Intra-VPC Inspection with AWS Network Firewall
Publication date: March 16, 2022 (Diagram history)
This architecture shows how to use the Amazon VPC routing enhancement to inspect intra-VPC traffic (between subnets of the same Amazon VPC) using AWS Network Firewall. With Amazon VPC routing enhancement, any traffic between private subnets in the Amazon VPC can be first sent to the firewall endpoint to inspect the traffic.
Intra-VPC inspection with Network Firewall architecture
The following numbered items describe the key components in this architecture:
-
Ingress traffic is routed directly to a public workload: web servers or a load balancer.
-
Traffic between the public subnet and the application servers is inspected. It is recommended that you place the firewall endpoint in its own subnet ("Firewall subnet").
-
When the inspection is done, allowed traffic is routed to the application servers.
-
With Amazon VPC routing enhancement, any traffic between private subnets in the Amazon VPC can be first sent to the firewall endpoint to inspect the traffic.
-
You can add a more specific classless inter-domain routing (CIDR) block than the default block in the routing tables to select which intra-VPC traffic is inspected.
-
Outbound traffic to the internet from the application servers: the packets are first sent to the firewall endpoint, and the allowed traffic goes to the load balancer, web servers, or NAT gateway before being sent to the internet.
For more information about Multi-AZ options or connectivity options using AWS Transit Gateway, see Deployment models for AWS Network Firewall with VPC routing enhancements
Further reading
For additional information, see the following resources:
Diagram history
To be notified about updates to this reference architecture diagram, subscribe to the RSS feed.
| Change | Description | Date |
|---|---|---|
Reference architecture diagram first published. | March 16, 2022 | |
Initial publication | Reference architecture diagram first published. | March 16, 2022 |
Reference architecture diagram first published. | March 16, 2022 | |
Reference architecture diagram first published. | March 16, 2022 | |
Reference architecture diagram first published. | March 16, 2022 | |
Reference architecture diagram first published. | March 16, 2022 |
Note
To subscribe to RSS updates, you must have an RSS plugin enabled for the browser you are using.
