Cloud NGFW Egress NAT

Alternatively, configure the Egress NAT feature. In this case, Cloud NGFW will perform source NAT on all outbound traffic except for those sessions with destination IP addresses within the Configure Private Traffic Range defined for the endpoint on which the traffic enters the Cloud NGFW resource. In this case, the Cloud NGFW resource does not redirect the inspected traffic back to the endpoint. Alternatively, the inspected egress traffic is sent directly to the internet. You no longer incur AWS NAT gateway costs but would pay Palo Alto Networks for the egress traffic data transfer. However, you will associate public IP addresses to the Cloud NGFW resource in one of two ways:

1. Configure the Cloud NGFW resource to use Palo Alto Networks managed AWS Elastic IP Address (EIP) addresses to perform source NAT for your VPC. In this case, you’ll incur hourly EIP management costs.
2. Transfer your BYOIPs to the Cloud NGFW from your AWS account to avoid the hourly EIP management costs. For more information, see BYOIPs with AWS IPAM.

The image below illustrates how source NAT works on Internet-bound traffic using Cloud NGFW Egress NAT; source NAT on Internet-bound traffic using Cloud NGFW Egress NAT:

Hybrid NAT Settings

You can enable Egress NAT for an NGFW resource while customizing it to be disabled on specific endpoints. In this hybrid configuration, the Cloud NGFW operates as follows:

• Egress NAT Disabled: The Cloud NGFW acts as a bump-in-the-wire, directing all inspected traffic back to the endpoint.
• Egress NAT Enabled: The Cloud NGFW redirects the inspected traffic directly to the internet rather than back to the endpoint.

Virtual Router (VR) Scaling Limit: While you can create up to 300 endpoints per resource, the ability to mix these two modes is governed by internal routing resources:

• A single Cloud NGFW resource is limited to a maximum of 7 Virtual Routers (VRs).
• Any customization performed at the VPC endpoint level triggers the creation of a new VR.
  This includes:
  • Disabling Egress NAT for a specific endpoint.
  • Adding additional private prefixes to a VPC endpoint to be treated as private traffic.

• Each unique routing behavior (Egress NAT vs. Bump-in-the-wire) across your Availability Zones consumes these VRs.
• Once the 7 VR limit is reached, you cannot create additional endpoints that require a different NAT configuration.

The image below illustrates Egress NAT enabled for endpoint 1 and disabled for endpoint 2:

Configure Egress NAT with Palo Alto Networks Managed AWS EIPs

1. Log in to the Cloud NGFW console.
2. Click NGFWs.
3. Create a new NGFW resource.
4. In the Policy Management section, select Panorama. Use the drop-down menu to select the integrated Panorama.
5. In the Egress NAT section, select Enable Egress NAT.
6. In the Public IPs section, select AWS Service IPs.

   Select the Public IPs tab in the firewall page to view the list of supported IP addresses for Egress NAT traffic:

   After the firewall is created, verify its status.

Configure Egress NAT with Bring Your Own IPs (BYOIPs)

1. Log in to the AWS VPC IP Address Manager.
2. Select Planning > IPAMs.
3. In the IPAMs page, click Create IPAM.

   For more information, see the instructions on the AWS page to Create an IPAM.

   After you successfully create the IPAM, the AWS VPC IP Address Manager displays details of the IPAM:

   After you successfully create the IPAM, the AWS VPC IP Address Manager displays details of the IPAM:
4. Create an IPAM pool to plan for IP address provisioning. Select Planning>Pools and click Create pool.

   When creating an IPAM pool, you must set the Address Family to IPv4, and set the Locale to where you want to deploy your Cloud NGFW resource, as illustrated in the Pool Hierarchy screen:

   After you successfully create the IPAM, the AWS VPC IP Address Manager displays details about the new pool:

   The newly created pool does not have CIDRs provisioned. You’ll need a public IP CIDR range and the corresponding certificate’s private key.
5. Provision CIDRS to the newly created pool from the previous step. Select Planning>Pools then select the CIDR tab below the Pool Summary.
6. Select Actions>Provision CIDR. You’ll use this process to retrieve a public IP CIDR range and the corresponding certificate’s private key. See Provision CIDRS to a pool for more information.
7. In the CIDRs to provision, click Input a CIDR with a X.509 Certificate .
8. Copy the Signature.
9. Click Provision.

   Confirm that the CIDR is successfully provisioned, and that the pool was successfully created:
10. By default, when you add a CIDR to a pool it isn't advertised. Advertise it to make it publicly accessible over the internet. To advertise the CIDR:

    1. Select the pool.
    2. Click the CIDR tab.
    3. In the Actions menu, select Advertise.
    4. In the Advertise CIDR menu, use the drop-down menu to select the appropriate ASN; click Advertise CIDR. For more information, see Advertise your CIDR.

    Confirm that the CIDR is successfully advertised:
11. After advertising the CIDR, share the IPAM pool with your Cloud NGFW deployment account. To do this:

    1. Select the pool.
    2. Click the Resource sharing tab.
    3. In the Resource sharing menu, select Create resource share.
    4. In the Resource share name menu, enter the name of the IPAM pool you want to share.
    5. Optionally add the ARN to the resource share name.
    6. Click Next.
    7. Grant access to principals.
    8. Review the resource share options and principals, then click Create. For more information, see Share an IPAM pool.

       Confirm that resources associated with the IPAM pool were successfully shared:

Create a Cloud NGFW Resource, Enable Egress NAT and Specify BYOIPs

1. Log in to the Cloud NGFW console.
2. Click NGFWs.
3. Create a new NGFW resource.
4. In the Policy Management section, select Panorama. Use the drop-down menu to select the integrated Panorama.
5. In the Egress NAT section, select Enable Egress NAT.
6. Select Bring Your Public IPs and enter the IPAM pool ID created in step 3 (above).

   The IPAM Pool ID is located in the IPAM Pool Details section.

   Select the Public IPs tab in the firewall page to view the list of supported IP addresses for Egress NAT traffic:

   After the firewall is created, verify its status.

   To release addresses back to your IPAM pool if you choose not to use BYOIPs contact Palo Alto Networks to create a support case.

Important Considerations