Firewall Deployment in AWS Network Security in the

Firewall Deployment in AWS Network Security in the Cloud Nick Matthews AWS Partner Solutions Architect November 2017 © 2015, Amazon Web Services, Inc. or its Affiliates. All rights reserved.

The Cloud is Happening The operators, applications, and the platform have changed

ABC’s of AWS Networking Availability Zone (AZ) = Datacenter (often more than 1) Region = Collection of Availability Zones Instance = Virtual Machine Virtual Private Cloud = Isolated network in a Region Elastic IP = Public IP for an instance Virtual Private Gateway = Logical device for VPN and WAN Direct Connect = Cross-connect WAN into a VPC Subnet = Subnet, local to an AZ

Security Groups “A security group acts as a virtual firewall that controls the traffic for one or more instances. ” • • Stateful – TCP, UDP, ICMP 250 rules per instance No additional cost Denies are logged to VPC Flow Logs Integration with other AWS services Can reference other security groups, similar to object/server groups Reference other security groups across VPC Peering White-list only

VPC security controls VPC 10. 1. 0. 0/16 • Network ACL per Subnet • Route Table per Subnet • Security Groups per instance Route Table Internet Gateway Virtual Router Route Table Virtual Private Gateway

Use Cases for Firewalls Beyond Security Groups • • Next-Gen Firewall (NGFW) and Application Inspection Intrusion Prevention/Detection (IPS/IDS) Auditing, Analytics, Compliance and Reporting • Comments for individual rules Central Management • Troubleshooting • Single pane of glass including on-premises Above 250 rules per instance IP Reputation or Geo Blocking Additional security features • Deep Packet Inspection, Web Application Firewall, URL Filtering

What does this mean? • Requirements of different environments may use different architectures • • • Firewalls may be easier to begin migrations • • Pay hourly Migrate applications to security groups as comfort increases May have a steady stream of on-premises applications migrating in Firewalls add a level of complexity • • • Web applications are more likely to use Security Groups, host-based firewalls, or a WAF Business applications are more likely to use Firewalls High Availability management Friction to application provisioning Intrusion Prevention/Detection and Deep Packet Inspection are common requirements • Sending all traffic back on-premises and host-based security don’t cover all use cases

Auto Scaling in AWS The Elastic Load Balancer is a Fully Qualified Domain Name (FQDN) that scales up with load Elastic Load Balancer (ELB) The Auto Scale Group launches or terminates instances based on defined metrics such as CPU load Limit the ports, protocols, and appropriate sources and destinations with security groups Auto-Scaling Web Instances

“Anti-Patterns” for Firewalls - Before Subnets and clustering are limited to a single Availability Zone Firewalls don’t auto-scale to meet demand, becoming a bottleneck Firewall Pair Virtual IP Addresses (VIPs) operate differently in AWS, so the firewall must support a version of high availability using VPC API calls Elastic Load Balancing Outbound routing from the instances is statically set to a single firewall Firewalls may not support a DNS name with NAT or in security policies, sending all traffic to a single IP address of the ELB Route Table Auto-Scaling Web Instances

Security Competency - Infrastructure Reviewed by the AWS Partner team • High quality Documentation • Auto-scaling • ELB Integration • Multi-AZ High Availability • Security best practices http: //aws. amazon. com/security/partner-solutions/

Firewall Design Patterns - Now Firewalls are distributed in multiple Availability Zones Firewalls auto-scale to meet demand Auto-Scaling Firewalls Health checks from the Elastic Load Balancer ensures only healthy firewalls are in the DNS records Elastic Load Balancing Outbound routing from the instances is set to the Virtual Private Gateway, which is highly available Firewalls poll the internal ELB DNS and make security policy and NAT decisions on the Fully Qualified Domain Name (FQDN) Route Table Auto-Scaling Web Instances

Deployment Architectures

Network Security Architectures on AWS Agent-Based Security Interface Shifting Route Shifting Services VPC AZ Mesh Web Auto-Scaling

