Transit FireNet Workflow for AWS

Aviatrix Transit FireNet allows you to deploy firewalls functions for the Aviatrix Encrypted Transit architecture. With Transit FireNet feature, the Firewall Network (FireNet) function is integrated into the Aviatrix Transit gateway.

To learn about Transit FireNet, check out Transit FireNet FAQ.

If you are looking deploying firewall networks in AWS Transit Gateway (TGW) environment, your starting point is here..

This workflow provides you the step by step instructions to build a Aviatrix Transit Firewall Network also called Transit FireNet.

While the instructions below reference AWS, these functionalities apply to any public cloud in which Aviatrix Transit FireNet is supported.

In this example, Transit VPC with Aviatrix Gateways will be deployed, and two Spoke Gateways (DEV and PROD) will be attached to it.

The transit VPC will have a firewall of supported vendors (Checkpoint, Palo Alto Networks and Fortinet etc.) deployed in it. Please see the diagram below for more details.

Once the infra is in-place then the policy will be created to inspect the east-west and north-south traffic.

avx_tr_firenet_topology

Step 1 : Create VPCs

VPCs can be created manually on AWS or directly from Aviatrix Controller.

Aviatrix controller has set of useful tools available for users and in this example, VPCs are created following the Useful Tools Create a VPC guidelines.

  1. Login to the Aviatrix Controller with username and password
  2. Navigate to Useful Tools -> Create A VPC
  3. Add one VPC for Transit FireNet Gateway and select Aviatrix FireNet VPC option as shown below.
  4. Create two more VPCs with no option/checkbox selected for Spoke Gateways.

create_vpc

Step 2: Deploy the Transit Aviatrix Gateway

Transit Aviatrix Gateway can be deployed using the Transit Gateway Workflow

Prerequisite for AWS

Transit FireNet builds on the Aviatrix Transit Network where Aviatrix gateways are deployed in both the transit VPC and the spoke VPCs in AWS.

Make sure the deployment meets the following specifications:

  1. ActiveMesh must be enabled when launching the Aviatrix Transit Gateway.
  2. The minimum size of the Aviatrix Transit Gateway is c5.xlarge.
  3. Aviatrix Transit Network must be in Connected mode. Go to Transit Network -> Advanced Config -> Connected Transit. Click Enable.

Procedure

  1. Navigate to MULTI-CLOUD TRANSIT -> Setup -> #1 Launch an Aviatrix Transit Gateway
  2. Choose instance size C5x.large
  3. Enable ActiveMesh Mode (Mandatory)
  4. Enable InsaneMode for higher throughputs (optional)
  5. Enable Transit VPC GW HA by navigating to MULTI-CLOUD TRANSIT -> Setup -> #2 (Optional) Enable HA to an Aviatrix Transit Gateway

Note

Instance size of c5.xlarge will be required for Insane Mode Encryption for higher throughput.

Please see an example below for Transit FireNet GW:

tr_firenet_gw

Step 3: Deploy Spoke Gateways

Now that we have Aviatrix Transit Gateway, we can deploy Aviatrix Spoke Gateways in the spoke VPCs using Aviatrix Spoke Gateway Workflow.

  1. Navigate to MULTI-CLOUD TRANSIT -> Setup -> #4 Launch an Aviatrix Spoke Gateway
  2. Deploy a Spoke Gateway (GW) in each of the spoke VPCs using defaults while choose correct Account and VPC info
  3. Choose the Public Subnet
  4. Enable Spoke Gateway HA by navigating to Transit network -> Setup -> #5 (Optional) Enable/Disable HA at Spoke GW

Note

Instance size of c5.xlarge will be required for Insane Mode Encryption for higher throughput.

launch_spk_gw

Step 4: Attach Spoke Gateways to Transit Network

Transit and spoke gateways are deployed, next step is to connect them.

  1. Navigate to MULTI-CLOUD TRANSIT -> Setup -> #6a Attach Spoke Gateway to Transit Network
  2. Select one spoke at a time and attach to the Transit Gateway.

attach_spk_trgw

Note

Transit Gateway is attached to Spoke Gateways, but by default, Transit Gateway will not route traffic between Spoke Gateways.

Step 5: Enable Connected Transit

By default, spoke VPCs are in isolated mode where the Transit will not route traffic between them. To allow the Spoke VPCs to communicate with each other, we need to enable Connected Transit

  1. Navigate to MULTI-CLOUD TRANSIT -> Advanced Config, select the right Transit Gateway and enable “Connected Transit”

connected_transit

Step 6: Configure Transit Firewall Network

Transit and Spoke Gateways have now been deployed, next step is to deploy and enable the Firewall for traffic inspection.

