DESIGN - AWS Gateway Load-Balancer with PAN Firewalls for Inbound, Outbound and East-West Security

In this video Ralph Carter designs an AWS Security VPC architecture in order to support Inbound, Outbound and East-West Traffic Inspection use cases within AWS. The AWS construct design is discussed along with Packet Walks for all of the use-cases.

[@damianfernandez1]

Very grateful for putting this out. Cleared all my doubts. Amazingly well done !

[@vardanvardanyan884]

Awesome presentation. Very clearly explained with packet walk. Thank you!

[@VirtualizeStuff]

Excellent job Ralph explaining the GWLB and the awesome packet walk! Learned a ton!

[@n8goodman]

You just saved me so much time. Thank you for making this!

[@muhammadyaqoob9777]

Hi Ralph, thanks for sharing amazing content! Thanks Mo

[@ADV-IT]

Great detailed explanation, thanks!

[@yourrakesh123]

This is an awesome tutorial that I was searching on youtube. Excellent explanation on setting up GWLB and firewall in multi-account environment through TGW. :)

[@dmohan16]

Excellent explanation..!! well articulated with the traffic flows.

[@johnjiang2470]

Ralph, great presentation!

[@subramanyasastry517]

Thank you for the detailed diagram and explanation. Keep up the Good Job.

[@trandat7274]

Many thanks Ralph, your video is very very great.... Thanks a lot !!!!

[@zubairqureshi9063]

Awesome presentation and explanation 👍🏻

[@abelcarvajalgil6705]

Thank you for your job. Excellent explication traffic North-South East-West

[@seph2x538]

Bravo !! Awesome presentation and walkthrough the use case. I am going to lab it asap. Thank you

[@shankarmaheswaran5435]

Hi Joe, Have you done setup with the Lab? I need some help.

[@psaneem]

Awesome presentation

[@arindamsaha9052]

That was an awesome explanation.

[@alinaqvi385]

Excellent and thank you, Mr. Carter.

[@ralphcarter769]

You are very welcome

[@edgarssimanis9381]

Thanks, awesome explanation

[@user-sf1cv5np6o]

Awesome video

[@abdallahezat8604]

great effort !

[@user-xs6hr1ol7d]

Quite Impressive !

[@ryanmilton2643]

Fantastic presentation. I’m working on exactly this model.

[@muhammadyaqoob9777]

Hi Ryan, How is deployment going? I am working on the same design maybe good to share some notes? let me know thanks

[@ryanmilton2643]

@@muhammadyaqoob9777 it is going well. Mine is a bigger environment. Not 100% out of POC

[@muhammadyaqoob9777]

@@ryanmilton2643 Thanks, I am close to completion for my deployment of this with PA's cluster in multiple regions.

[@djangosmissingfingers]

This is awesome. I would love to see an explanation of how this changes with Overlay routing and app-vpc to subint matching as well.

[@gkorten]

Hey, Ralph been a while. Thanks for sharing the info, good stuff.

[@ralphcarter769]

Anytime pal!

[@gkorten]

@@ralphcarter769 Ralph can you give me a call at work. This is about a few projects I am working on.

[@mehulpruthi]

Thank a ton Ralph, request you to teach us about Azure GWLB with PAN Firewalls for Inbound, Outbound and East-West Security

[@vennempify]

This is fantastic. Though this subnetting would require a public IP on the management interface.

[@benjaminlugger2908]

Hi! This is a great presentation! It provides a very good starting point. To get the full architecture picture it would be great to address the following in addtion: 1. On-Premise connectivity via VPN and DX attachment; 2. TGW Attachment to keep AWS cloud traffic in the cloud. 3. Internet Inbound (Ingress) with two AZs (e.g. How the introduction of a third party Load Balancer (e.g. f5) could look like; Ad3) I know that AWS provides the ALB and NLB beside the GWLB but some companies want to rely on their load balancers (e.g. f5) across all environments (on-premise and cloud (aws, azure, google, ...). The presentation is really great and I have my personal understanding on how points 1. 2. and 3. fit into that architecture but it would be great to see others (your view Ralph on that). All the best. THX YOU AGAIN! ROUTING MAKES SENSE NOW :-D

[@DARK_YT242]

Great Job. awesome presentation!! .Want to deploy in my environment. Do you have the next session of the implementation video?.

[@vyaspranav]

awesome...

[@tc-cm5ml]

Awesome video..great work Ralph...Could you please also do a video referencing the same architecture but without Gateway LB and with usual VPN/VPC attachments...that would be a great help for me since the Gateway LB is not available in my region yet...Thanks a lot!!!

[@Shanayathukral]

Hi Raplh, great video! U mentioned about part 2 on how to ? May i know when u are doing that video?

[@PhaseHabit]

This is a great video! In the inbound flow, where are you authenticating (e.g., via mTLS, UN/PW) the traffic? Is that needed in this case? I'm also assuming that if you didn't want East-West Prod to Dev traffic, you'd block that at the Palo (though I guess if you needed to refresh DEV from PROD for testing/development purposes) - is that right? Or is that simply looking for malicious content and session state and the GWLBe01/2 is looking at it's route table and if no there, would send a 404.

[@thecatbellayuki]

That was freaking awesome. Just one question though. The GWLBe03 subnet cidr should've been /28 instead of /26 and thus the subsequent change in the DEMO-Prod-Ingreass_RT. Or am I missing something?

[@RicardoGutierrezOchoa]

Great job. QQ, what software did you use for the presentation? was it PPT?

[@sskavuri]

Thank you for the great design and explanation. If you don’t mind, can you share the diagram?

