stackArmor Security MicroSummit How to select a Next Generation Firewall by Palo Alto Networks: Ed Caswell from Palo Alto Networks will talk about how to select and deploy a next generation firewall. He will cover the topics described below. Understand key threats and use cases for NGFW : Understand the threat vectors and use cases that are driving NGFW adoption. Key features and benefits of NGFW : Understand key capabilities and the protections that are delivered for cloud hosting environments. NGFW Best Practices : Common deployment models and cloud-architecture best practices for security focused organizations leveraging cloud platforms such as AWS.

1. Ed Caswell
Consulting Engineer
Palo Alto Networks
Securing the Public Cloud
AWS Deployment Scenarios

2. in

3. ELB Interoperability

4. 4 | ©2014, Palo Alto Networks. Confidential and Proprietary.
Region 1
Web farm Web farm
Internal
ELB
AZ1 AZ2
External ELB

5. CloudFormation Template: Automates full
use case deployments
S3: AWS service where bootstrapping files
are stored
CloudWatch: Consumes metrics and makes
intelligent scale in/out decisions
Lambda: Code as a service pushes custom
metrics to CloudWatch via XML API
Auto Scale Groups (ASG): The firewalls are
members of an ASG that scales in/out based
on custom metrics
PAN-OS Bootstrapping: Automates
creation of fully configured firewall
PAN-OS API: enables delivery of custom
metric to CloudWacth
Panorama: Optional but highly
recommended to simplify VM-Series
management
Native AWS and PAN-OS/VM-Series Services Used
5 | © 2015, Palo Alto Networks. Confidential and Proprietary.
AWS Services PAN-OS/VM-Series Services

6. Region 1
AZ1
External ELB
AZ2
Internal ELB
Web ASG
1
CFT deploys
base topology
ASG1
2 Initial firewalls are
bootstrapped from S3
ASG2
Bootstrapping adds
VM-Series firewalls to
Panorama
Auto Scaling the VM-Series on AWS
6 | © 2016, Palo Alto Networks. Confidential and Proprietary.

7. Region 1
AZ1
External ELB
AZ2
Internal ELB
Web ASG
ASG1
3
Standard metrics
sent to CloudWatch
4
Alarm triggers
ASG scale out
ASG2
Auto Scaling the VM-Series on AWS
7 | © 2016, Palo Alto Networks. Confidential and Proprietary.

8. Region 1
AZ1
External ELB
AZ2
Internal ELB
Web ASG
ASG1
5 l function collects
PAN-OS metrics via API
Custom metrics
sent to
CloudWatch
6
7
Alarm triggers FW
ASG scale events
ASG2
Bootstrapping
continues to add
FWs to Panorama
l Function
removes FWs
from Panorama
Auto Scaling the VM-Series on AWS
8 | © 2016, Palo Alto Networks. Confidential and Proprietary.

9. Region 1
AZ1
IELB VIP 1 IELB VIP 2
AZ2
Web ASG
ASG1 ASG2
8
l function monitors
for ELB VIP changes IELB VIP 3
9 l function deploys new
ASG with NAT rule for new VIP
ASG3
IELB VIP 4
ASG4
External ELB
Internal ELB
Auto Scaling the VM-Series on AWS
9 | © 2016, Palo Alto Networks. Confidential and Proprietary.

10. InterVPC

11. Securing one VPC
IPSec VPN
DC-FW1
DC-FW2
AZ1b
Web1-01
Web1-02

12. AZ1c
Securing one VPC
AZ1b
IPSec VPN
DC-FW1
DC-FW2
Web1-01
Web1-02
Web2-01
Web2-02
IPSec VPNs

13. Securing lots of VPCs
DC-FW1
DC-FW2
Marketing App
HR App
QA Environment
Dev Environment

14. Region
Services VPC
Subnet 1
Availability Zone 2
Availability Zone 1
Subnet 2
Region
Subscribing VPC
Subnet 1
Availability Zone 2
Availability Zone 1
Subnet 2

15. Region
Services VPC
Subnet 1
Availability Zone 2
Availability Zone 1
Subnet 2

16. DC-FW1
DC-FW2
Services VPC + Hybrid + Internet Gateway

17. DC-FW1
DC-FW2
Routing
Default route learned via DHCP from IGW on E1/1
Static route defined for enterprise network
Redistribution profile shares static routes with BGP peers
BGP routes propagated into local route table
SNAT on gateway firewall ensure symmetric return

18. DC-FW1
DC-FW2
More scale

19. DC-FW1
DC-FW2
LOTS more scale
Direct Connect
Location
Service Provider Links