topic Re: AWS securing outbound communication in private subnet in VM-Series in the Public Cloud

AWS securing outbound communication in private subnet

foobar7 — Mon, 22 Jan 2018 21:58:54 GMT

I've a private subnet in AWS that needs to be locked out from Internet access. But the instances in this private subnet need to access specific set of hosts (say update.java.com, update.ubuntu.com etc). Obviously the IP address associated with these hosts are dynamic. Does Palo Alto Networks Firewall (or any other solution) solve this scenario? If so, please provide pointers.

Re: AWS securing outbound communication in private subnet

hshah — Mon, 22 Jan 2018 22:02:32 GMT

Hi Foobar,

You can create custom URL and allow internet traffic for those URL for a specific subnet.

Please refer the following doc.

https://live.paloaltonetworks.com/t5/Configuration-Articles/How-to-Create-Custom-URL-Categories/ta-p/54355

-- Hardik Shah

Re: AWS securing outbound communication in private subnet

foobar7 — Tue, 23 Jan 2018 19:30:20 GMT

Thanks Hardik.

I'm assuming this solution is available in Palo Alto Networks VM-series Next-Gen Firewall Bundle 1/2 in AWS Marketplace. Please confirm.

Re: AWS securing outbound communication in private subnet

jperry1 — Tue, 23 Jan 2018 20:03:05 GMT

PAYG2 will have support for URL Filtering

https://live.paloaltonetworks.com/t5/AWS-Azure-Articles/VM-Series-for-AWS-and-Azure-Licensing-Considerations/ta-p/125552

If all you need to do is create a customer URL category and define the URLs then you shouldn't need a URL filtering license for that. But if you want URL filtering then PAYG2 is the way to go there.

Re: AWS securing outbound communication in private subnet

hshah — Tue, 23 Jan 2018 20:04:27 GMT

I Agree ...

Re: AWS securing outbound communication in private subnet

foobar7 — Tue, 23 Jan 2018 22:35:25 GMT

Thanks.

Is there a template readily available to deploy a simple solution for this usecase in AWS?

From link, I guess I'm trying to implement "Use Case: Secure the EC2 Instances in the AWS Cloud" section. Looking for a template that I leverage.

Thanks.