[@chatchaikomrangded960]

Best one!!

[@ralphcarter769]

Glad you liked it.

[@vainilk78]

Ralph, that was a great session. I want to know what charting tool you used ? I want to learn more about it to map my AWS drawing design better.

[@CreateWithDre]

Love it Ralph. Got this one working manually and traffic is flowing inbound/outbound as intended. Only issue is with Global Protect, my VPN users can't seem to connect to internal resources. Is that because the return path is coming back across the GWLB, but the forwarding to a server (is going across the TGW)? Any suggestions/articles that you know of addressing this concern? Thanks so much and keep up the great work.

[@hakinen4000]

Hi Ralph, thank you for posting this, truly helped this newbie understand how AWS GW can be used. I do have a question, what if this is trying to be deployed in an environment that already has PA's setup across multiple sites and these sites connect to the Core (via IPSEC), where most of our on-prem apps reside? Thanks again for the great and easy to understand video

[@tc-cm5ml]

Hi Ralph, do we need public IPs to be assigned compulsorily on any of the devices in the architecture you designed to make it work, please let me know... Thanks a lot!

[@networkers5037]

if you can share any document or video of deployment guide for manual integration of GWLB and PAN VM series it will be helpful.

[@tdelnatte]

Great job, very grateful. Jusk ask, is it possible to create a gateway loadbalancer endpoint cross account environnement typically for inbound from internet?

[@chrisholman7468]

I found this very insightful (well earned kudos to you Ralph), but when trying to implement it, I can't make it support a load balanced application. The Prod IGW routing table only routes to AZ 1a, therefore the app is not load balanced. I've been trying to figure out how to make this possible, but no luck so far. Any hints welcome.

[@arunabhbiswas3210]

Very few videos available on KZbin that talks about this architecture, but yours one is unique and best of all. Quick question about the outbound traffic (north-south) that is flowing from PROD vpc to the internet via security vpc transit attachment, that has only routes to security vpc, prod vpc and dev vpc, but i dont see any entry that tells it to redirect this outbound traffic to security vpc. Then how come it will reach to security vpc transit eni? can you please explain this?

[@David-bc2oj]

What would the architecture look like if I needed to put a WAF in front of the http/https ports? The WAF would be working together with the Palo Alto NGFW to handle non-http/https traffic

[@dnyaneshwarnarale88]

Awesome content. I do have One Doubt where to map Elastic IP's, from those IP's server will be accessible? Can anyone knows please let us know?

[@mmantilla2010]

Hi, just amazing video, very good walk through. I wanted to ask in this architecture. Where would the on premise vpn or direct connect terminate? Would it be another spoke VPC? Second question is, where would I put a VPN firewall like an ASav for Anyconnect VPN. Thank you

[@muhammadyaqoob9777]

Hi Maikel, in my opinion what you can do is create a separate RT for Direct Connect and VPN in TGW and enable routing to and from on-prem through that.

[@gattupalliaditya7244]

Can Demo-Security IGW be used for inbound traffic too instead of Demo-Production IGW ?

[@syedlogin]

Well explained, appreciate it. as you were mentioning, do you have deployment video as well?

[@nonatercesa2865]

Very nice video; well explained. Thanks Ralph. I have a few questions though. Is there a reason why you did not allow the Palo Alto (PA) firewalls to act as the NAT gateway? I have a new AWS deployment with PA firewalls in active-passive mode but one of the infrastructure requirement is to allow the PA to act as the NAT gateway, and as the VPN Gateway because the intention is to create a site-to-site (S2S) IPSec tunnel between the PA in AWS and another PA that is on-premise. I like to know if I will still need a GWLB in a case where the PAs are in active-passive and not in active-active. Awaiting your reply. Thanks again.

[@matheusbertimansano9693]

i m curious as well to know if is required

[@vennempify]

@@matheusbertimansano9693 Apparently this is supported with a slightly different architecture - I'm playing with this now and have the above architecture working as expected. I believe if you wanted to NAT out thru PAT it would rrequire another feature called Overlay Routing which released in 10.0.3 or 10.0.4.

[@marekwugmailcom]

Very clear and helpful presentation. Thanks ! But with EC2 with EIP is simple.The only question is how to protect ALBs (either internal or internet-facing). In case of internet-facing Will ingress routing help to route traffic to GLB endpoint ?

[@ralphcarter769]

Yes, Ingress traffic > GWLBe > ALB, follow the routing.

[@looqmern]

Hi, how does one configure the palo alto to use one interface for inbound and outbound traffic and what does the security policy look like? Thanks

[@Shanayathukral]

I think it will be same zone to same zone policy, but your source destination subnet will be used as a differentiator.

[@shamstabrez2986]

plz make video on cloud wan with complete details n hands on lab

[@srinivasanandababu2701]

Can we use VPCe instead of traversing via Transit GW?

[@dougclendening5896]

What if you don't want inline and just want to mirror the TGW traffic off to a security vpc to be analyzed?

[@teibidh]

You want VPC Traffic Mirroring for this, I believe.

[@jayf9553]

ON the data port of the Palo's do we set up zones? I feel like you lose the ability to apply zones if you're routing all traffic though that data port without applying multiple zones. How do you apply multiple zones to one interface?

[@maxcavalera917]

You can use sub-interfaces(this will over complicate the design) or you can just control traffic based on src/dst instead of zones (you will need to deny all intra-zone traffic that is allow by default)

[@randicalib]

hi, where can i watch the configuration video?

[@s_dee_13]

Does this support ipv6?

[@bx1803]

Is there a template for this available?