AWS Transit Gateway

[fwmike]

Hello,

Is there planned AWS Transit Gateway integration? There is mention but no detail in this video:

https://www.youtube.com/watch?v=6fhwoAwYrug

Other than operational ease, the Transit Gateway advantages appear limited. Traffic between VPCs is not encrypted. VPC segmentation is via routing and does not traverse a firewall.

[jmeurer]

Yes, we announced our intentions here.

https://researchcenter.paloaltonetworks.com/2018/11/reinvent-2018-update-aws-security-hub-integratio...

You can build it out manually today, it works and has been tested internally.  We will be releasing additional documentation and templates soon.

I would recommend reaching out to your account team for additional information.

[fwmike]

Thanks @jmeurer.

Is there an ETA on the documentation?

I've asked our SE for more details.

---

@jmeurer wrote:

Yes, we announced our intentions here.

https://researchcenter.paloaltonetworks.com/2018/11/reinvent-2018-update-aws-security-hub-integratio...

You can build it out manually today, it works and has been tested internally.  We will be releasing additional documentation and templates soon.

I would recommend reaching out to your account team for additional information.

---

[Cdchamberlin]

Hi @jmeurer

Any updates on the documentation? I'm interested in securing traffic flowing Inbound, East/West and Outbound with VPC insertion and VPN insertion. Particulary interested in taking advantage of ECMP VPN to connect the VM_SERIES to the TG. Any documentation would be greatly appreciated.

Thank you.

[jperry1]

Here is some information on Transit Gateway manual deployment as well as a YAML template for automated deployments. Hope this helps. 

https://github.com/PaloAltoNetworks/TransitGatewayDeployment

[Cdchamberlin]

Hi @jperry1 ,

My concern with this design is the VPC attachment from TGW SN to the TGW. Rather than using ECMP VPN links 'that I have been unable to find documentation on', the data sent across that connection will be in the clear; right? 

What are your thoughts on that? 

[buzor.okoye]

Fantastic documentation here in the manual build https://github.com/PaloAltoNetworks/TransitGatewayDeployment, I think you left out one thing. A need to add default route on FW2 pointing to eth1, otherwise the outbound traffic will be dropped by the firewall.

[DewhirstR]

I am on my third or fourth attempt to walk through the Manual build guide and every time I reach Page 22, step 8, the TGW Attachment "attach-spoke1" is not available as a target.  Only the tgw-security gateway.

[jmeurer]

Please switch the deployment guide and reference architecture here. 

https://www.paloaltonetworks.com/resources/reference-architectures/aws

[Cdchamberlin]

Hi @DewhirstR ,

Hope all is well and you get this worked out.

Take a look at page 13-15 and verify the VPC attachments for both spokes to the TGW. Verify Associations in the TGW Route Table for the VPCs.