Let’s start with enabling the firewall function and configure the FireNet policy.

  1. Navigate to MULTI-CLOUD TRANSIT -> Transit FireNet -> #1 Enable Transit FireNet on Aviatrix Transit Gateway
  2. Choose the Aviatrix Transit Gateway and Click “Enable”

en_tr_firenet

  1. Navigate to MULTI-CLOUD TRANSIT -> Transit FireNet -> #2 Manage FireNet Policy
  2. Add spokes to the Inspected box for traffic inspection

Note

By default, FireNet inspects ingress (INET to VPC) and east-west traffic (VPC to VPC) only.

tr_firenet_policy

Step 7: Subscribe Firewall Vendor in AWS Marketplace

At this point, FireNet functionality on Transit Gateway is enabled and FireNet policy is created for spokes. It is time to subscribe the firewall vendor and deploy the firewall.

  1. Navigate to Firewall Network -> Setup -> #2 Subscribe to Firewall Vendor Product in AWS Marketplace
  2. Follow the link to subscribe to Check Point, Palo Alto or Fortinet in AWS Marketplace.

Note

Please subscribe the firewall but do not launch the firewall.

subscribe_firewall

Step 8a: Launch and Associate Firewall Instance

This approach is recommended if this is the first Firewall instance to be attached to the gateway.

This step launches a Firewall instance and associates it with one of the FireNet gateways.

Important

The Firewall instance and the associated Aviatrix FireNet gateway above must be in the same AZ, and, we recommend that the Management Interface Subnet and Egress (untrust dataplane) Interface Subnet should not be in the same subnet.

7a.1 Launch and Attach

Go to Aviatrix Controller’s console and navigate to Firewall Network -> Setup -> Step 7a and provide all the required input as shown in a table and click “Launch” button.

Important

Vendor’s firewall may take some time after launch to be available.

Setting Value
VPC ID The Security VPC created in Step 1.
Gateway Name The primary FireNet gateway.
Firewall Instance Name The name that will be displayed on AWS Console.
Firewall Image The AWS AMI that you have subscribed in Step 2.
Firewall Image Version Firewall instance current supported software versions.
Firewall Instance Size Firewall instance type.
Management Interface Subnet. Select the subnet whose name contains “gateway and firewall management”
Egress Interface Subnet Select the subnet whose name contains “FW-ingress-egress”.
Username Applicable to Azure deployment only. “admin” as a username is not accepted.
Password Applicable to Azure deployment only.
Key Pair Name (Optional) The .pem file name for SSH access to the firewall instance.
Attach (Optional) By selecting this option, the firewall instance is inserted in the data path to receive packet. If this is the second firewall instance for the same gateway and you have an operational FireNet deployment, you should not select this option as the firewall is not configured yet. You can attach the firewall instance later at Firewall Network -> Advanced page.
Advanced (Optional) Click this selection to allow Palo Alto firewall bootstrap files to be specified.
IAM Role In advanced mode, create an IAM Role on the AWS account that launched the FireNet gateway. Create a policy to attach to the role. The policy is to allow access to “Bootstrap Bucket”.
Bootstrap Bucket Name In advanced mode, specify a bootstrap bucket name where the initial configuration and policy file is stored.

1. CheckPoint Specification

CheckPoint Firewall instance has 2 interfaces as described below.

CheckPoint VM instance interfaces Description Inbound Security Group Rule
eth0 (on subnet -Public-FW-ingress-egress-AZ-a) Egress or Untrusted interface Allow ALL
eth1 (on subnet -dmz-firewall) LAN or Trusted interface Allow ALL (Do not change)

Note that firewall instance eth1 is on the same subnet as FireNet gateway eth2 interface.

Important

Starting from Release 5.4, launching CheckPoint firewall instances from the Aviatrix Controller automatically initiates its onboarding process. After completing this step, user should be able to login to the CheckPoint console with username admin and password Aviatrix123#.

Note

Repeat Step 8a to launch the second firewall instance to associate with the HA FireNet gateway. Or repeat this step to launch more firewall instances to associate with the same FireNet gateway.

Follow Check Point Example to launch Check Point security gateway in AWS and for more details.

2. Palo Alto VM-Series Specifications

Palo instance has 3 interfaces as described below.

