Reference Deployment Datasheet
AWS Direct Connect + Palo Alto + BGP
This FireOwls All-CCIE Team have helped customers implement AWS and Palo Alto transit VPC. The solution allows a pair of Palo Alto VM-Series firewalls act as the transit hub for multiple subscriber VPC. This diagram details the routing configuration between a customers private data center and the AWS public cloud.
Integration Guidelines
 |
Direct Connect is preferred as the primary connectivity between a customers data center and the AWS cloud. BGP local preference is used to manipulate the VM-Series firewalls so that they prefer Direct Connect over the internet VPNs. |
 |
The transit VPC design is an active/standby configuration that relies on routing as the failover mechanism. FW-A is preferred over FW-B and BGP AS Path prepend is used so the private data center FW prefers the path to FW-A first. |
 |
If Direct Connect goes down BGP will route over the internet IPSEC VPN |
 |
If FW-A goes down BGP will route all traffic to FW-B and traffic will first use the Direct Connect circuit versus the internet IPSEC. |
