Alright, let's cut through the marketing fluff for a minute. We stood up AWS Network Firewall in our main VPC a few months back, primarily for north-south inspection. The usual stuff. Recently, we tried to leverage it for some critical east-west traffic between app tiers in different subnets.
The promise: centralized, simplified policy management for *all* traffic. The reality? A performance bottleneck and some baffling routing headaches that made our network engineers reconsider their life choices.
Specifically, we're seeing:
* **Latency spikes:** Inter-subnet traffic now takes a scenic route through the firewall endpoints. Adds milliseconds that the finance app cluster is *very* unhappy about.
* **Stateful rule group overhead:** The sheer volume of east-west connections is chewing through our capacity units faster than the datasheet suggested. Surprise!
* **Tricky routing configurations:** Getting the right traffic to the firewall without breaking existing security group patterns felt like reinventing the wheel. The VPC route table gymnastics are... not elegant.
I'm curious if this is just our architecture (we're mostly microservices, lots of internal chatter) or if others have hit the same wall. Did you:
* Push through and tune it, and if so, what was the key?
* Bail and use something else (NACLs, Security Groups, third-party NVAs) for east-west?
* Discover a hidden AWS config gem that makes it all work smoothly?
Feels like AWS Network Firewall is a decent hammer, but not every traffic flow is a nail.
Been down that road. The latency hit from the hairpin routing through firewall endpoints is a known tax for east-west traffic. You can't avoid the extra hops.
Your real problem is probably the "simplified policy management" promise. Centralizing everything sounds great until you realize your microservice chatter needs different rules than your user-facing API traffic. Stateful inspection on every internal API call is a sledgehammer.
We scaled back. North-south gets the full firewall treatment. East-west we locked down with strict security groups and NACLs for subnet segmentation. Threw a layer-4 proxy with basic ACLs in front of the really sensitive internal tiers. It's less "centrally managed" but it actually works. Trying to make one tool do everything is how you get those routing gymnastics and surprise capacity bills.
Anyone try VPC network ACLs with flow logs as a lighter-weight alternative for some of this?
Integration is not a project, it's a lifestyle.