Hey, everyone.
And welcome back.
Now in today's video, we are going to discuss about firewall manager at a very high level overview.
Now, before we discuss more in detail about the service, let's look into a typical challenge that
will allow us to understand the benefits that the service provides.
Nowadays in the US you will see most of the organizations, they take up multi account strategy.
For example, they might have separate account for dev, environment, stage environment, production
environments and so on.
And in fact even within the production environments, they might have separate accounts for each set
of applications.
Some of the organizations that I have seen, they have 8200 accounts and things are still growing.
Now when you have larger set of accounts, one of the primary challenges that comes is to maintain a
common set of security standards across all of these environments.
So, for example, let's say in this specific diagram, you have three accounts.
Now, for all of these three accounts, let's say one is dev, second is staging, third is production.
Now, for each of these accounts, you need to maintain a separate set of services and its associated
rules, for example, if needs to be there in all the accounts, Network Firewall might need to be there
in all accounts, DNS Firewall might need to be there in all the accounts and so on.
This is one challenge, so you'll have to maintain each one of them.
Second primary challenge that you will see, let's say in the development account, your wife is configured
now a developer.
Tomorrow he launches a new set of application so that application might not really have have integrated
with him.
So then security team might again need to integrate for his specific application and so on.
So this is an ongoing challenge that happens.
So for certain set of time, maybe it can be a day, it can be a week, so on.
There will always be a Delta time where certain security service is not applicable for certain application
ins, specifically the ones that are newly launched.
So in order to overcome this, A has released firewall manager at a High level Overview.
Firewall Manager is a security management service which allows you to centrally configure and manage
firewall rules across your accounts and applications within your organization.
For example, let's say you have these three accounts now instead of manually logging in and manually
applying the appropriate rules associated with network firewall, VAV and others, you can make use
of firewall manager where you centrally configure the rules, and these rules will be common across
all of the accounts.
For example, let's say that one of the common services that is used across all three accounts is elastic
load balancer, for an example, application load balancer.
So now what you can do at a firewall manager level, you can go ahead and set the appropriate web application
firewall rules.
So now what will happen?
All of the load balancers here will be associated with the common set of rules that you apply at the
firewall manager level.
So this is the high level understanding about firewall manager at this stage.
Now, one of the great advantages of firewall manager is that it supports a wide variety of services.
One among them is VRF.
It also supports VPC security groups, Network Firewall, Route 53, DNS Firewall Shield Advance, and
the new one is Palo Alto Cloud Next Generation Firewall.
So these are the services.
There will be more to add at a later stage.
Now, again, one thing to note is that since firewall manager, it operates at an account level, there
are certain prerequisites.
And one of the important prerequisites here is the A plus organization and you'll also need the config.
Now, one of the things that needs to be noted associated with a firewall manager this is quite important
is its pricing primarily because it is quite expensive.
For example, you'll generally see that for various services that it supports, it charges $100 per
policy per region.
If you have multiple region, then the amount will increase subsequently.
And similarly, even for VPC security group, you see you have $100 per policy per region.
And they also have given certain examples over here where not only you have to pay for the policy,
as we were discussing over your firewall manager also requires a config.
So not only you pay $100 per policy per region, but you also pay for the necessary config and other
charges that are required as part of the firewall manager.
Now I feel that this is a little expensive, similar to how cloud is and when that service was launched,
it was very expensive and many of the organizations refrained from using that services and at a later
stage it has reduced the.
Praise of cloud ism quite subsequently.
And similarly Firewall manager.
I expect the pricing to be reduced because per policy per region 100 us the I feel it's quite expensive.
Now before we conclude, let's look into some of the benefits of Fireball Manager.
First one is that it simplifies the management of fireball rule across your accounts.
We have seen that if you centrally manage the fireball rules, it becomes much more simpler.
Second is it ensures compliance of existing and new applications.
This is something that we looked into our use case challenge, where, for example, a developer launches
a new application load balance for this new application.
Then with the help of firewall manager, you can ensure that the new resources that are created, those
resources will have existing set of rules that you configure at a firewall manager level.
Third one is it is easy to deploy, manage, rule across accounts and fourth is centrally deployed protection
for your VPC.
Now from what I've seen in the real world environment perspective is that many of the organizations
nowadays, they use data from extensively and all of the rules are centrally managed at the TerraForm
level.
So even though you have multiple accounts, it does not really prove to be much of a hazard.
The only primary challenge where you will face issues related to maintaining rules is if you are not
using a central infrastructure as a service, it can be cloud formation, it can be terraform, etc.
For example, if you are manually managing everything across accounts, this is where you will face
multiple level of challenges.
So this is one thing to note.
Now, again, firewall manager does provide good amount of benefit because you can deploy and manage
rules at a central account.
This is of great benefit, but because of pricing, many of the organizations that have decided to stick
at the infrastructure as code level where they manage the rules centrally from that.
So again, this might change at a later stage.
However, that's the high level overview and with this will conclude today's video.