Getting started from AWS members accounts—you can subscribe to the Palo
Alto Networks Cloud NGFW for AWS Marketplace SaaS listing from your member AWS
account. Each subscription results in the creation of a unique Cloud NGFW
tenant. See
Getting Started from an AWS Members
Account.
You can then add multiple other AWS accounts to the Cloud NGFW tenant,
then create Cloud NGFW resources (also called NGFWs) and associate them with
VPCs in their AWS accounts. Author security policy rules on these NGFWs and
monitor the usage of the Cloud NGFW tenants to send metering records to the AWS
Marketplace Metering Service. AWS uses this information to invoice the customer.
Within your AWS account, you then add an NGFW endpoint (also referred
to as a VPC endpoint) for this resource. You then add VPC route rules to route
all traffic to the NGFW endpoint for inspection. AWS automatically redirects the
traffic sent to the NGFW endpoint to the NGFW resource for inspection. Traffic
sent to an NGFW endpoint is always returned to the same NGFW endpoint—the NGFW
behaves as a “bump in the wire.”
Once started with
this method, you can't use the AWS Firewall Manager with this Cloud NGFW
tenant.
You can use the simplified onboarding experience to deploy your Cloud NGFW
resource using the Quick Launch in AWS Marketplace. This
option differs from other onboarding options. It includes updates to the Global
Firewall Admin role, changes in endpoint management, and modifications to the
Cloud NGFW console interface.
When you create a new tenant using the updated
simplified onboarding process the tenant is considered a V2 tenant. This
designation allows you to differentiate what onboarding process was used to
create your Cloud NGFW tenant. Tenants created prior to using the simplified
onboarding method are considered V1 tenants.
Getting started from an AWS Firewall Manager administrator account—If you
currently use the AWS Firewall Manager to manage security groups, or other
network security features across your AWS organization, You can use the same AWS
Firewall Manager to deploy NGFWs into multiple accounts and VPCs throughout an
AWS organization.
You can then use the
AWS Firewall Manager policy workflow
to author a global rulestack and quickly deploy NGFWs across multiple AWS
accounts in an AWS Organization. Under the hood, the Firewall Manager
orchestrates all of the components. This includes invoking the Cloud NGFW APIs
to create the NGFWs and invoking the AWS APIs to create the NGFW endpoints in
the customer VPCs.
Refer to the AWS Firewall Manager integration
blog and
video for more details on how AWS
Firewall Manager integrates with Cloud NGFW for AWS.
Once started with this method, you should always use an
AWS Firewall Manager to add AWS accounts to the Cloud NGFW tenant.
