Aviatrix Integration of a NextGen Firewall in AWS Transit Gateway

Learn how Aviatrix’s intelligent orchestration and control eliminates unwanted tradeoffs encountered when deploying Palo Alto Networks VM-Series Firewalls with AWS Transit Gateway.

Deploying any next generation firewall in a public cloud environment is challenging, not because of the firewall itself but because of the public cloud networking services that practitioners must use. The job of understanding and problem-solving around cloud networking complexities to ensure a successfully configured and maintained firewall deployment is no small task. It’s a task that is definitely possible — though difficult — and it comes with performance, scale, and visibility tradeoffs that need to be considered closely. This blog explores how to use Aviatrix’s intelligent orchestration and control service to simplify the deployment of Palo Alto Networks VM-Series Firewalls and eliminate those tradeoffs.

Aviatrix Firewall Network Service

Aviatrix’s Firewall Network Service is a service extension of its Enterprise Cloud Backbone Service. The Firewall Network service is a combination of Aviatrix services, combining both the  intelligent controller and gateway services. The service enables simple insertion of Next Generation Firewalls (NGFW) into AWS Transit Gateway (TGW) environments, without sacrificing performance, scale, or visibility. The Aviatrix intelligent controller handles orchestration and dynamic updates for all routing elements within the AWS TGW environment, and the gateway service offers dynamic load balancing across multiple firewalls across high-performance links.

The Aviatrix intelligent controller handles orchestration and dynamic updates for all routing elements within the AWS TGW environment, and the gateway service offers dynamic load balancing across multiple firewalls across high-performance links.

The Aviatrix Firewall Network Service leverages the combination of its intelligent orchestration and control as well as gateway services to remove AWS networking complexities such as lack of route propagation to VPCs, IPSec tunnels, and BGP; or use of source address translation (SNAT) between the firewall and the TGW. Eliminating these constraints allows Palo Alto VM-Series firewalls to operate at optimal performance and at TGW-native throughput. Removing the need to use SNAT allows session stickiness and source address to be retained for full visibility. The firewall network service is often deployed in multiple availability zones for active redundancy and scale-out load balancing. With Aviatrix, Palo Alto Networks VM-Series can achieve optimal performance, scale, and visibility.

Key benefits of bringing the Palo Alto Networks VM-Series to AWS TGW environments include:

  • Easily Integrate NGFW into AWS Transit Gateway for threat detection and prevention.
  • Eliminate IPSec bottleneck and leverage the best performance of the firewall.
  • Enable scale-out and redundancy with ease.
  • Automate end-to-end route propagation with Aviatrix intelligent orchestration and control service.
  • Perform in-line traffic inspection based on user-defined policies.
Figure 6. Aviatrix Firewall Network architecture with VM-Series
Figure 6. Aviatrix Firewall Network architecture with VM-Series

Why You Need Aviatrix For Your Nextgen Firewall In TGW

Let’s discover further how Aviatrix helps secure your AWS Transit Gateway using next generation firewalls.

Get the best performance out of your firewall

Getting the optimal performance out of your NGFW in the cloud is all about feeding packets to the firewall in the most efficient manner. One of the most common ways of doing this today is to create IPSec tunnels between VPCs and the firewall instances. IPSec is an excellent technology for securing communications over the internet, but it inherently has performance limitations. An IPSec tunnel between the NGFW and VPC’s VPN Gateway (VGW) unnecessarily restricts bandwidth of the traffic going in and out of the firewall. No matter how much throughput the firewall can handle, IPSec will limit how much traffic a single instance of the firewall can process. This is like having a wide garden hose that’s clamped somewhere in the middle.

Ease the pain of firewall insertion in Transit Gateway

As stated earlier, in order to secure your AWS cloud with a next generation firewall using the resources and services that are provided by AWS, you will have to rely on VPN tunnels to pipe traffic to and from the firewall. This presents several challenges for the insertion of an NGFW. The first challenge is how to actually do this at scale. AWS Transit Gateway solves this issue to some degree but leaves a lot of room for improvement, such as the use case in which native VPC attachments require manual and static route management.

