"Hosted by PolarSeven Cloud Consulting - http://polarseven.com Our monthly AWS User Group Sydney presentation night. http://www.meetup.com/AWS-Sydney/ Introductions and What's New In AWS - by PolarSeven" Session 2: Sophos https://www.sophos.com/en-us.aspx How to overcome the challenges of routing, scalbility and automation of DevOps while ensuring security of your VPC. Watch the video presentation here https://youtu.be/oFwuDjR3Wg0 See Session 1 and download the slides from here https://youtu.be/CJj5jbqmQ_o https://www.slideshare.net/secret/bfjfGxqDVgrHWt

1. Break & Networking
• Refresh your drink
• Grab some pizza
• Make new contacts
• Connect with our Sponsors
• Talk to the PolarSeven
Team & our AWS warrior -
Binqi

2. Session 2:
Peter Gordon - Senior Cloud Security Architect
APAC – Sophos
"Securing Traffic Leaving A VPC"

3. Securing traffic leaving a
(peered) VPC
Peter Gordon
Security Architect APAC, Public Cloud

4. Sophos and AWS
• Sophos UTM has been on the AWS Marketplace since 2011
• Three deployment models
• AWS Advanced Technology Security Competency Partner

5. Needs
• EC2 instances, or AWS Workspaces desktops, requiring secure,
filtered Internet connecFvity from a local VPC or peered VPC
• Egress traffic loads vary substanFally through the course of a day
o Don’t want to over provision firewall infrastructure ($$$)
o Don’t want boAlenecks and/or firewalls falling over under load
• Flexibility in allowing some subnets out, but not others

6. Challenges
• RouFng, rouFng, rouFng
• TransiFve rouFng restricFons (yes more rouFng)
• Scalability and resilience of Firewall/Proxy deployment
• AutomaFon and supporFng DevOps

7. TransiEve Peering
• No rouFng from VPC B through VPC A to the Internet
L

8. So…
… if you have instances (or perhaps Workspaces desktops) in a
peered VPC…
how do you route traffic to the internet AND have it
subject to firewall policies and web filtering?
How do you ensure the firewall infrastructure can handle
variaFons in outbound traffic?

9. Addressing resilience and scalability
What happens if:
o Outbound traffic (generated by EC2 instances) increases significantly?
o Firewalls/Proxies become boZleneck, or worse…
Auto-scaling, self-healing architecture will support resilience

10. OpEons
• Route to an ELB? Is it even possible?
• Deploy mulFple firewalls/proxies to
ensure availability? Yes, but
o How to do so efficiently, and in a cost
effecEve manner?
o Seamless failover and scaling?
o Easily load balance traffic across them?
Internal ELB? See above.

11. • Wanna go to the Internet huh?
• Can you route to an ELB??
Internal ELBs poinEng to Firewall pair??
Firewall Firewall
Instances

12. Internal ELBs poinEng to Firewall pair??
Firewall Firewall
Instances
• Wanna go to the internet huh?
• Can you route to an ELB??
• Explicit proxy se_ng to ELB?

13. Route to an Internal ELB? Well, no

14. Other opEons
• Use an explicit proxy in peered VPC instances’ se_ngs?
Yes, but
o HA and Failover? Maybe
o Scalability?
o Can you be bothered?
• Or… Use a local (within the peered VPC) rouFng point that
o Has a tunnel to the firewalls via the Peering ConnecFon
o Offers failover, availability, and scalability
o Supports a transparent proxy

15. GRE Tunnels
RouEng instance (Outbound Gateway)
Firewalls
Tunnelling over a peering connecEon using GRE

16. GRE Tunnels
RouEng instance
Firewalls
RouEng instance
RouEng within the main VPC
RouEng instance

17. • Route to the Internet?
• High availability?
• Failover?
• Transparent?
• But what about scalability?
Route to the Outbound Gateway instance
UTM UTM
VPC Private Subnet VPC Private Subnet

18. Route to the Outbound Gateway instance
• Route to the Internet?
• High availability?
• Failover?
• Transparent?
• But what about scalability?
UTM UTM
VPC Private Subnet VPC Private Subnet

19. Adding in scalability & automaEon…
• Auto-scaling?
• Self-healing?
• DevOps friendly?
UTM UTM
VPC Private Subnet VPC Private Subnet
UTMs UTMs

20. Adding in scalability & automaEon…
• Auto-scaling?
• Self-healing?
• DevOps friendly?
UTM UTM
VPC Private Subnet VPC Private Subnet
UTMs UTMs

21. Extending this across VPCs…
• Cross VPC? UTMs UTMs
VPC Private Subnet

22. Extending this across VPCs…
• Cross VPC? UTMs UTMs
VPC Private Subnet

25. Outbound Gateway / Load Balancer instance

26. Outbound Gateway / Load Balancer instance

27. Outbound Gateway / Load Balancer

28. Outbound Gateway / Load Balancer

29. Route table for subnet in peered VPC (without IGW)

30. Route table for subnet in peered VPC (without IGW)

31. Transparent Internet access from a peered instance
29

32. Transparent Internet access from a peered instance
30

34. Prize Draw Time!
6 Year Anniversary!
Win a Drone – Prize Draw

35. Thanks For Coming
Join Us Next Month – October 4th
Presenters
&
Brought to you by
>> Register @ http://www.meetup.com/AWS-Sydney/ <<