AWS - Palo ALto IPSEC or AWS native IPSEC?

Reply
L3 Networker

AWS - Palo ALto IPSEC or AWS native IPSEC?

AWS - Palo ALto IPSEC or AWS native IPSEC?

Which is better any why? 

 

 

Thanks

L5 Sessionator

Re: AWS - Palo ALto IPSEC or AWS native IPSEC?

The all depends on what type of design and throughput you are looking for?

For example if you use AWS Native IPsec then you will need to setup a VGW which has a limit of 1.25 Gbps throughput

if you setup VM-Series to Device your limit is only the bandwidth and the performance capabilities of the devices you are using for VPN. That will probably be the main thing to consider but I am sure there is more. 

L5 Sessionator

Re: AWS - Palo ALto IPSEC or AWS native IPSEC?

The AWS VGW limit is 1.25Gbps not Mbps

L3 Networker

Re: AWS - Palo ALto IPSEC or AWS native IPSEC?

@jperry1 wouldn't VM-Series to Device be slower...even if I take the VM with higest resources?

 

Thanks

L5 Sessionator

Re: AWS - Palo ALto IPSEC or AWS native IPSEC?

It depends on the size VM-Series you use but certain VM-series devices will give you over 2GB throughput on IPSec. At that point you are at the mercy of your Internet speed. 

L1 Bithead

Re: AWS - Palo ALto IPSEC or AWS native IPSEC?

It would be best to do the VPN to AWS and let the VM firewall deal with inspection. After all, why bog down the VM firewall with the extra overhead of doing encryption/decryption? AWS VPN is also pretty easy to set up, even with BGP for dynamic routing for failover.

L3 Networker

Re: AWS - Palo ALto IPSEC or AWS native IPSEC?

Without knowing more about your use case, the decision around where to decrypt will come down to routing.  In general, if you terminate on the VGW, there are very limited options to have the traffic route through the Firewalls due to routing limitations within the VPC.  AWS typical recommends "Transit VPC" designs where remote traffic and/or spoke VPC traffic can route through multiple Firewalls in a fault tolerant fashion.  You can find both manual and automated Transit VPC Options here.  

https://github.com/PaloAltoNetworks/aws-transit-vpc

 

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!