topic Re: East west traffic in transit gateway with vpn attachment with firewall... in VM-Series in the Public Cloud https://live.paloaltonetworks.com/t5/vm-series-in-the-public-cloud/east-west-traffic-in-transit-gateway-with-vpn-attachment-with/m-p/381520#M1106 <P>You have two options.&nbsp; You can either use BGP to prepend the routes from one of the firewalls to create essentially an Active/Passive routing hierarchy or use SNAT.&nbsp; The former is generally preferred.&nbsp; We have this documented in our AWS Reference Architecture here.</P><P>&nbsp;</P><P><A href="https://www.paloaltonetworks.com/resources/reference-architectures/aws" target="_blank">https://www.paloaltonetworks.com/resources/reference-architectures/aws</A></P><P>&nbsp;</P> Fri, 22 Jan 2021 13:04:53 GMT jmeurer 2021-01-22T13:04:53Z East west traffic in transit gateway with vpn attachment with firewall... https://live.paloaltonetworks.com/t5/vm-series-in-the-public-cloud/east-west-traffic-in-transit-gateway-with-vpn-attachment-with/m-p/381441#M1105 <P>Hi Team,</P><P>&nbsp;</P><P>i am deploying two vm firewall in different AZ of same VPC</P><P>I will configure VPN attachment with firewall for east west and outbound&nbsp; traffic to be scanned by firewall.</P><P>&nbsp;</P><P>My concern is for the return traffic of east west from the vm firewall.</P><P>The outbound traffic will pass with vpn attachment but how the return traffic will flow?</P><P>&nbsp;</P><P>&nbsp;</P> Fri, 22 Jan 2021 06:48:48 GMT https://live.paloaltonetworks.com/t5/vm-series-in-the-public-cloud/east-west-traffic-in-transit-gateway-with-vpn-attachment-with/m-p/381441#M1105 omprasadax 2021-01-22T06:48:48Z Re: East west traffic in transit gateway with vpn attachment with firewall... https://live.paloaltonetworks.com/t5/vm-series-in-the-public-cloud/east-west-traffic-in-transit-gateway-with-vpn-attachment-with/m-p/381520#M1106 <P>You have two options.&nbsp; You can either use BGP to prepend the routes from one of the firewalls to create essentially an Active/Passive routing hierarchy or use SNAT.&nbsp; The former is generally preferred.&nbsp; We have this documented in our AWS Reference Architecture here.</P><P>&nbsp;</P><P><A href="https://www.paloaltonetworks.com/resources/reference-architectures/aws" target="_blank">https://www.paloaltonetworks.com/resources/reference-architectures/aws</A></P><P>&nbsp;</P> Fri, 22 Jan 2021 13:04:53 GMT https://live.paloaltonetworks.com/t5/vm-series-in-the-public-cloud/east-west-traffic-in-transit-gateway-with-vpn-attachment-with/m-p/381520#M1106 jmeurer 2021-01-22T13:04:53Z