AWS - Palo ALto IPSEC or AWS native IPSEC?

[junior_r]

AWS - Palo ALto IPSEC or AWS native IPSEC?

Which is better any why? 

Thanks

[jperry1]

The all depends on what type of design and throughput you are looking for?

For example if you use AWS Native IPsec then you will need to setup a VGW which has a limit of 1.25 Gbps throughput

if you setup VM-Series to Device your limit is only the bandwidth and the performance capabilities of the devices you are using for VPN. That will probably be the main thing to consider but I am sure there is more. 

[jperry1]

The AWS VGW limit is 1.25Gbps not Mbps

[junior_r]

@jperry1 wouldn't VM-Series to Device be slower...even if I take the VM with higest resources?

Thanks

[jperry1]

It depends on the size VM-Series you use but certain VM-series devices will give you over 2GB throughput on IPSec. At that point you are at the mercy of your Internet speed. 

[mrzepa2]

It would be best to do the VPN to AWS and let the VM firewall deal with inspection. After all, why bog down the VM firewall with the extra overhead of doing encryption/decryption? AWS VPN is also pretty easy to set up, even with BGP for dynamic routing for failover.

[jmeurer]

Without knowing more about your use case, the decision around where to decrypt will come down to routing.  In general, if you terminate on the VGW, there are very limited options to have the traffic route through the Firewalls due to routing limitations within the VPC.  AWS typical recommends "Transit VPC" designs where remote traffic and/or spoke VPC traffic can route through multiple Firewalls in a fault tolerant fashion.  You can find both manual and automated Transit VPC Options here.  

https://github.com/PaloAltoNetworks/aws-transit-vpc