ1b Web1-01 Web1-02
- 12. AZ1c Securing one VPC AZ1b IPSec VPN DC-FW1 DC-FW2 Web1-01 Web1-02 Web2-01 Web2-02 IPSec VPNs
- 13. Securing lots of VPCs DC-FW1 DC-FW2 Marketing App HR App QA Environment Dev Environment
- 14. Region Services VPC Subnet 1 Availability Zone 2 Availability Zone 1 Subnet 2 Region Subscribing VPC Subnet 1 Availability Zone 2 Availability Zone 1 Subnet 2
- 15. Region Services VPC Subnet 1 Availability Zone 2 Availability Zone 1 Subnet 2
- 16. DC-FW1 DC-FW2 Services VPC + Hybrid + Internet Gateway
- 17. DC-FW1 DC-FW2 Routing Default route learned via DHCP from IGW on E1/1 Static route defined for enterprise network Redistribution profile shares static routes with BGP peers BGP routes propagated into local route table SNAT on gateway firewall ensure symmetric return
- 19. DC-FW1 DC-FW2 LOTS more scale Direct Connect Location Service Provider Links
Editor's Notes
- #14: Too many firewalls to purchase, manage, monitor Too many enforcements points Who’s job to add the FWs to the VPCs?
- #15: Routing: VM-Series learns default route via DHCP VM-Series redistributes default route into BGP VM-Series shares default route with each VGW via BGP peering Each VGW propagates the default route it learned via BGP into the local route table EC2 instances require no special configuration for routing – just the default GW they learned via DHCP