Network inspection design patterns that scale
summary
Shows how AWS Network Firewall plus Gateway Load Balancer, Transit Gateway/Cloud WAN, Route 53 Resolver DNS Firewall and Firewall Manager combine into concrete patterns: a distributed egress pattern for per‑VPC scale, or a centralized model for control; use appliance mode (AZ affinity) to avoid asymmetric routing; prefer more‑specific routing to preserve original client IP when inserting firewalls between load balancers and targets; the deployment scales to 10 terabits per second and migrated over 250 billion daily connections, with VPC flow logs, traffic mirroring and Firewall Manager for observability and orchestration.
AI-written summary · about
chapters (11)
- 0:00Introduction and agenda
- 1:37Layered security overview
- 3:40Security basics and scaling
- 8:13DNS and gateway load balancing
- 11:27Network firewall services
- 15:52Deployment models
- 20:05Design patterns for inspection
- 28:17Ingress inspection patterns
- 32:24Egress case study
- 42:18Orchestration and visibility
- 50:48Closing remarks
related talks
44mElevando la postura de seguridad con AWS Network Firewall
52mFirewalls, and where to put them
29mBuild resilient and secure global cloud networks
47mNetwork operations management and governance
11mUse AWS Network Firewall for enterprises: Egress & ingress inspection
51mAdvanced approaches to traffic inspection & network diagnosis w/
39mOutbound security implementation with AWS Network Firewall & Route 53
17mSimplify, optimize, and enhance AWS network management