topic Re: AWS Transit Gateway in VM-Series in the Public Cloud

AWS Transit Gateway

fwmike — Fri, 04 Jan 2019 18:28:02 GMT

Hello,

Is there planned AWS Transit Gateway integration? There is mention but no detail in this video:

https://www.youtube.com/watch?v=6fhwoAwYrug

Other than operational ease, the Transit Gateway advantages appear limited. Traffic between VPCs is not encrypted. VPC segmentation is via routing and does not traverse a firewall.

Re: AWS Transit Gateway

jmeurer — Fri, 04 Jan 2019 18:37:43 GMT

Yes, we announced our intentions here.

https://researchcenter.paloaltonetworks.com/2018/11/reinvent-2018-update-aws-security-hub-integration-aws-transit-gateway-support/

You can build it out manually today, it works and has been tested internally. We will be releasing additional documentation and templates soon.

I would recommend reaching out to your account team for additional information.

Re: AWS Transit Gateway

fwmike — Mon, 07 Jan 2019 15:11:50 GMT

Thanks @jmeurer.

Is there an ETA on the documentation?

I've asked our SE for more details.

@jmeurer wrote:
Yes, we announced our intentions here.
https://researchcenter.paloaltonetworks.com/2018/11/reinvent-2018-update-aws-security-hub-integration-aws-transit-gateway-support/

You can build it out manually today, it works and has been tested internally. We will be releasing additional documentation and templates soon.

I would recommend reaching out to your account team for additional information.

Re: AWS Transit Gateway

Cdchamberlin — Sun, 10 Mar 2019 02:10:24 GMT

Hi @jmeurer

Any updates on the documentation? I'm interested in securing traffic flowing Inbound, East/West and Outbound with VPC insertion and VPN insertion. Particulary interested in taking advantage of ECMP VPN to connect the VM_SERIES to the TG. Any documentation would be greatly appreciated.

Thank you.

Re: AWS Transit Gateway

jperry1 — Sun, 10 Mar 2019 02:53:08 GMT

Here is some information on Transit Gateway manual deployment as well as a YAML template for automated deployments. Hope this helps.

https://github.com/PaloAltoNetworks/TransitGatewayDeployment

Re: AWS Transit Gateway

Cdchamberlin — Mon, 11 Mar 2019 20:11:58 GMT

Hi @jperry1 ,

My concern with this design is the VPC attachment from TGW SN to the TGW. Rather than using ECMP VPN links 'that I have been unable to find documentation on', the data sent across that connection will be in the clear; right?

What are your thoughts on that?

Re: AWS Transit Gateway

buzor.okoye — Fri, 07 Feb 2020 02:21:22 GMT

Fantastic documentation here in the manual build https://github.com/PaloAltoNetworks/TransitGatewayDeployment, I think you left out one thing. A need to add default route on FW2 pointing to eth1, otherwise the outbound traffic will be dropped by the firewall.

Re: AWS Transit Gateway

DewhirstR — Tue, 10 Mar 2020 19:39:23 GMT

I am on my third or fourth attempt to walk through the Manual build guide and every time I reach Page 22, step 8, the TGW Attachment "attach-spoke1" is not available as a target. Only the tgw-security gateway.

Re: AWS Transit Gateway

jmeurer — Tue, 10 Mar 2020 19:44:48 GMT

Please switch the deployment guide and reference architecture here.

https://www.paloaltonetworks.com/resources/reference-architectures/aws

Re: AWS Transit Gateway

Cdchamberlin — Tue, 10 Mar 2020 20:08:08 GMT

Hi @DewhirstR ,

Hope all is well and you get this worked out.

Take a look at page 13-15 and verify the VPC attachments for both spokes to the TGW. Verify Associations in the TGW Route Table for the VPCs.