Design Considerations Direction of Traffic East-West Security Policy Availability Requirements Bandwidth VPC Scale Application and Protocols

Firewall Deployment Designs

Lollipop Design • Send all traffic back on-premises • Use VPN or Direct Connect to connect on-premises • Use existing security stack for Internet traffic • Maintains dependency and increases requirements of existing hardware

Lollipop Design – Public AWS Services • Not all services are accessible through a VPC • Traffic hairpins through the internet • Example of services available in a VPC: • • Amazon S 3 AWS Lambda Amazon RDS Amazon Dynamo. DB • Private Link: • Kinesis, EC 2, ELB, SSM

Host Based Security • Host Intrusion Detection Systems (HIDS) • Agent-based solution scales as instances scale • Agent can be monitoring and controlled centrally • Access to unencrypted data and process and user context

‘Services VPC’ or ‘Transit VPC’ • Use for centralized control and transitive routing between VPCs • • Close to a DMZ design Hub and spoke network uses VPN • • Reduces operational and software licensing costs Can be used between VPCs, accounts, and regions Reduces changes needed on spoke VPCs Scales to ~10 VPCs without overlapping addresses using the default tunnel addresses • Use your own tunnel addresses for higher scale

Auto Scaling Firewalls – the ‘ELB Sandwich’ • • Use stickiness for HTTP/S applications Use NLB for long-lived TCP connections Firewalls or WAF Requires: • • • ELB support Auto-scaling automation Flexible licensing Security Competency products have support Use X-Forwarded headers or Proxy Protocol for source visibility • NLB provides source IP natively

Single VPC Designs

Elastic Network Interface (ENI) Shifting • AWS equivalent to Virtual IP • HSRP, VRRP • Move the ENI within a single Availability Zone • IP address stays the same • Works for inbound and outbound traffic • Health check on-instance or off -instance • Clustering may be available

Route Shift • Outbound connectivity • Move the route across multiple Availability Zones • Health check on-instance or off-instance • Equivalent to changing the route table association for a subnet

Case Studies

Customer #1 • Operate 10 VPCs • • Using VPC to segment applications of different security levels Different organizations and acquisitions will be placed in different VPCs • Traffic will be an application mix from on-premises migration • Requirement for IPS and stateful packet inspection between security zones • Need to reduce cost on licensing and operational overhead • Traffic between on-premises and AWS is trusted but requires private link with predictable performance, at least 1 Gbps total

Customer #1 – Services VPC • Security Groups within the VPC for security • Default route points towards VPN • On-premises (RFC 1918) routes towards Direct Connect • Traffic to the internet or other applications goes through firewall

Customer #2 • Requires encryption over AWS Direct Connect • Requires IPS on all traffic to and from the datacenter • AWS considered an ‘untrusted datacenter’ • Requires high availability in case AWS Direct Connect is down • Direct Internet access for patches, AWS API access, and ability to whitelist access to URLs • Expect 2 Gbps to a single VPC

Encrypted Direct Connect and Outbound Proxy Instances have proxies set for outbound HTTP traffic Routes to on-premises split between firewalls with VPN connections • Scale firewalls and routes out to handle load • Most firewalls handle approximately 1. 5 Gbps • Use ENI shifting for additional high availability

Customer #3 • Customer requires encryption in transit for all traffic leaving an AWS building (Availability Zone) • Requires IPS between accounts and VPC’s • 4 VPC’s • 3 stage development – Development, Staging, Production • 1 DMZ choke point to the internet and on-premises • Utilizing 2 Availability Zones in each VPC

Customer #3 Full Availability Zone Mesh • Firewall in each Availability Zone • DMZ VPC with WAN and Internet access • Using firewall vendor’s centralized management solution for VPN management • Relies on application-level failover • Encryption everywhere

Metadata – AWS Cloud. Trail, VPC Flow Logs

Metadata and Event Driven Security Use cases • Customized security • Complement existing control Advantages • Scalable • Dynamic VPC Flow Logs AWS Lambda Design Caveats • Requires security maturity • Based on quality of metadata

Q&A Thank you!