Integrate AWS Network Firewall with your ISV Firewall Rulesets
AWS Architecture BlogIntegrate AWS Network Firewall with your ISV Firewall Rulesetsby Mony Kiem, Frenil Randeria, and Ripunjaya Pattnaik | on28 JUN 2021| inArchitecture,AWS Network Firewall,AWS Transit Gateway,Intermediate (200)|Permalink|ShareYou may have requirements to leverage on-premises firewall technology in AWS by using your existing firewall implementation. As you move these workloads to AWS or launch new ones, you may replicate your existing on-premises firewall architecture. In this case, you can run partner appliances such asPalo AltoandFortinetfirewall appliances onAmazon EC2 instances.Ensure that the firewall and intrusion prevention system (IPS) rules that protect your on-premises data center will also protect yourAmazon Virtual Private Cloud (VPC). These rules must be frequently updated to ensure protection against the latest security threats. Many enterprises do not want to manage multiple rulesets across their entire hybrid architecture.AWS Network Firewalltakes the responsibility of this undifferentiated heavy lifting by providing a managed service that runs a fleet of firewall appliances, from patching to security updates. It uses the free and open-source intrusion prevention system (IPS),Suricata, for stateful inspection. Suricata is a network threat detection engine capable of real-time intrusion detection (IDS). It also provides inline intrusion prevention (IPS), network security monitoring (NSM), and offline packet capture processing. Customers can now import their existing IPS rules from their firewall provider software that adheres to the open source Suricata standard. This enables a network security model for your hybrid architecture that minimizes operational overhead while achieving consistent protection.Overview of AWS services usedThe following are AWS services that are used in our solution. These are the fundamental building blocks of a hybrid architecture on AWS.AWS Network Firewall (ANFW): a stateful, managed, network firewall and intrusion detection and prevention service. You can filter network traffic at your VPC using AWS Network Firewall.  AWS Network Firewall pricing is based on the number of firewalls deployed and the amount of traffic inspected. There are no upfront commitments, and you pay only for what you use.AWS Transit Gateway (TGW): a network transit hub that you use to interconnect your virtual private clouds (VPCs) and on-premises networks. Transit Gateway enables customers to connect thousands of VPCs. You can attach all your hybrid connectivity (VPN and Direct Connect connections) to a single Transit Gateway. This enables you to consolidate and control your organization’s entire AWS routing configuration in one place.AWS Direct Connect,AWS Site-to-Site VPN, andAmazon VPCare other core components of this hybrid architecture.Hybrid architecture with centralized network inspectionThe example architecture in Figure 1 depicts the deployment model of acentralized network security architecture. It shows all inbound and outbound traffic flowing through a single VPC for inspection. The centralized inspection architecture incorporates the use of AWS Network Firewall deployed in an inspection VPC. All traffic is routed from other VPCs through AWS Transit Gateway (TGW). The threat intelligence rulesets are managed by a partner integration solution and can be automatically imported into AWS Network Firewall. This will allow you to use the same ruleset that is deployed on-premises. It will reduce inconsistent and manual processes to maintain and update the rules.Figure 1. Centralized inspection architecture with AWS Network Firewall and imported rulesThe partner integration with AWS Network Firewall (ANFW) will work for both acentralized and distributed inspection architecture. The AWS Network Firewall service will house the rulesets, and you only need to deploy a Firewall endpoint in the Availability Zone of your VPC. In the centralized architecture deployment, all traffic originating from the attached VPCs is routed to the TGW. On the TGW route table, all traffic is routed to the inspection VPC attachment ID. The route table associated to the subnet where the TGW ENI is created in the inspection VPC will have a default route via the ANFW endpoint and return traffic from the ANFW endpoint is routed back to the TGW. If your VPC Firewall endpoint is being deployed across multiple Availability Zones (AZ), use theTGW appliance modeto allow traffic flow symmetry. This will ensure that return traffic is processed by the same AZ. For further details on how to set up your network routing, reference theDeployment models for AWS Network Firewallblog post.AWS Network Firewall partner integrationsFigure 1 depicts two partner integrations, which includeTrend MicroandFortiNet. View this complete and latest list ofpartner integrations with AWS Network Firewall.If you are already a user of Trend Micro for your threat intelligence, you can leverage this deployment model to standardize your hybrid cloud security. Trend Micro enables you to deploy your AWS managed network infrastructure and pair it with a partner-supported threat intelligence. This focuses on detecting and disrupting malware in your environments. You just need to enable the Sharing capability on Trend Micro Cloud One. For further information, see thesedetailed instructions.For existing users ofFortinetthat are using their managed IPS rulesets, you can automatically deploy updated IPS rule sets to AWS Network Firewall. This will ensure consistent protection across your applications landscape. For moredetails on this integration, visit the partner page.Getting started with AWS FirewallYou can get started with this pattern through the following high-level steps with link to detailed instructions along the way.Determine your current networking architecture and cross reference it with the different deployment models supported by AWS Network Firewall. You can learn more about your different options in the blogDeployment models for AWS Network Firewall. The deployment model will determine how you set up your route tables and where you will deploy your AWS Network Firewall endpoint.Visit theAWS Network Firewall Partnerspage to confirm your provider’s integration with ANFW and follow the integration instructions from the partner’s documentation.Get started with AWS Network Firewall by visiting theAmazon VPC Consoleto create or import your firewall rules. You can group them into policies and apply them to the VPCs you want to protect per thedeveloper guide.To start inspecting traffic,deploy your Network Firewall endpointin your inspection VPC.ConclusionYou may need to operate a hybrid architecture using the same firewall and IPS rules for both your on-premises and cloud networks. For implementing these rules in the cloud, you can run partner firewall appliances on EC2 instances. This model of operation requires some heavy lifting.Instead, you can set up AWS Network Firewall quickly, and not worry about deploying and managing any infrastructure. AWS Network Firewall automatically scales with your organizations’ network traffic. AWS provides a flexible rules engine that enables you to define firewall rules to control this traffic. To simplify how organizations determine what rules to define, Fortinet and Trend Micro have made managed rulesets available throughAWS Marketplace offerings. These can be deployed to your environment with a few clicks. These partners remove complexity for security teams so they can easily create and maintain rules to take full advantage of the AWS Network Firewall.Mony KiemMony Kiem is a Principal Solutions Architect at AWS helping customers on their AWS journey. His focus is on accelerating the customer’s modernization process across technology and business.Frenil RanderiaFrenil is a Greenfield Solutions Architect at AWS. He focuses on helping customers get started on their AWS journey and drives innovation for their workloads. When not helping customers, he likes to explore the different beaches and mountains in the New England area.Ripunjaya PattnaikRipunjaya is an Enterprise Solutions Architect at AWS. He enjoys problem-solving and advising his customers. In his free time, he likes to try new sports, play ping-pong and watch movies.
You may have requirements to leverage on-premises firewall technology in AWS by using your existing firewall implementation. As you move these workloads to AWS or launch new ones, you may replicate your existing on-premises firewall architecture. In this case, you can run partner appliances such as Palo Alto and Fortinet firewall appliances on Amazon EC2 […]
Mony Kiem
Architecture AWS Network Firewall AWS Transit Gateway Intermediate (200)