Multi-Region Inspection with AWS Network Firewall and AWS Transit Gateway
Publication date: March 16, 2022 (Diagram history)
This architecture shows how to inspect traffic in each AWS Region when using AWS Transit Gateway to centralize your inspection and inter-Region peering between two AWS Regions. Inspecting traffic in each Region is a best practice to avoid asymmetric traffic.
Multi-Region centralized inspection with Network Firewall architecture
The following numbered items describe the traffic flow in this architecture:
-
Traffic from an instance in Spoke VPC A destined to another instance in Spoke VPC B is routed to the Transit Gateway in Region A as per the Spoke VPC A route table.
-
The Transit Gateway (Region A) route table associated with the attachment (Pre-inspection route table) sends all the traffic (0.0.0.0/0) to the Inspection VPC A.
-
The Inspection VPC A TGW subnet route table sends all the traffic to the firewall endpoint for transparent inspection.
-
The allowed traffic is forwarded back to the TGW ENI.
-
As per the Transit Gateway (Region A) route table associated with the Inspection VPC A (Post-inspection route table), the traffic is sent to Region B through the Transit Gateway peering.
-
As per the Transit Gateway (Region B) route table associated with the Transit Gateway peering (Pre-inspection route table), the traffic is sent to the Inspection VPC B for inspection.
-
The Inspection VPC B TGW subnet route table sends all the traffic to the firewall endpoint for transparent inspection.
-
The allowed traffic is forwarded back to the TGW ENI.
-
As per the Transit Gateway (Region B) route table associated with the Inspection VPC B (Post-inspection route table), the traffic is sent to Spoke VPC B.
-
Traffic is forwarded to the destination, the Amazon Elastic Compute Cloud instance in Spoke VPC B.
Note
It is recommended to use Transit Gateway appliance mode in the Inspection VPC Transit Gateway attachments to maintain flow symmetry.
Further reading
For additional information, see the following resources:
Diagram history
To be notified about updates to this reference architecture diagram, subscribe to the RSS feed.
| Change | Description | Date |
|---|---|---|
Reference architecture diagram first published. | March 16, 2022 | |
Reference architecture diagram first published. | March 16, 2022 | |
Reference architecture diagram first published. | March 16, 2022 | |
Reference architecture diagram first published. | March 16, 2022 | |
Reference architecture diagram first published. | March 16, 2022 | |
Initial publication | Reference architecture diagram first published. | March 16, 2022 |
Note
To subscribe to RSS updates, you must have an RSS plugin enabled for the browser you are using.
