> ## Documentation Index
> Fetch the complete documentation index at: https://docs.aviatrix.com/llms.txt
> Use this file to discover all available pages before exploring further.

# FireNet Ingress Traffic Inspection

> If the FireNet deployment is for both Egress and Ingress traffic, you need to SNAT on the firewall instance to its LAN or Trusted Interface IP (eth2 interface).

<Note>
  If the FireNet deployment is for both Egress and Ingress traffic, you need to
  SNAT on the firewall instance to its LAN or Trusted Interface IP (eth2
  interface). The rule is that for a source IP address that comes from NLB or a
  vendor load balancer such as an F5 private IP address, it is translated to a
  firewall interface eth2 private IP address.
</Note>

## Ingress Traffic Inspection

Follow the <a href={"/docs/enterprise/" + "10.1" +
"/guides/security/firenet/ingress-firewall-example"}>Ingress firewall
instructions</a> to deploy the solution for Ingress traffic inspection.

<img src="https://mintcdn.com/aviatrix-14b37c43/vKpoXYmi49a-T1vW/images/concepts-architectures/architecture/security/ingress-firewall-network-design.png?fit=max&auto=format&n=vKpoXYmi49a-T1vW&q=85&s=f15f6a3d4dbf9e9fca744e36e77df672" alt="ingress_firewall" width="1434" height="788" data-path="images/concepts-architectures/architecture/security/ingress-firewall-network-design.png" />

## Ingress Directly through Firewall

Another often configured Ingress Egress design pattern is to have the traffic
forward to firewall instances directly as shown in the diagram below. In this
design pattern, each firewall instance must configure SNAT on its LAN interface
that connects to the Aviatrix FireNet gateway.

<img src="https://mintcdn.com/aviatrix-14b37c43/vKpoXYmi49a-T1vW/images/concepts-architectures/architecture/security/firenet-ingress-egress-design.png?fit=max&auto=format&n=vKpoXYmi49a-T1vW&q=85&s=5bb27ee5fbe2e2240f10a055f33251b1" alt="firenet_ingress_egress" width="808" height="739" data-path="images/concepts-architectures/architecture/security/firenet-ingress-egress-design.png" />

The drawback of this design is that the source IP address is not preserved when
traffic reaches the application. If you need to preserve source IP address,
refer to <a href={"/docs/enterprise/" + "10.1" +
"/guides/security/firenet/ingress-firewall-example"}>this recommended design for
Ingress</a>.

For more information, follow the <a href={"/docs/enterprise/" + "10.1" +
"/guides/security/firenet/transit-firenet-workflow-aws"}>FireNet workflow</a>.

## Ingress Protection via Aviatrix Transit FireNet

This Ingress Protection design pattern is to have the traffic forward to
firewall instances directly in Aviatrix Transit FireNet VPC/VNet as shown in the
diagram below. In this design pattern, each firewall instance must configure (1)
SNAT on its LAN interface that connects to the Aviatrix FireNet Gateway and (2)
DNAT to the IP of application server/load balancer. The drawback of this design
is that the source IP address is not preserved when traffic reaches the
application.

<img src="https://mintcdn.com/aviatrix-14b37c43/vKpoXYmi49a-T1vW/images/concepts-architectures/architecture/security/ingress-transit-firenet-topology.png?fit=max&auto=format&n=vKpoXYmi49a-T1vW&q=85&s=d968c29a84716cbe1e3a8b96484feb0a" alt="500" width="940" height="767" data-path="images/concepts-architectures/architecture/security/ingress-transit-firenet-topology.png" />

For an example configuration workflow, see
[Ingress Protection via Aviatrix Transit FireNet with FortiGate](https://legacy.docs.aviatrix.com/documentation/latest/security/fortigate-ingress-protection-firenet.html).

<a href={"/docs/enterprise/" + "10.1" + "/guides/security/firenet/azure-ingress-firewall-example"}>Azure Ingress Firewall Setup Solution</a>

<a href={"/docs/enterprise/" + "10.1" + "/guides/security/firenet/paloalto-ingress-gcp"}>Ingress Protection via Aviatrix Transit FireNet with Palo Alto in GCP</a>