Automated route state management with Aviatrix

Aviatrix FireNet enables inspection of cloud traffic through a cluster of NGFWs, while maintaining native functionality and visibility. The Aviatrix controller handles orchestration and ongoing management of firewalls as well as critical elements of cloud networking, so that you don’t have to work around the limitations imposed by the cloud network controls. With Aviatrix, no manual modification of the route tables is required, as the controller handles propagation end-to-end.

Unleash the power of your firewall

In order to reach the highest level of optimization, you want every bit of your NGFW’s compute power to be spent on what it is meant to do: namely, threat detection, threat prevention, logging, etc. Aviatrix FireNet feature eliminates the need for IPSec and frees the NGFW from having to deal with any of the IPSec overhead.

Further, Aviatrix leverages native TGW attachments for forwarding traffic to firewall instances in the firewall VPC. This forwarding method offers very high throughput (50 Gbps) and low latency thanks to TGW VPC attachments, and does not introduce a performance bottleneck into your application’s design. This is a huge improvement over VPN tunnels connecting to VGW that cap at 1.25 Gbps. As such, it significantly improves the technical and economical efficiency of the entire architecture. In other words, you get more bang for your proverbial buck out of the firewall.

Scale without loss of visibility

As is the rule in the computing world, when you scale out you need to ensure that state is maintained properly across the scaled systems, and traffic is distributed accurately. Another major part of FireNet architecture is the use of Aviatrix gateways to do the load balancing across firewalls. If you have considered using AWS Transit Gateway and its Equal Cost MultiPathing (ECMP) capability, you may know that in order to avoid asymmetric routing, you need to perform source address translation at the firewall. This will replace the original source of the traffic with firewall’s IP, which could become problematic for any application that requires visibility into the traffic’s source address. For example, if we have an application that is tracking application transactions based on the source of the traffic, the source of the traffic will always be the firewall’s interface instead of the actual source. This diminishes the flexibility and applicability of this architecture for East-West inspection. With Aviatrix, you do not need to make this tradeoff between visibility and scalability. Aviatrix will manage load balancing across the firewall instances and retain visibility across all traffic.

Move fast with Aviatrix

Beyond firewall insertion, Aviatrix helps speed up build and management of your complex AWS environment. In our current cloud-based world, users have set high expectations for an infrastructure’s speed and agility. The complete Aviatrix Enterprise Cloud Backbone Service leverages a combination of intelligent orchestration and control with Aviatrix gateway technologies, in concert with native public cloud transit services to significantly increases IT agility in response to business requirement changes. Gone are the days of asking users to wait for weeks to get what they need in the cloud. Aviatrix decouples your operation from micro-configurations that are required to adapt to changes in the cloud. It orchestrates and automates the complex steps of building networks in the cloud, giving you the ultimate state that you are looking for. With that, you can react and service your business users and customers much faster.

To learn more, register for this upcoming webinar, “Best Practices for Deploying Palo Alto Networks VM-Series in an AWS Transit Network: Simplify Deployment and Optimize Performance, Scale and Visibility” taking place on May 23 at 10 am PT.

Best Practices for Deploying Palo Alto Networks VM-Series in an AWS Transit Network
Best Practices for Deploying Palo Alto Networks VM-Series in an AWS Transit Network
Sam Ghardashem

Written by

Sam Ghardashem

Sam is a Product Manager and technology evangelist at Aviatrix Systems. Prior to this role, he was a Solutions Manager at Ixia Communications (now part of Keysight Technologies), focused on Private and Public Cloud network and security products. Sam comes from a diversified technical background in Networking, SDN, Virtualization, and Cloud computing. In his spare time, he enjoys outdoor activities, and playing team sports.

Related Posts

Francesca Vigliani
— April 30, 2019

Cloud Academy is Coming to the AWS Summits in Atlanta, London, and Chicago

Cloud Academy is a proud sponsor of the 2019 AWS Summits in Atlanta, London, and Chicago. We hope you plan to attend these free events that bring the cloud computing community together to connect, collaborate, and learn about AWS. These events are all about learning. You can learn how t...

