Limitations of Existing Firewalls and AWS NAT Gateways There are legitimate reasons why AWS VPCs or Azure VNets need Internet access; for example, to receive software updates from vendors or integrate with native AWS services or third-party SaaS services. But this is substantially different from an on-premises use case, where traditional, full-featured firewalls are needed to filter co-mingled end-user traffic and application traffic. And while AWS provides a NAT gateway, it can be configured only on a per-VPC basis against a limited number of IP addresses.

1. Security Requirements and
Tradeoffs for Controlling VPC-
to-Internet Egress Traffic
AWS Bootcamp #7 – July 20, 2018
Sherry Wei, Founder & CTO
Neel Kamal, Head of Field Operations
Frank Cabri, VP Product Marketing

2. © 2017 AVIATRIX SYSTEMS, INC. | 2© 2017 AVIATRIX SYSTEMS, INC. | 2
• Introductions
• VPC Egress Traffic: A Quick Backgrounder
• What Are the Security Requirements for
Egress Traffic?
• Demo
• Q and A
Welcome & Agenda
SHERRY WEI
Founder & CTO
NEEL KAMAL
Head of Field Operations
FEATURED SPEAKERS

3. © 2017 AVIATRIX SYSTEMS, INC. | 3© 2017 AVIATRIX SYSTEMS, INC. | 3
Check Out More Bootcamps – Available On-Demand
www.aviatrix.com/bootcamps

4. © 2017 AVIATRIX SYSTEMS, INC. | 4© 2017 AVIATRIX SYSTEMS, INC. | 4
Why it Matters? AWS Security is a Shared Responsibility

5. © 2017 AVIATRIX SYSTEMS, INC. | 5© 2017 AVIATRIX SYSTEMS, INC. | 5
• On Premise-to-VPC
• VPC-to-VPC
• Remote User-to-VPC
• Internet-to-VPC (Ingress)
• VPC-to-Internet (Egress)
Planning Network Security for Your AWS Environment

6. © 2017 AVIATRIX SYSTEMS, INC. | 6© 2017 AVIATRIX SYSTEMS, INC. | 6
Why Does it Matter?
• Apps in VPCs need Internet access for API calls, AWS services & other
external resources
• Access to unapproved Internet sites or services creates vulnerabilities
• Hair-pinning traffic thru corporate edge firewall impacts app performance
• Many regulations (e.g., PCI) require controls over outbound Internet traffic
What Does AWS Provide Natively?
• NAT gateway service (no policies)
• Relies on individual EC2 security policies
• NAT instance
• IP Address Based Policies
• Limited number of rules allowed
VPC Egress Traffic: A Backgrounder

7. © 2017 AVIATRIX SYSTEMS, INC. | 7© 2017 AVIATRIX SYSTEMS, INC. | 7
What Are the Common Architectures for Egress Control?
Use NAT Service
Limited Capabilities
VPC 1 VPC 2 VPC 3
In-Line Execution
Full Functionality
VPC 1 VPC 2 VPC 3VPC 1
Centralized Execution
Full Functionality
VPC 2 VPC 3
Security
Service VPC

8. © 2017 AVIATRIX SYSTEMS, INC. | 8© 2017 AVIATRIX SYSTEMS, INC. | 8
Considerations for VPC Egress Security
3. Managing Costs 2. Security Policy Controls
1. Discovery

9. © 2017 AVIATRIX SYSTEMS, INC. | 9© 2017 AVIATRIX SYSTEMS, INC. | 9
Why Does It Matter?
• You may not know what Internet sites your Apps are communicating with
• Obtaining visibility before applying policy is a good practice
• Demonstrating compliance thru reporting
What Does AWS Provide Natively?
• AWS natively doesn’t provide egress traffic at the domain name level
What’s Missing?
• An easy way to view egress traffic at the domain name level
1. Discovery

10. © 2017 AVIATRIX SYSTEMS, INC. | 10© 2017 AVIATRIX SYSTEMS, INC. | 10
What is Unique about Egress Security in Cloud?
- On prem firewall is dealing with both workloads and user traffic
- Apps in VPCs are more predictable vs humans
- You are dealing with a finite list of egress sites vs the entire Internet
- You may not need deep packet inspection for workloads in the cloud
Why Can’t I Filter using IP Addresses?
• Most domain names consist of many IP addresses
• Domain name doesn’t change; associated IP addresses will change
Other Considerations
- If running VDI workloads, you may need full firewall capabilities
• Out of the box integration with your logging tools
• Performance bottlenecks depending on architecture
2. Security Policy Controls

11. © 2017 AVIATRIX SYSTEMS, INC. | 11© 2017 AVIATRIX SYSTEMS, INC. | 11
What are the Costs?
• AWS Instance Charges
• Traditional firewall requires larger instance (M4 or C4)
• AWS Data Charges
• Centralized architecture has 2X data charge
• Software (license) charges
• Traditional firewall an overkill for what you need; hence higher cost
• Operational Costs
• VPC to data center ratio is 100:1 – Requires centralized management
3. Managing Costs

12. © 2017 AVIATRIX SYSTEMS, INC. | 12© 2017 AVIATRIX SYSTEMS, INC. | 12
Aviatrix Solution
….VPC 1 VPC 2 VPC 3 VPC 4
Centralized
Controller
GW GW GW GWGW
(Aviatrix Transit Network)
Egress Security
Architecture
VPC 100

13. © 2017 AVIATRIX SYSTEMS, INC. | 13© 2017 AVIATRIX SYSTEMS, INC. | 13
Aviatrix Solution
….VPC 1 VPC 2 VPC 3 VPC 4
VGW
Transit VPC
Hub
Direct Connect / Internet
Centralized
Controller
GW GW GW GW
GW
GW
(Aviatrix Transit Network)
BGP
Corporate
Datacenter
Corporate
Datacenter
Transit
Architecture
Egress Security
Architecture
VPC 100

14. © 2017 AVIATRIX SYSTEMS, INC. | 14© 2017 AVIATRIX SYSTEMS, INC. | 14
• You’ll receive email w/ a
link to a replay and slides
• Take 10 minutes and start
a free 14-day trial ….
https://www.aviatrix.com/trial
• To view other bootcamps:
https://www.aviatrix.com/bootcamps
Next Steps with Aviatrix