fbpx

I’ve recently been working with a client on magically spinning up entire environments in AWS. This means I’ve learned a fair bit about AWS on the way!

Without going into too much detail (as it’s the clients work), we have been bootstrapping Palo Alto firewalls. This allows you to be able to stand up a fully configured Palo Alto firewall using a CloudFormation script in AWS, in a matter of minutes. That’s pretty cool.

Palo Alto are pretty helpful with this – they provide a decent sample here: https://github.com/PaloAltoNetworks/aws

From this, you can amend the scripts as appropriate to fit into your own environment – this method does rely on having a full configuration for the firewall available to bootstrap from available on an S3 bucket. If this is static, then easy. If not, you’ll have to do some magic elsewhere before calling the CloudFormation script to make sure the config you need is in the bucket.

One of the challenges we faced was that there is an interface limit (depending on which EC2 instance type you choose). This means that the example from Palo Alto does not scale too well – if you have too many subnets, it becomes impossible to put a Palo interface in every subnet. To get around this, you can add routes in the routing tables pointing to the ENI’s (Elastic Network Interfaces) of the Palo. This means you can have multiple subnets behind one interface.

We know technology can be a bother, and that’s why we are here to help with all your IT needs, no matter how big or small.

Our goal is to make sure that your business has a reliable infrastructure in place so you can focus on what matters most – running your company! 

So if you need any help at all, book a 15 minute discovery call with one of our experts today. We’ll be happy to lend a hand! 

Select Service

Discovery Call 15 minutes
Free

Select time

Select a service and date to see available times.

Tell us who we are meeting

Can we have a heads up on roughly what you want to talk about please?

Initial consult

Duration: 1 hour
Not sure what you need? Grab 60 minutes with us and we will work with you to understand your goals, and to develop a proposal and price estimate.

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.

Design

NAT: Demystified

What is NAT? NAT stands for Network Address Translation. It’s a method used for changing addresses in transit. Before we get too far into that,

Read More »