Read more
  • Amazon Web Services
  • AWS
  • AWS Summits
Paul Hortop
Paul Hortop
— April 2, 2019

How to Monitor Your AWS Infrastructure

The AWS cloud platform has made it easier than ever to be flexible, efficient, and cost-effective. However, monitoring your AWS infrastructure is the key to getting all of these benefits. Realizing these benefits requires that you follow AWS best practices which constantly change as AWS...

Read more
  • Amazon Web Services
  • monitoring
Stuart Scott
— March 14, 2019

Multiple AWS Account Management using AWS Organizations

As businesses expand their footprint on AWS and utilize more services to build and deploy their applications, it becomes apparent that multiple AWS accounts are required to manage the environment and infrastructure.  A multi-account strategy is beneficial for a number of reasons as ...

Read more
  • Amazon Web Services
  • Identity Access Management
Badrinath Venkatachari
Badrinath Venkatachari
— February 1, 2019

10 Common AWS Mistakes & How to Avoid Them

Massive migration to the public cloud is changing architecture patterns, operating principles, and governance models. That means new approaches are vital to get a handle on soaring cloud spend. Because the cloud’s short-term billing cycles call for financial discipline, you must empower...

Read more
  • Amazon Web Services
  • Operations
Andrew Larkin
— January 15, 2019

2018 Was a Big Year for Content at Cloud Academy

As Head of Content at Cloud Academy I work closely with our customers and my domain leads to prioritize quarterly content plans that will achieve the best outcomes for our customers.We started 2018 with two content objectives: To show customer teams how to use Cloud Services to solv...

Read more
  • Amazon Web Services
  • Cloud Computing
  • Google Cloud Platform
  • microsoft azure
Jeremy Cook
— November 29, 2018

Amazon Elastic Inference – GPU Acceleration for Faster Inferencing

“Add GPU acceleration to any Amazon EC2 instance for faster inference at much lower cost (up to 75% savings)”So you’ve just kicked off the training phase of your multilayered deep neural network. The training phase is leveraging Amazon EC2 P3 instances to keep the training time to a...

Read more
  • Amazon Web Services
  • Elastic Inference
  • re:Invent 2018
Logan Rakai
— November 29, 2018

IoT Thrives on AWS — re:Invent IoT Announcement Roundup

The Internet of Things (IoT) embeds technology into any physical thing to enable never before seen levels of connectivity. IoT is revolutionizing industries and creating many new market opportunities, with management consulting firm McKinsey predicting the IoT market reaching up to $581...

Read more
  • Amazon Web Services
  • IoT
  • re:Invent 2018
Stuart Scott
— November 29, 2018

New Security & Compliance Service: AWS Security Hub

This morning’s Andy Jassy keynote was followed by the announcement of over 20 new services across a spectrum of AWS categories, including those in Security and Compliance, Database, Machine Learning, and Storage.  One service that jumped out to me was the AWS Security Hub, currently...

Read more
  • Amazon Web Services
  • re:Invent 2018
  • Security
Jeremy Cook
— November 28, 2018

AWS Firecracker: Next Generation Virtualization for MicroVMs

“Firecracker is an open source virtualization technology that is purpose-built for creating and managing secure, multi-tenant containers and functions-based services.”One of the great things embedded in Amazon Web Services DNA is their unparalleled vision and innovation in the compute...

Read more
  • Amazon Web Services
  • Firecracker
  • re:Invent 2018
  • Virtualization
Stuart Scott
— November 28, 2018

New Custom Key Stores in KMS – Backed by CloudHSM

Another new announcement was made by AWS here at re:Invent, this time in the popular security category. AWS has announced new custom key stores backed by CloudHSM. Here's some background and a summary of what this means.The Key Management Service (KMS) stores and generates encryptio...

Read more
  • Amazon Web Services
  • KMS
  • re:Invent 2018
Stuart Scott
— November 26, 2018

New Amazon S3 Features Announced at re:Invent

In true AWS style, a number of new features and services were announced yesterday, the day before the official start of re:Invent.Three of these announcements were related to Amazon S3 which included: S3 Intelligent Tiering (A new storage class) Batch Operations for Object M...

Read more
  • Amazon S3
  • Amazon Web Services
  • re:Invent 2018
  • S3