Next-Generation Firewall Services VPC Integration
•
5 j'aime•1,548 vues
Protecting a small number of VPCs with a next-generation firewall is relatively easy, but what happens when you have hundreds of VPCs and regularly add more as business groups or new apps come on-line? How can you maintain a prevention architecture without slowing the business? One concept is to build a services VPC that protects your existing and new VPCs. This deep dive session will discuss how to integrate next-generation firewalls in a services VPC with the Palo Alto Networks VM-Series in AWS. Topics will include architectural design considerations, routing recommendations, and dynamic fail-over. Session sponsored by Palo Alto Networks.
Recommandé
Recommandé
Contenu connexe
Tendances
Tendances (20)
En vedette
En vedette (20)
Similaire à Next-Generation Firewall Services VPC Integration
Similaire à Next-Generation Firewall Services VPC Integration (20)
Plus de Amazon Web Services
Plus de Amazon Web Services (20)
Dernier
Dernier (20)
Next-Generation Firewall Services VPC Integration
- 1. © 2016, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Warby Warburton Technical Marketing Engineering Manager Palo Alto Networks July 13, 2016 Next-Generation Firewall Services VPC Integration
- 2. About Palo Alto Networks CORPORATE HIGHLIGHTS • Founded in 2005; first customer shipment in 2007 • Safely enabling applications and preventing cyber threats • Able to address all enterprise cybersecurity needs • Exceptional ability to support global customers • Experienced team of 3,500+ employees • Q3 FY16: $345.8M revenue $MM REVENUES ENTERPRISE CUSTOMERS $13 $49 $119 $255 $396 $598 $928 $0 $200 $400 $600 $800 $1,000 FY09FY10FY11FY12FY13FY14FY15 4,700 9,000 13,500 19,000 26,000 0 4,000 8,000 12,000 16,000 20,000 24,000 Jul-11 Jul-12 Jul-13 Jul-14 Jul-15
- 3. Securing one VPC IPSec VPN DC-FW1 DC-FW2 AZ1b Web1-01 Web1-02
- 4. AZ1c Securing one VPC AZ1b IPSec VPN DC-FW1 DC-FW2 Web1-01 Web1-02 Web2-01 Web2-02 IPSec VPNs
- 5. Securing lots of VPCs DC-FW1 DC-FW2 Marketing App HR App QA Environment Dev Environment
- 6. Central security enforcement • Amazon Virtual Private Cloud VPCs can be created quickly for project specific infrastructures • Many departments have one or more VPCs dedicated to their needs • But granting access to/from a corporate network creates a security challenge • It is more difficult to create a centrally managed policy for securing disparate VPCs • The services VPC architecture creates a single point of policy enforcement and management
- 7. Bandwidth optimization • Another advantage to the services VPC architecture is the optimization of bandwidth • Many VPCs will have a hybrid cloud connection to the private data center • This connection can be used not only for accessing and managing the application but also for server-initiated sessions like updating software • Many hybrid designs require server software update traffic to first traverse the corporate network connection and then cross the Internet to Microsoft/Linux update servers • This creates additional load on the connection back to corporate • A better solution is to securely allow the servers to leverage the Internet connection that is already present in each AWS Region
- 8. Region Services VPC Subnet 1 Availability Zone 2 Availability Zone 1 Subnet 2 Region Subscribing VPC Subnet 1 Availability Zone 2 Availability Zone 1 Subnet 2
- 9. Region Services VPC Subnet 1 Availability Zone 2 Availability Zone 1 Subnet 2
- 10. DC-FW1 DC-FW2 Services VPC + Hybrid + Internet Gateway
- 11. DC-FW1 DC-FW2 Routing Default route learned via DHCP on E1/1 Static route defined for enterprise network Redistribution profile shares static routes with BGP peers BGP routes propagated into local route table SNAT on gateway firewall ensures symmetric return
- 13. Options for even more scale • Dealing with potential virtual private gateway subnet collisions for larger scale deployments • Lots of VPCs in a single region • There are several options for dealing with this: • Terminate the duplicate IPsec tunnels on virtual routers in front of the VM-Series • Without VRF support, could use multiple virtual routers • Or continue to terminate on the firewalls and use new VM-Series pair • Or use physical firewalls in an AWS Direct Connect location
- 14. DC-FW1 DC-FW2 LOTS more scale Direct Connect Location Service Provider Links
- 15. Scale Cost Open source routers with VRF support Commercial routers with VRF support Multiple firewall pairs Physical firewalls in direct connection rack Multiple open source routers
- 16. Learn More at Booth 201
- 17. © 2016, Amazon Web Services, Inc. or its Affiliates. All rights reserved. Thank you