Configure Egress NAT for Cloud NGFW for AWS from Strata Cloud Manager to control which public IP addresses Cloud NGFW uses for outbound internet traffic.
| Where Can I Use This? | What Do I Need? |
|---|
Egress NAT performs source address translation on outbound traffic to destinations in
the public internet. Cloud NGFW replaces the private source IP addresses of your
workloads with public Elastic IP (EIP) addresses before it sends the traffic to the
internet, so you control which public addresses your outbound traffic uses.
Cloud NGFW offers two ways to perform source NAT: AWS NAT Gateway and Cloud NGFW
Egress NAT. With Cloud NGFW Egress NAT, you can use EIPs that Palo Alto Networks
manages or bring your own IP address space (BYOIP). You can expand a BYOIP pool that
is already in use without disrupting active traffic, monitor pool utilization
through Amazon CloudWatch metrics, and disable the automatic fallback to the AWS
Internet Gateway when the EIP pool is exhausted.
The number of Cloud NGFW endpoints with Egress NAT customizations that each resource
supports depends on your firewall tier. See
Cloud NGFW for AWS limits and quotas for the
values.
Egress NAT functionality isn't supported on existing firewalls (those created
before this release of Cloud NGFW for AWS). Create a new one to use Egress
NAT.
AWS NAT Gateway
The
Amazon NAT gateway allows your VPC
resources in your Private subnets to securely access services outside the
subnet, including the public internet, while keeping Private resources
inaccessible to unsolicited traffic.
You can continue to use the AWS NAT gateway in your VPC. In this scenario, the
Cloud NGFW acts as a bump-in-the-wire, directing all inspected traffic back to
its endpoint.
You pay AWS for the NAT gateway and for associated Egress data transfer
costs.
The image below illustrates source NAT on Internet-bound traffic using the AWS
NAT gateway:
Cloud NGFW Egress NAT
Alternatively, configure the Egress NAT feature. In this case, Cloud NGFW will
perform source NAT on all outbound traffic except for those sessions with
destination IP addresses within the
Configure Private Traffic Range
defined for the endpoint on which the traffic enters the Cloud NGFW resource. In
this case, the Cloud NGFW resource does not redirect the inspected traffic back
to the endpoint. Alternatively, the inspected egress traffic is sent directly to
the internet. You no longer incur AWS NAT gateway costs but would pay Palo Alto
Networks for the egress traffic data transfer. However, you will associate
public IP addresses to the Cloud NGFW resource in one of two ways:
- Configure the Cloud NGFW resource to use Palo Alto Networks managed AWS
Elastic IP Address (EIP) addresses to perform source NAT for your VPC. In
this case, you’ll incur hourly EIP management costs.
- Transfer your BYOIPs to the Cloud NGFW from your AWS account to avoid the
hourly EIP management costs. For more information, see BYOIPs with AWS IPAM.
The image below illustrates how source NAT works on Internet-bound traffic using
Cloud NGFW Egress NAT; source NAT on Internet-bound traffic using Cloud NGFW
Egress NAT:
Hybrid NAT Settings
You can enable Egress NAT for an NGFW resource while customizing it to
be disabled on specific endpoints. In this hybrid configuration, the Cloud NGFW
operates as follows:
The image below illustrates Egress NAT enabled for endpoint 1 and disabled for
endpoint 2:
Elastic IP Addresses
In AWS, an elastic IP address (EIP) represents a static IPv4 address, used for
dynamic cloud computing. An Elastic IP Address is reachable from the public
internet, however, you can associate it with a private instance to enable
communication with the internet.
IPv6 Protocol Compatibility and NAT Limitations
Egress NAT translates a private IP address to a public routable address
by altering the source address of packets passing through the Cloud NGFW,
allowing connections to be initiated only for outgoing network connections.
For Cloud NGFW instances deployed in IPv6 environments, Egress
NAT is supported for IPv4 traffic only. IPv6-to-IPv6
communication utilizes native routing without address translation.
To use your own IP addresses with Cloud NGFW Egress NAT, first
create an IPAM pool for BYOIPs in AWS and
share it with your Cloud NGFW deployment account.
You can configure Egress NAT for Cloud NGFW for AWS directly from Strata™ Cloud
Manager. This release also introduces expanded BYOIP capabilities: you can add CIDRs
to existing in-use pools without disrupting active traffic, disable the automatic
fallback to AWS Internet Gateway when the EIP pool is exhausted, and monitor BYOIP
pool utilization through Amazon CloudWatch metrics.
The image below illustrates how the Egress NAT configuration you author in Strata
Cloud Manager applies to Cloud NGFW, and how outbound traffic, the BYOIP pool,
CloudWatch metrics, and the optional fallback relate to each other:
