Securing AWS inter-subnet traffic using Check Point Cloud Guard

[vt100]

For those of us in the trenches responsible for securing cloud payloads, this may come handy. Apparently, AWS does not natively support inspection of the in-VPC traffic.

This solution circumvents the limitation and allows you to control and inspect traffic within VPC between multiple private and public subnets:

https://community.checkpoint.com/docs/DOC-2639-inspection-of-inter-subnet-traffic-in-aws-vpc

[denbesten]

Fortinet, Palo Alto and Cisco ASA also have solutions in the AWS marketplace to protect inter-subnet traffic within AWS.   Coupled with Checkpoint, these are the Gartner  "Enterprise Network Firewall" magic quadrant leaders, visionaries and challengers  - everyone else is a "niche player".  

AWS's closest native capability is Security Groups.  They inspect transparently "just outside" the network interface on each server, rather than the more traditional inline default-gateway. They are an adequate stateful inspection packet firewall, but they can not do advanced analytics, such as malware detection or SQL injection defenses.

This may or may not be adequate depending on your use case.  Simple is enough in many cases, such as blocking unneeded IP ports.

[vt100]

I am talking about inspection and control of traffic between subnets inside single VPC.

As AWS using common router per-VPC, by default, traffic from all subnets inside are forwarding traffic to it.

Thus, to achieve proper inspection between tiers, multi-VPC architecture is required.

In contrast, Azure allows routing of the traffic inside Availability Set.

This distinction has, in some instances, swayed the choice of the cloud provider for organizations trying to migrate payloads and looking at complexities caused by AWS prohibiting trans-VPC traffic.

That was the reason to figure out how to achieve intra-VPC, inter-subnet inspection and access control.

Since I am versed in Check Point, I've picked that vendor's offering for POC, but there is no reason same could not be achieved with PAN or Fortinet.