Palo Alto VM instance interfaces Description Inbound Security Group Rule
eth0 (on subnet -Public-FW-ingress-egress-AZ-a) Egress or Untrusted interface Allow ALL
eth1 (on subnet -Public-gateway-and-firewall-mgmt-AZ-a) Management interface Allow SSH, HTTPS, ICMP, TCP 3978
eth2 (on subnet -dmz-firewall) LAN or Trusted interface Allow ALL (Do not change)

Note that firewall instance eth2 is on the same subnet as FireNet gateway eth2 interface.

Important

For Panorama managed firewalls, you need to prepare Panorama first and then launch a firewall. Check out Setup Panorama. When a VM-Series instance is launched and connected with Panorama, you need to apply a one time “commit and push” from the Panorama console to sync the firewall instance and Panorama.

Tip

If VM-Series are individually managed and integrated with the Controller, you can still use Bootstrap to save initial configuration time. Export the first firewall’s configuration to bootstrap.xml, create an IAM role and Bootstrap bucket structure as indicated above, then launch additional firewalls with IAM role and the S3 bucket name to save the time of the firewall manual initial configuration.

Follow Palo Alto Network (VM Series) Example to launch VM Series firewall in AWS and for more details.

3. Fortigate Specifications

Fortigate Next Generation Firewall instance has 2 interfaces as described below.

Fortigate VM instance interfaces Description Inbound Security Group Rule
eth0 (on subnet -Public-FW-ingress-egress-AZ-a) Egress or Untrusted interface Allow ALL
eth1 (on subnet -dmz-firewall) LAN or Trusted interface Allow ALL (Do not change)

Note

Firewall instance eth1 is on the same subnet as FireNet gateway eth2 interface.

Tip

Starting from Release 5.4, Fortigate bootstrap configuration is supported.

Follow Fortigate Example to launch Fortigate in AWS and for more details.

Step 8b: Associate an Existing Firewall Instance

This step is the alternative step to Step 8a. If you already launched the firewall (Check Point, Palo Alto Network or Fortinet) instance from AWS Console, you can still associate it with the FireNet gateway.

Go to Aviatrix Controller’s console and navigate to Firewall Network -> Setup -> Step 7b and associate a firewall with right FireNet Gateway.

Step 9: Example Setup for “Allow All” Policy

After a firewall instance is launched, wait for 5 to 15 minutes for it to come up. Time varies for each firewall vendor. In addition, please follow example configuration guides as below to build a simple policy on the firewall instance for a test validation that traffic is indeed being routed to firewall instance.

Palo Alto Network (PAN)

For basic configuration, please refer to example Palo Alto Network configuration guide.

For implementation details on using Bootstrap to launch and initiate VM-Series, refer to Bootstrap Configuration Example.

FortiGate (Fortinet)

For basic configuration, please refer to example Fortinet configuration guide.

Check Point

For basic configuration, please refer to example Check Point configuration guide.

Step 10: (Optional) Vendor Firewall Integration

Vendor integration dynamically updates firewall route tables. The use case is for networks with non-RFC 1918 routes that require specific route table programming on the firewall appliance

  1. Go to Firewall Network -> Vendor Integration -> Select Firewall, fill in the details of your Firewall instance.
  2. Click Save, Show and Sync.

Step 11: Verification

There are multiple ways to verify if Transit FireNet is configured properly:

  1. Aviatrix Flightpath - Control-plane Test
  2. Ping/Traceroute Test between Spoke VPCs (East-West) - Data-plane Test

Flight Path Test for FireNet Control-Plane Verification:

Flight Path is a very powerful troubleshooting Aviatrix tool which allows users to validate the control-plane and gives visibility of end to end packet flow.

  1. Navigate to Troubleshoot-> Flight Path
  2. Provide the Source and Destination Region and VPC information
  3. Select ICMP and Private subnet, and Run the test

Note

EC2 VM instance will be required in AWS, and ICMP should be allowed in security group.

Ping/Traceroute Test for FireNet Data-Plane Verification:

Once control-plane is established and no problem found in security and routing polices. Data-plane validation needs to be verified to make sure traffic is flowing and not blocking anywhere.

There are multiple ways to check data-plane:
  1. One way to SSH to Spoke EC2 instance (e.g. DEV1-VM) and ping other Spoke EC2 to instance (e.g PROD1-VM) to make sure no traffic loss in the path.
  2. Ping/traceroute capture can also be performed from Aviatrix Controller. Go to TROUBLESHOOT -> Diagnostics and perform the test.