This section describes how to deploy a virtual Network Security instance in a scenario in which the Network Security instance is deployed inline in AWS between AWS virtual desktop clients in a private subnet and a Network Address Translation (NAT) device. In this example scenario, the NAT device acts as a third-party virtual firewall and performs the address translation between public Internet servers and the private subnet hosting the desktop clients. The desktop clients connect to the Internet servers through the public IP address of the NAT device. The traffic between the desktop clients and the Internet servers flows through the Network Security instance, which protects the desktop clients.
Note
This procedure assumes that security groups and network access control lists are already configured in AWS.
The network mask of the IP addresses in this scenario is 255.255.255.224 (10.88.9.xxx/27).
This scenario involves the following components:
NAT device—An Ubuntu Linux EC2 instance with source network address translation (SNAT) configured and IP forwarding enabled to translate the internal source IP addresses of the desktop clients to keep them private.
AWS virtual desktop clients—Ubuntu Linux EC instances (internal AWS EC2 instances) on a private subnet. They can be desktop instances in an AWS virtual desktop infrastructure (VDI).
The Network Security instance protects the desktop clients. The desktop clients connect to the Internet servers through the public IP address configured on the NAT device.
Network Security instance—A Network Security EC2 instance deployed inline. Port pair A is the inline port pair. One monitoring interface is connected to the NAT instance and the other monitoring interface is connected to the private subnet that hosts the desktop clients.
Internet servers—Internet servers (or on-premises enterprise servers) with which the desktop clients communicate.
Perform the following tasks to configure this deployment scenario.
Configure a Network Security monitoring interface as the default gateway for the desktop clients
A Network Security monitoring interface must be the default gateway for the desktop clients hosted on the private subnet. This allows the desktop clients to send traffic to the Network Security instance.
Add a default route in the route table associated with the private subnet that hosts the desktop clients.
Set the destination to 0.0.0.0/0.
Set the target to the Network Security network interface (also known as elastic network interface, or ENI) that is connected to the private subnet (pether4 in this example).
The following illustration shows the example AWS route table configuration.
For more information about route tables and detailed instructions for implementing them, see the Amazon AWS VPC route table documentation.
Configure the NAT private IP address as the default gateway for the other Network Security monitoring Interface
The private IP address of the NAT instance must be configured as the default gateway for the other Network Security monitoring interface. This procedure creates a static IP default gateway and removes the DHCP default gateway from the configuration.
Configure a default gateway to point to the NAT instance public IP address through the monitoring port interface (pether3 in this example) connected on that subnet. In this scenario,
<NAT ether1 IP>is 10.88.9.79.nx-hostname (config) # ip route vrf vrfA 0.0.0.0 /0 <NAT ether1 IP>Verify your changes.
nx-hostname (config) # show ip routeSave your changes.
nx-hostname (config) # write memory
The following Network Security routing table shows that the static gateway is the only default gateway that exists on the instance.
nx-hostname (config) # show ip route
Destination Mask Gateway Interface Source
default 0.0.0.0 10.88.9.79 pether3 static
10.88.9.64 255.255.255.224 0.0.0.0 pether3 interface
10.88.9.96 255.255.255.224 0.0.0.0 pether4 interface
10.88.9.192 255.255.255.224 0.0.0.0 ether1 interface
Custom table routes
Destination Mask Gateway Interface Table
nx-hostname (config) # Configure an HTTP proxy device for management port connectivity
This procedure describes how to configure an HTTP proxy device on a Network Security instance to establish management port connectivity for services that operate over the management interface and require access to the Internet.
Important
The HTTP proxy device must have a public IP address that can communicate with the Network Security ether1 interface IP address.
Note
If the Network Security instance is managed by a Central Management System appliance, this procedure must be performed on the Central Management System appliance instead of the Network Security instance.
Configure the proxy device hostname or IP address, and the port (if you do not want to use the default port 8080):
nx-hostname (config) # fenet proxy host <hostname or IP address>:[<port>]Enable the proxy device:
nx-hostname (config) # fenet proxy enableVerify your changes:
nx-hostname (config) # show fenetSave your changes:
nx-hostname (config) # write memory
For details about configuring an HTTP proxy on a Network Security instance or Central Management System appliance, see the Network Security System Administration Guide or the Central Management System Administration Guide.
Configure the NAT instance
The NAT instance must simulate a third-party firewall that provides NAT functionality. In addition to configuring SNAT and enabling IP forwarding, you should create a static route in the NAT configuration that ensures that the Internet traffic flows through the Network Security instance before it reaches the desktop clients. The static route sets the Network Security monitoring interface IP address configured for the NAT instance (pether3 in this example) as the next-hop gateway.
The following is an excerpt from the routing table for the NAT instance used in this scenario. In this excerpt, 10.88.9.107 and 10.88.9.111 are the desktop client IP addresses and 10.88.9.77 is the Network Security pether3 address.
Kernel IP routing table Destination Gateway ... 10.88.9.107 10.88.9.77 10.88.9.111 10.88.9.77 ...
For details about using an Amazon Linux AMI as a NAT instance, see the Amazon AWS VPC NAT gateway documentation.