Hi all, We are working on moving some of our servers to AWS and they require 2 VPN redundant tunnels to be configured with our network. Amazon suggested to terminate the VPN on Internet edge router because the VPN redundancy requires BGP. Between the Internet edge router and the Palo Alto firewall, it is unprotected (but it will be on our physical premises). I have suggested to project team to terminate the VPN on Palo Alto instead. However, in this case, the PA3020 has to run BGP which is supported. My questions are: - whether running BGP will have a significant impact on performance? - As the existing firewall traffic does not run BGP, my plan is to run this AWS VPN on a different virtual router with 2 separate external and internal interfaces totally segregated from existing firewall traffic but still performs traffic inspection. Does this work? Do you have any best practice and recommendations for this VPN connectivity? Thanks! FYI: http://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/VPC_VPN.html vs. NIST 800-77 (http://csrc.nist.gov/publications/nistpubs/800-77/sp800-77.pdf) a standard for all US federal agencies to follow: 3 - Traffic Not Protected by IPsec. Organizations should consider carefully the threats against network traffic after it has been processed by the receiving IPsec gateway and sent without IPsec protection across additional network segments. For example, an organization that wants to place its VPN gateway outside its Internet firewalls should ensure that the traffic passing between the IPsec gateway and the Internet firewalls has sufficient protection against breaches of confidentiality and integrity.
... View more
