6. Detailed Configuration Commands
Step 1: Create Stateful Rule Group
aws network-firewall create-rule-group \
--rule-group-name "StatefulRuleGroup-WebTraffic" \
--type STATEFUL \
--capacity 100 \
--rule-group '{
"RuleVariables": {
"IPSets": {
"HOME_NET": {
"Definition": ["10.0.0.0/16", "192.168.0.0/16"]
}
},
"PortSets": {
"WEB_PORTS": {
"Definition": ["80", "443"]
}
}
},
"RulesSource": {
"StatefulRules": [
{
"Action": "PASS",
"Header": {
"Protocol": "TCP",
"Source": "$HOME_NET",
"SourcePort": "ANY",
"Direction": "FORWARD",
"Destination": "ANY",
"DestinationPort": "$WEB_PORTS"
},
"RuleOptions": [
{
"Keyword": "sid",
"Settings": ["1"]
}
]
}
]
}
}' \
--region us-east-1
{
"RuleGroupResponse": {
"RuleGroupArn": "arn:aws:network-firewall:us-east-1:123456789012:stateful-rulegroup/StatefulRuleGroup-WebTraffic",
"RuleGroupName": "StatefulRuleGroup-WebTraffic",
"RuleGroupId": "12345678-1234-1234-1234-123456789012",
"Type": "STATEFUL",
"Capacity": 100,
"RuleGroupStatus": "ACTIVE"
},
"UpdateToken": "abcd1234-5678-90ef-ghij-klmnopqrstuv"
}
Stateful Rule Group Configuration:
| Parameter | Description | Options |
|---|
| rule-group-name | Unique identifier for the rule group | Must be unique within region |
| type | Rule group type | STATEFUL | STATELESS |
| capacity | Processing capacity units | 1-30000 for stateful |
| RuleVariables | Variables for reusable values | IPSets, PortSets |
| Action | Action for matching traffic | PASS | DROP | REJECT | ALERT |
What this does: Creates a stateful rule group that allows web traffic (HTTP/HTTPS) from internal networks. The rule group uses variables to make maintenance easier and includes a unique SID for tracking. This is typically the first component created as it's referenced by the firewall policy.
Step 2: Create Stateless Rule Group
aws network-firewall create-rule-group \
--rule-group-name "StatelessRuleGroup-BlockBadIPs" \
--type STATELESS \
--capacity 50 \
--rule-group '{
"RulesSource": {
"StatelessRulesAndCustomActions": {
"StatelessRules": [
{
"RuleDefinition": {
"MatchAttributes": {
"Sources": [
{
"AddressDefinition": "192.0.2.0/24"
}
],
"Protocols": [6, 17],
"DestinationPorts": [
{
"FromPort": 1,
"ToPort": 65535
}
]
},
"Actions": ["aws:drop"]
},
"Priority": 1
}
]
}
}
}' \
--region us-east-1
{
"RuleGroupResponse": {
"RuleGroupArn": "arn:aws:network-firewall:us-east-1:123456789012:stateless-rulegroup/StatelessRuleGroup-BlockBadIPs",
"RuleGroupName": "StatelessRuleGroup-BlockBadIPs",
"RuleGroupId": "87654321-4321-4321-4321-210987654321",
"Type": "STATELESS",
"Capacity": 50,
"RuleGroupStatus": "ACTIVE"
},
"UpdateToken": "efgh5678-9012-34ij-klmn-opqrstuvwxyz"
}
Stateless Rule Group Configuration:
| Parameter | Description | Options |
|---|
| Priority | Rule evaluation order | 1-65535 (lower = higher priority) |
| MatchAttributes | Traffic matching criteria | Sources, Destinations, Protocols, Ports |
| Actions | Actions to take on match | aws:drop, aws:pass, aws:forward-to-sfe |
| Protocols | IP protocol numbers | 6=TCP, 17=UDP, 1=ICMP |
What this does: Creates a stateless rule group that drops traffic from known bad IP ranges. Stateless rules are processed first and provide fast, efficient filtering. This rule group blocks a specific subnet (192.0.2.0/24) commonly used for documentation/testing that shouldn't appear in production traffic.
