Cloud NGFW for AWS Deployment Architectures
Distributed Deployment Architecture
In a distributed deployment architecture, Cloud NGFW endpoints are deployed in each of the VPC’s availability zones to send traffic to its dedicated Cloud NGFW resource. Any traffic leaving the availability zone is redirected to the Cloud NGFW endpoint and sent to the Cloud NGFW for inspection and enforcement. This model reduces the possibility of misconfiguration and limits the scope of impact.
Figure 1: Cloud NGFW Distributed Deployment Architecture
Protect Inbound Traffic to a VPC
Figure 2: Cloud NGFW is deployed to protect Inbound Traffic from Internet (Single AZ)
Figure 3: Cloud NGFW is deployed to protect Inbound Traffic from Internet (Multiple AZ)
Protect Outbound Traffic to Internet
Figure 4: Cloud NGFW is deployed to protect Outbound Traffic to Internet (Single AZ)
Figure 5: Cloud NGFW is deployed to protect Outbound Traffic to Internet (Multiple AZ)
Protect Traffic between TWO subnets in a VPC
Figure 6: Cloud NGFW is deployed to protect traffic between two Subnets in a (Single AZ)
Figure 7: Cloud NGFW is deployed to protect traffic between two Subnets in a (Multiple AZ)
2. Centralized Deployment Architecture
In a centralized deployment, a dedicated security VPC provides a central approach to managing access control and East-West threat prevention of traffic between VPCs and on-premises networks using a TGW.
You must specify the security VPC and Firewall subnet(s) when creating the Cloud NGFW. The Cloud NGFW endpoints are deployed in the firewall subnets. Each Transit Gateway subnet requires a dedicated VPC route table to ensure the traffic is forwarded to the Cloud NGFW endpoint within the same AZ.
These route tables have a default route (0.0.0.0/0) pointing towards the NGFW endpoint in the same AZ.
Note: To ensure that the Cloud NGFW can inspect traffic that is routed between VPC attachments, you must enable appliance mode on the transit gateway VPC attachment for the security VPC.
Figure 8: Cloud NGFW Centralized Deployment Architecture
Protect Outbound Traffic to Internet
Figure 9: Cloud NGFW is deployed to protect outbound traffic to Internet (Single AZ)
Figure 10: Cloud NGFW is deployed to protect outbound traffic to Internet (Multiple AZ)
Protect Inbound Traffic to a VPC
Figure 11: Cloud NGFW is deployed to protect inbound traffic to a VPC (Single AZ)
Figure 12: Cloud NGFW is deployed to protect inbound traffic to a VPC (Multiple AZ)
Protect East-West Traffic between VPCs
Figure 13: Cloud NGFW is deployed to protect East-West Traffic between VPCs (Single AZ)
Figure 14: Cloud NGFW is deployed to protect East-West Traffic between VPCs (Multiple AZ)
... View more