topic Re: How to add a Firewall for ALB which is connected to Global accelerator in AWS in VM-Series in the Public Cloud

How to add a Firewall for ALB which is connected to Global accelerator in AWS

KimSiah — Wed, 14 Jun 2023 05:53:33 GMT

I have implemented a security service VPC using VM series and Gateway Load balancer. in the case where traffic is coming thru the IGW, I am able to route incoming traffic from IGW to security VPC for inspection and then back the application ALB.

However, I am not sure how to do this if my ALB is connected to a Global Accelerator (when traffic does not pass thru IGW). where and how could I insert the GWLB endpoint ?

The diagram to illustrate the connectivity

Please enlighten. Thanks.

Re: How to add a Firewall for ALB which is connected to Global accelerator in AWS

aleksandar.astardzhiev — Tue, 20 Jun 2023 15:08:39 GMT

Hi @KimSiah ,

I don't have experience with Global Accelerator, but when reading AWS docs it is basically an Anycast public address. Which if I could just simplify - traffic to the Global Accelerator IP will be "forwarded" to the ALB, but again over the Internet Gateway.

I am assuming the anycast IP will use ALB public IP and for that will also need IGW to be deployed, which means same GWLBendpoint should be sufficient.

I am curious if have tested it and what is the result.

Re: How to add a Firewall for ALB which is connected to Global accelerator in AWS

KimSiah — Mon, 25 Sep 2023 08:13:38 GMT

GA does not send traffic via IGW, GA traffic is not even controlled by the VPC NACL. I have removed the GA, instead, I used a NLB in front of the ALB and made IGW send traffic for the NLB to the GWLB endpoint