Step 3: Create Firewall Policy
aws network-firewall create-firewall-policy \
--firewall-policy-name "ComprehensiveFirewallPolicy" \
--firewall-policy '{
"StatelessDefaultActions": ["aws:forward-to-sfe"],
"StatelessFragmentDefaultActions": ["aws:forward-to-sfe"],
"StatelessRuleGroupReferences": [
{
"ResourceArn": "arn:aws:network-firewall:us-east-1:123456789012:stateless-rulegroup/StatelessRuleGroup-BlockBadIPs",
"Priority": 1
}
],
"StatefulRuleGroupReferences": [
{
"ResourceArn": "arn:aws:network-firewall:us-east-1:123456789012:stateful-rulegroup/StatefulRuleGroup-WebTraffic"
}
],
"StatefulDefaultActions": ["aws:drop_strict"],
"StatefulEngineOptions": {
"RuleOrder": "STRICT_ORDER"
}
}' \
--region us-east-1
{
"FirewallPolicyResponse": {
"FirewallPolicyArn": "arn:aws:network-firewall:us-east-1:123456789012:firewall-policy/ComprehensiveFirewallPolicy",
"FirewallPolicyName": "ComprehensiveFirewallPolicy",
"FirewallPolicyId": "11111111-2222-3333-4444-555555555555",
"FirewallPolicyStatus": "ACTIVE"
},
"UpdateToken": "ijkl9012-3456-78mn-opqr-stuvwxyzabcd"
}
Firewall Policy Configuration:
| Parameter | Description | Options |
|---|
| StatelessDefaultActions | Default action for unmatched stateless traffic | aws:drop, aws:pass, aws:forward-to-sfe |
| StatelessFragmentDefaultActions | Action for fragmented packets | aws:drop, aws:pass, aws:forward-to-sfe |
| StatefulDefaultActions | Default action for stateful engine | aws:drop_strict, aws:drop_established, aws:alert_strict |
| RuleOrder | Rule evaluation order | STRICT_ORDER | DEFAULT_ACTION_ORDER |
What this does: Creates the firewall policy that orchestrates all rule groups. The policy forwards unmatched stateless traffic to the stateful engine, uses strict ordering for consistent rule evaluation, and applies a default drop action for unmatched stateful traffic. This policy references both rule groups created in previous steps.
Step 4: Create Network Firewall
aws network-firewall create-firewall \
--firewall-name "ProductionNetworkFirewall" \
--firewall-policy-arn "arn:aws:network-firewall:us-east-1:123456789012:firewall-policy/ComprehensiveFirewallPolicy" \
--vpc-id "vpc-12345678" \
--subnet-mappings SubnetId=subnet-12345678,SubnetId=subnet-87654321 \
--tags Key=Environment,Value=Production Key=Project,Value=NetworkSecurity \
--region us-east-1
{
"Firewall": {
"FirewallName": "ProductionNetworkFirewall",
"FirewallArn": "arn:aws:network-firewall:us-east-1:123456789012:firewall/ProductionNetworkFirewall",
"FirewallId": "aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee",
"VpcId": "vpc-12345678",
"SubnetMappings": [
{
"SubnetId": "subnet-12345678",
"AvailabilityZone": "us-east-1a"
},
{
"SubnetId": "subnet-87654321",
"AvailabilityZone": "us-east-1b"
}
],
"FirewallPolicyArn": "arn:aws:network-firewall:us-east-1:123456789012:firewall-policy/ComprehensiveFirewallPolicy",
"FirewallStatus": "PROVISIONING"
},
"FirewallStatus": {
"Status": "PROVISIONING",
"ConfigurationSyncStateSummary": "IN_SYNC"
},
"UpdateToken": "mnop4567-8901-23qr-stuv-wxyzabcdefgh"
}
Network Firewall Configuration:
| Parameter | Description | Requirements |
|---|
| firewall-name | Unique firewall identifier | Must be unique within region |
| firewall-policy-arn | ARN of the firewall policy | Must exist and be ACTIVE |
| vpc-id | VPC where firewall will be deployed | Must exist and have available subnets |
| subnet-mappings | Subnets for firewall endpoints | Must be in different AZs, minimum /28 |
What this does: Creates the actual Network Firewall resource in your VPC. The firewall will create endpoints in the specified subnets, and the status will change from PROVISIONING to READY when deployment is complete. The firewall endpoints receive ENIs that you'll use in route table configurations.
