> ## Documentation Index
> Fetch the complete documentation index at: https://docs.aviatrix.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Aviatrix FireNet / AWS Transit Gateway Native Deployment Comparison

> There are two native deployments: TGW VPN to connect to firewall or TGW VPC attachment to connect to firewall.

There are two native deployments: TGW VPN to connect to firewall or TGW VPC
attachment to connect to firewall.

The three different deployment models are illustrated in the diagram below.

<img src="https://mintcdn.com/aviatrix-14b37c43/-mwrdwN2SbwuEu52/images/reference/security/firenet/firewall-deploy.png?fit=max&auto=format&n=-mwrdwN2SbwuEu52&q=85&s=7951c0b37758b8db026455f721f1aba2" alt="Diagram comparing three firewall deployment models" width="2178" height="1290" data-path="images/reference/security/firenet/firewall-deploy.png" />

If an AWS Transit Gateway connects to a firewall by using its built in VPN
function, it must run IPsec and BGP. If you run more than one firewall instance
using ECMP, each firewall instance must configure SNAT function to ensure that
both source and destination-initiated traffic lands on the same firewall
instance. Furthermore, since native deployment requires an IPsec VPN which
limits its performance to 1Gbps, in this scenario a single firewall instance can
only perform at 500Mbps since the VPN function is traversed twice.

A more detailed functional comparison is described in the table below.

| **Firewall Deployment Functions**       | **Firewall in VPN deployment \*** | **Firewall in VPC/VNet attachment \*** | **Firewall in Aviatrix FireNet** |
| --------------------------------------- | --------------------------------- | -------------------------------------- | -------------------------------- |
| On-prem to VPC/VNet traffic inspection  | Yes                               | Yes                                    | Yes                              |
| VPC/VNet to VPC/VNet traffic inspection | Yes (requires SNAT)               | Yes                                    | Yes                              |
| Egress traffic inspection               | Yes                               | Yes                                    | Yes                              |
| Per firewall performance                | 500Mbps                           | Up to 6Gbps                            | Up to 6Gbps                      |
| Total FireNet performance               | > 500Mbps                         | Up to 6Gbps                            | up to 75Gbps                     |
| Multiple firewalls (scale out)          | Yes                               | No (Active/Standby)                    | Yes                              |
| Integrated solution                     | Yes                               | No (requires external script)          | Yes                              |
| Solution complexity                     | High                              | Medium                                 | Low                              |
| Centrally managed                       | Yes                               | No (requires external script)          | Yes                              |
| Multi-vendor support                    | Yes                               | Yes                                    | Yes                              |

\* Native AWS Transit Gateway deployment.

## Related Topics

* <a href={"/docs/enterprise/" + "10.1" + "/reference/security/firenet/firewall-interfaces"}>Firewall Interface Specifications</a>
* <a href={"/docs/enterprise/" + "10.1" + "/guides/security/firenet/firewall-subscribe-aws"}>Subscribing to a Firewall Instance (AWS)</a>