They are described in ascending order of innovation… 1.

Nothing gets the morning started better than subscribing to the latest PAN-OS AMI in the AWS marketplace, but before we get ahead of ourselves, we need to look at all of the scenarios that a given organization may have executed on to get a firewall into the cloud datapath.

I don’t know how much stuff in the cloud and I am scared.

As of now, there is no logical point of governance or strategy behind the deployment and enablement of my cloud operations.

My entire internet-working philosophy is becoming cloud-centric and I need a plan to integrate in-line inspection into the cloud stack.

My cloud has become the entry point for 3rd party vendors and customer sites connecting to the cloud.

My mission critical applications are moving to the cloud so they require localized security controls.

My VPCs need independent internet connectivity, not tied to on-prem firewalls, which includes ingress and egress to the internet.

I usually get answers in the neighborhood of the following:

To get a clear understanding of what types of architectures are relevant for a given customer, I have to ask: “Why do you WANT to put your firewalls in the cloud?” Since there has been exponential growth in the capacities for intercloud routing, it naturally gives rise to conversations around egress control with two emergent camps of distributed and centralized. I’ve been getting a decent amount of questions from my customers about the AWS routing construct, called the Transit Gateway, and lately the concept of in-line filtering and deep packet inspection has come up during the discussions of modeling new cloud implementation strategies that fit into the new transit model.

Aws network firewall