Design recommendation for PAN NGFW in AWS

[sdip009]

Hi,

We are moving our SaaS app to AWS which will periodically query remote endpoints sitting at 20+ of our customer's locations via IPsec. We are looking to keep the AWS architecture simple with a single VPC for the app.

What would be an ideal configuration on the PAN that would allow us to segment/isolate each of the customer's traffic so there isn't cross contamination incase one of the 20+ customers has a breach. 

To begin, we will only have 1 virtual NGFW.

[TomYoung]

Hi @sdip009 ,

Have you seen the AWS Reference Architecture guides?

https://www.paloaltonetworks.com/resources/reference-architectures/aws

Thanks,

Tom