Distributed Deployment Model

For the distributed deployment model, we deploy AWS Network Firewall into each VPC which requires protection. Each VPC is protected individually and blast radius is reduced through VPC isolation. Each VPC does not require connectivity to any other VPC or AWS Transit Gateway. Each AWS Network Firewall can have its own firewall policy or share a policy through common rule groups (reusable collections of rules) across multiple firewalls. This allows each AWS Network Firewall to be managed independently, which reduces the possibility of misconfiguration and limits the scope of impact. Following use cases are covered:

  • Protect traffic between a workload in public subnet (e.g. EC2 Instance) and the Internet
  • Protect/Filter traffic between an AWS service (e.g. ALB, NLB) in a public subnet and the Internet

As shown in the Figure 1: Distributed Architecture, AWS Network Firewall is deployed in a dedicated Firewall subnet which has access to Internet Gateway (IGW). Returning traffic from IGW is returned back to Firewall Elastic Network Interface (ENI) using Ingress Routing table attached to the IGW. This ensures the traffic is symmetric for full inspection. NAT Gateway deployed in dedicated public subnet allows instances in private subnet to communicated with resources on the Internet.

Distributed Architecture

Figure 1: Distributed Architecture

Click next to deploy resources using AWS CloudFormation.

To learn more about how you can deploy AWS Network Firewall for various use cases - Click here.