Step 5: Get Firewall Status and Endpoints
aws network-firewall describe-firewall \
--firewall-name "ProductionNetworkFirewall" \
--region us-east-1
{
"Firewall": {
"FirewallName": "ProductionNetworkFirewall",
"FirewallArn": "arn:aws:network-firewall:us-east-1:123456789012:firewall/ProductionNetworkFirewall",
"FirewallId": "aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee",
"VpcId": "vpc-12345678",
"SubnetMappings": [
{
"SubnetId": "subnet-12345678",
"AvailabilityZone": "us-east-1a"
},
{
"SubnetId": "subnet-87654321",
"AvailabilityZone": "us-east-1b"
}
]
},
"FirewallStatus": {
"Status": "READY",
"ConfigurationSyncStateSummary": "IN_SYNC",
"SyncStates": {
"us-east-1a": {
"Attachment": {
"SubnetId": "subnet-12345678",
"EndpointId": "vpce-12345678901234567",
"Status": "READY"
}
},
"us-east-1b": {
"Attachment": {
"SubnetId": "subnet-87654321",
"EndpointId": "vpce-87654321098765432",
"Status": "READY"
}
}
}
}
}
Firewall Status Information:
| Field | Description | Values |
|---|
| Status | Overall firewall status | PROVISIONING, DELETING, READY |
| ConfigurationSyncStateSummary | Configuration sync status | IN_SYNC, PENDING, CAPACITY_CONSTRAINED |
| EndpointId | VPC endpoint for firewall | Used in route table destinations |
What this shows: This command retrieves the firewall status and endpoint information. The EndpointId values are crucial for the next step - configuring route tables. Wait until Status shows "READY" before proceeding with route table updates.
Step 6: Configure Route Tables
# Route internet traffic through firewall endpoint in AZ-A
aws ec2 create-route \
--route-table-id rtb-12345678 \
--destination-cidr-block 0.0.0.0/0 \
--vpc-endpoint-id vpce-12345678901234567 \
--region us-east-1
{
"Return": true
}
# Route internet traffic through firewall endpoint in AZ-B
aws ec2 create-route \
--route-table-id rtb-87654321 \
--destination-cidr-block 0.0.0.0/0 \
--vpc-endpoint-id vpce-87654321098765432 \
--region us-east-1
{
"Return": true
}
# Configure firewall subnet route table to send traffic to IGW
aws ec2 create-route \
--route-table-id rtb-firewall123 \
--destination-cidr-block 0.0.0.0/0 \
--gateway-id igw-12345678 \
--region us-east-1
{
"Return": true
}
Route Table Configuration:
| Route Type | Source | Destination | Purpose |
|---|
| Protected Subnets | 0.0.0.0/0 | Firewall Endpoint | Route internet traffic through firewall |
| Firewall Subnets | 0.0.0.0/0 | Internet Gateway | Route inspected traffic to internet |
| IGW Route Table | VPC CIDR | Firewall Endpoint | Route return traffic through firewall |
What this does: Configures the routing to ensure all traffic flows through the Network Firewall. Protected subnets route internet-bound traffic to firewall endpoints, firewall subnets route approved traffic to the internet gateway, and the IGW route table ensures return traffic goes through the firewall for inspection.
Step 7: Enable Logging
aws network-firewall put-logging-configuration \
--firewall-name "ProductionNetworkFirewall" \
--logging-configuration '{
"LogDestinationConfigs": [
{
"LogType": "FLOW",
"LogDestinationType": "CloudWatchLogs",
"LogDestination": {
"logGroup": "NetworkFirewall-FlowLogs"
}
},
{
"LogType": "ALERT",
"LogDestinationType": "CloudWatchLogs",
"LogDestination": {
"logGroup": "NetworkFirewall-AlertLogs"
}
},
{
"LogType": "FLOW",
"LogDestinationType": "S3",
"LogDestination": {
"bucketName": "network-firewall-logs-bucket",
"prefix": "flow-logs/"
}
}
]
}' \
--region us-east-1
{
"FirewallArn": "arn:aws:network-firewall:us-east-1:123456789012:firewall/ProductionNetworkFirewall",
"LoggingConfiguration": {
"LogDestinationConfigs": [
{
"LogType": "FLOW",
"LogDestinationType": "CloudWatchLogs",
"LogDestination": {
"logGroup": "NetworkFirewall-FlowLogs"
}
},
{
"LogType": "ALERT",
"LogDestinationType": "CloudWatchLogs",
"LogDestination": {
"logGroup": "NetworkFirewall-AlertLogs"
}
},
{
"LogType": "FLOW",
"LogDestinationType": "S3",
"LogDestination": {
"bucketName": "network-firewall-logs-bucket",
"prefix": "flow-logs/"
}
}
]
}
}
Logging Configuration:
| Log Type | Description | Destination Options |
|---|
| FLOW | Connection flow information | CloudWatchLogs, S3, KinesisDataFirehose |
| ALERT | Security alerts and rule matches | CloudWatchLogs, S3, KinesisDataFirehose |
| TLS | TLS inspection details | CloudWatchLogs, S3, KinesisDataFirehose |
What this does: Enables comprehensive logging for the Network Firewall. Flow logs capture all traffic flows for analysis and compliance, while alert logs capture security events. Using multiple destinations (CloudWatch Logs for real-time monitoring and S3 for long-term storage) provides flexibility for different use cases.
