About crypto

Hi Jperry, It is possible now. ... View more

After connecting the NICs to the Palo Alto, you must reboot. cupcake 2048 ... View more

This would be true if you were only using AWS native constructs but introducing the Palo Alto FW in the "Transit" VPC would allow you to pass traffic/inspect traffic by sending traffic to a VPC subnet ENI resource to another subnet ENI resource. In effect, the Palo Alto FW becomes the "transit router" for the VPC. VPCs as AWS native constructs are non-transitory in nature but a FW can act as the bridge.   ... View more

Hi @crypto ,   That is correct, with SSL decryption firewall will have visibility over the full URL, which ensure more accurate categorization. If no SSL decryption is enabled FW will use certificate subject name or subject alternative name to identify the requested site and use this information for categorization.   One good example that saw somewhere in this forum a while ago is - take blogger.com which is categorized by PAN-DB as " Personal Sites and Blogs". If I create a blog there to discuss weapons, my blog should fall under "Weapons" category, but since your firewall doesn't have SSL decryption enabled it will only inspect the SSL certificate and will now that the user is trying to react blogger, which is save in general. But if you enable SSL decryption firewall will have access to the full URL and will know that not only user is trying to reach blogger.com, but which specific blog it is trying to reach it and apply more granular control.   Same goes for any other sites that is using wildcard certificate for the whole domain, but different subdomains are categorized differently.      To sum up - even if your don't use SSL decryption you will be able to block HTTPS. In general you probably will be fine without decryption, as you explain it correctly it will give you more visibility and you will have granular control over some edge cases URLs ... View more

If using the TGW, vpn to the TGW rather than to the firewalls and use the TGW routing mechanism to route through the firewalls before going to the spoke VPC.  If using a single VPC, vpn to a VGW attached to the VPC and use Ingress Routing to route through the firewalls.  If you VPN to the firewalls and they are not configured for HA, you either need to SNAT the traffic or use some additional scripting to update the VPC routing to avoid asymmetry.   I believe you could benefit from a white board session with one of our SEs.  Reach out to your local account team and they can assist with locking in a design that suites your environment. ... View more