AWS Transit Gateway

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.

AWS Transit Gateway

L2 Linker

Hello,

 

Is there planned AWS Transit Gateway integration? There is mention but no detail in this video:

 

https://www.youtube.com/watch?v=6fhwoAwYrug

 

Other than operational ease, the Transit Gateway advantages appear limited. Traffic between VPCs is not encrypted. VPC segmentation is via routing and does not traverse a firewall.

9 REPLIES 9

L4 Transporter

Yes, we announced our intentions here.

https://researchcenter.paloaltonetworks.com/2018/11/reinvent-2018-update-aws-security-hub-integratio...

 

You can build it out manually today, it works and has been tested internally.  We will be releasing additional documentation and templates soon.

 

I would recommend reaching out to your account team for additional information.

Thanks @jmeurer.

 

Is there an ETA on the documentation?

 

I've asked our SE for more details.


@jmeurer wrote:

Yes, we announced our intentions here.

https://researchcenter.paloaltonetworks.com/2018/11/reinvent-2018-update-aws-security-hub-integratio...

 

You can build it out manually today, it works and has been tested internally.  We will be releasing additional documentation and templates soon.

 

I would recommend reaching out to your account team for additional information.



 

Hi @jmeurer

 

Any updates on the documentation? I'm interested in securing traffic flowing Inbound, East/West and Outbound with VPC insertion and VPN insertion. Particulary interested in taking advantage of ECMP VPN to connect the VM_SERIES to the TG. Any documentation would be greatly appreciated.


Thank you.

Here is some information on Transit Gateway manual deployment as well as a YAML template for automated deployments. Hope this helps. 

 

https://github.com/PaloAltoNetworks/TransitGatewayDeployment

 

 

Hi @jperry1 ,

 

My concern with this design is the VPC attachment from TGW SN to the TGW. Rather than using ECMP VPN links 'that I have been unable to find documentation on', the data sent across that connection will be in the clear; right? 

 

What are your thoughts on that? 

Fantastic documentation here in the manual build https://github.com/PaloAltoNetworks/TransitGatewayDeployment, I think you left out one thing. A need to add default route on FW2 pointing to eth1, otherwise the outbound traffic will be dropped by the firewall.

 

 

I am on my third or fourth attempt to walk through the Manual build guide and every time I reach Page 22, step 8, the TGW Attachment "attach-spoke1" is not available as a target.  Only the tgw-security gateway.Screen Shot 2020-03-10 at 2.36.38 PM.png

Please switch the deployment guide and reference architecture here. 

https://www.paloaltonetworks.com/resources/reference-architectures/aws

 

 

Hi @DewhirstR ,

 

Hope all is well and you get this worked out.

 

Take a look at page 13-15 and verify the VPC attachments for both spokes to the TGW. Verify Associations in the TGW Route Table for the VPCs. 

 

 

  • 13094 Views
  • 9 replies
  • 1 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!