7. Monitoring and Maintenance
graph TB
subgraph "Monitoring Components"
subgraph "Metrics"
M1[Packets Passed]
M2[Packets Dropped]
M3[Invalid Packets]
M4[TLS Errors]
end
subgraph "Logs"
L1[Flow Logs]
L2[Alert Logs]
L3[TLS Logs]
end
subgraph "Destinations"
D1[CloudWatch Logs]
D2[S3 Buckets]
D3[Kinesis Data Firehose]
end
subgraph "Analysis"
A1[CloudWatch Insights]
A2[Athena Queries]
A3[Custom Dashboards]
end
end
M1 --> D1
M2 --> D1
M3 --> D1
M4 --> D1
L1 --> D1
L1 --> D2
L2 --> D1
L3 --> D3
D1 --> A1
D2 --> A2
D3 --> A3
Monitoring Architecture: Network Firewall provides comprehensive monitoring through CloudWatch metrics and configurable logging. Metrics track packet processing statistics, while logs provide detailed traffic and security information. Multiple log destinations enable different analysis approaches - CloudWatch Logs for real-time analysis, S3 for long-term storage and batch processing, and Kinesis Data Firehose for streaming analytics.
CloudWatch Metrics Commands
# Get firewall metrics for passed packets
aws cloudwatch get-metric-statistics \
--namespace "AWS/NetworkFirewall" \
--metric-name "PassedPackets" \
--dimensions Name=FirewallName,Value=ProductionNetworkFirewall \
--start-time 2024-01-01T00:00:00Z \
--end-time 2024-01-01T23:59:59Z \
--period 3600 \
--statistics Sum \
--region us-east-1
{
"Label": "PassedPackets",
"Datapoints": [
{
"Timestamp": "2024-01-01T00:00:00Z",
"Sum": 1250000.0,
"Unit": "Count"
},
{
"Timestamp": "2024-01-01T01:00:00Z",
"Sum": 1180000.0,
"Unit": "Count"
}
]
}
# Create CloudWatch alarm for dropped packets
aws cloudwatch put-metric-alarm \
--alarm-name "NetworkFirewall-HighDropRate" \
--alarm-description "Alert when firewall drops exceed threshold" \
--metric-name "DroppedPackets" \
--namespace "AWS/NetworkFirewall" \
--statistic Sum \
--period 300 \
--threshold 1000 \
--comparison-operator GreaterThanThreshold \
--evaluation-periods 2 \
--alarm-actions "arn:aws:sns:us-east-1:123456789012:network-firewall-alerts" \
--dimensions Name=FirewallName,Value=ProductionNetworkFirewall \
--region us-east-1
{
"ResponseMetadata": {
"RequestId": "12345678-1234-1234-1234-123456789012"
}
}
Key Monitoring Metrics:
| Metric | Description | Threshold Guidance |
|---|
| PassedPackets | Packets allowed through firewall | Monitor for baseline traffic patterns |
| DroppedPackets | Packets dropped by firewall rules | Alert on unusual spikes |
| InvalidPackets | Malformed or invalid packets | Alert on any non-zero values |
| TLSErrors | TLS inspection errors | Alert on sustained increases |
Monitoring Strategy: Set up CloudWatch alarms to monitor key metrics and detect anomalies. Monitor both allowed and dropped traffic to understand normal patterns and identify potential security events or misconfigurations. Use SNS notifications to alert security teams of significant events.
Complete Setup Validation Checklist
- ✓ Rule groups created and showing ACTIVE status
- ✓ Firewall policy created and referencing all rule groups
- ✓ Network firewall deployed and showing READY status
- ✓ Route tables updated to direct traffic through firewall endpoints
- ✓ Security groups allow traffic to/from firewall subnets
- ✓ Logging enabled for flow, alert, and TLS logs
- ✓ CloudWatch alarms configured for key metrics
- ✓ Test traffic flows through firewall and logs are generated