East-West Inspection with AWS Network Firewall and AWS Transit Gateway
Publication date: March 16, 2022 (Diagram history)
This architecture shows how to use AWS Transit Gateway to centralize the traffic inspection between several VPCs, both in the same Region or between Regions, using AWS Network Firewall.
East-west centralized inspection with Network Firewall architecture
The following steps describe the east-west traffic flow in this architecture:
-
Any traffic leaving a spoke VPC is routed to AWS Transit Gateway (TGW). The Transit Gateway route table associated with the VPCs and Transit Gateway peering forwards the traffic to the Inspection VPC.
-
The Inspection VPC route table forwards all the traffic to the firewall endpoint. The allowed traffic is forwarded back to the Transit Gateway.
-
The Transit Gateway route table associated with the Inspection VPC attachment has all the routes within the network.
-
In this particular example, the traffic is destined to Spoke VPC B.
-
In Spoke VPC B, the TGW subnet route table routes the traffic to the destination instance.
The following steps describe the return traffic flow:
-
Traffic from an instance in Spoke VPC B to Spoke VPC A first reaches the Transit Gateway endpoint in the TGW subnet. The traffic is routed to the Transit Gateway.
-
The Transit Gateway route table sends the traffic to the Inspection VPC, where it is routed to the firewall endpoint for inspection.
-
Allowed traffic comes back to the Transit Gateway. The route table associated with the Inspection VPC forwards the traffic to Spoke VPC A.
Note
It is recommended to use Transit Gateway appliance mode in the Inspection VPC Transit Gateway attachment to maintain flow symmetry.
For more information about deployment models with AWS Network Firewall and AWS Transit Gateway, see Deployment Models for AWS Network Firewall
Further reading
For additional information, see the following resources:
Diagram history
To be notified about updates to this reference architecture diagram, subscribe to the RSS feed.
| Change | Description | Date |
|---|---|---|
Reference architecture diagram first published. | March 16, 2022 | |
Reference architecture diagram first published. | March 16, 2022 | |
Initial publication | Reference architecture diagram first published. | March 16, 2022 |
Reference architecture diagram first published. | March 16, 2022 | |
Reference architecture diagram first published. | March 16, 2022 | |
Reference architecture diagram first published. | March 16, 2022 |
Note
To subscribe to RSS updates, you must have an RSS plugin enabled for the browser you are using.
