topic AWS - Palo ALto IPSEC or AWS native IPSEC? in VM-Series in the Public Cloud

AWS - Palo ALto IPSEC or AWS native IPSEC?

junior_r — Tue, 23 Oct 2018 20:43:06 GMT

AWS - Palo ALto IPSEC or AWS native IPSEC?

Which is better any why?

Thanks

Re: AWS - Palo ALto IPSEC or AWS native IPSEC?

jperry1 — Wed, 24 Oct 2018 18:51:31 GMT

The all depends on what type of design and throughput you are looking for?

For example if you use AWS Native IPsec then you will need to setup a VGW which has a limit of 1.25 Gbps throughput

if you setup VM-Series to Device your limit is only the bandwidth and the performance capabilities of the devices you are using for VPN. That will probably be the main thing to consider but I am sure there is more.

Re: AWS - Palo ALto IPSEC or AWS native IPSEC?

jperry1 — Wed, 24 Oct 2018 18:51:53 GMT

The AWS VGW limit is 1.25Gbps not Mbps

Re: AWS - Palo ALto IPSEC or AWS native IPSEC?

junior_r — Wed, 24 Oct 2018 23:38:43 GMT

@jperry1 wouldn't VM-Series to Device be slower...even if I take the VM with higest resources?

Thanks

Re: AWS - Palo ALto IPSEC or AWS native IPSEC?

jperry1 — Thu, 25 Oct 2018 00:51:58 GMT

It depends on the size VM-Series you use but certain VM-series devices will give you over 2GB throughput on IPSec. At that point you are at the mercy of your Internet speed.

Re: AWS - Palo ALto IPSEC or AWS native IPSEC?

mrzepa2 — Wed, 31 Oct 2018 19:29:45 GMT

It would be best to do the VPN to AWS and let the VM firewall deal with inspection. After all, why bog down the VM firewall with the extra overhead of doing encryption/decryption? AWS VPN is also pretty easy to set up, even with BGP for dynamic routing for failover.

Re: AWS - Palo ALto IPSEC or AWS native IPSEC?

jmeurer — Wed, 31 Oct 2018 20:16:24 GMT

Without knowing more about your use case, the decision around where to decrypt will come down to routing. In general, if you terminate on the VGW, there are very limited options to have the traffic route through the Firewalls due to routing limitations within the VPC. AWS typical recommends "Transit VPC" designs where remote traffic and/or spoke VPC traffic can route through multiple Firewalls in a fault tolerant fashion. You can find both manual and automated Transit VPC Options here.

https://github.com/PaloAltoNetworks/aws-transit-vpc