AWS Network Firewall for Ingress/Egress Traffic

As a network engineer, your role encompasses monitoring and troubleshooting of the network. Understanding the flow of traffic through the network, being able to identify where traffic is coming from and ensuring that unauthorized access attempts are unsuccessful. This lab demonstrates the key concepts of AWS Network Firewall. This lab will demonstrate the use of AWS Network Firewall to filter outbound web traffic using resources that are provisioned as part of this lab. You will learn to use Amazon Route 53 DNS Firewall to block certain domains and apply it to the VPCs. Next you will use Network Firewall Engine to inspect traffic and to configure stateless and stateful rule group to mitigate threat against AWS workload. You will set up CloudWatch Log Groups to monitor your network and detect anomalies. Based on the finding displayed in CloudWatch, you investigate and mitigate the suspected threats.

Level

Advanced

Duration

1 Hours 30 Minutes

Course objectives

By the end of this lab, you will be able to do the following:

      •    Configure the AWS Network Firewall using the Network Firewall rule groups to filter outbound web traffic.

      •    Create DNS Firewall Domain List, rule groups and rules using your custom domain lists.

      •    Use Route 53 DNS Firewall to filter and secure DNS traffic.

      •    Use CloudWatch Log Groups to filter queries for auditing and identifying potential threats.

      •    Configure stateful rule groups in AWS Network Firewall that follow Suricata-compatible intrusion prevention system (IPS) rule specifications.

      •    Apply stateful and stateless firewall rules to detect suspicious network traffic.

      •    Configure Firewall Policy and monitoring for AWS Network Firewall to hunt for suspicious network activity.

      •    Stop malicious activities identified through monitoring and investigation of security alerts.

Intended audience

This course is intended for:

      •    Architect

      •    Developer

      •    Infrastructure Engineer

Prerequisites

We recommend that attendees of this course have the following prerequisites:

      •    Familiarity with routing and DNS are recommended. You should also be comfortable working with the Command Line Interface (CLI) in a Linux environment.

Course outline

Task 1: Verify firewall resources

Task 2: Egress web filtering

Task 3: Egress DNS query filtering

Task 4: Using open source rules with AWS Network Firewall

Task 5: Threat hunting with AWS Network Firewall