Policy and Suricata compatible rule creation for AWS Network Firewall
summary
AWS Network Firewall uses the Suricata engine for deep packet inspection and the session lays out concrete, working patterns: configure strict order and drop established to get default deny, prefer stateful custom Suricata rules, set a global home_net and unique SIDs, and centralize endpoints behind Transit Gateway to save cost. Examples include rules that drop HTTP on non‑80, validate NTP over UDP, and build a TLS SNI allow list using flow to server established and content/SNI matches for reliable, auditable enforcement.
AI-written summary · about
chapters (26)
- 0:00Introduction
- 1:00Agenda
- 5:45Best Practices
- 13:15Rule Groups
- 16:04Define HomeNet Variable
- 17:13Use Alert Rules before Pass Rules
- 18:04Pass Rules dont alert
- 18:29Longer SIDs
- 19:11Suricata Keywords
- 20:39Flow to Server
- 21:26Log Types
- 28:53Network Firewall Deployment
- 29:50Circular Syntax
- 30:43Action
- 32:11Protocol Options
- 32:21Layer 7 Protocols
- 33:05Source and Destination
- 34:47Ports
- 34:59Port Ranges
- 35:58Source Destination
- 36:47Rule Options
- 37:05Flow Keyword
- 38:55Alert Rule
- 41:38Drop Rule
- 45:04Drop Rule explanation
- 49:53Wrap up
related talks
44mElevando la postura de seguridad con AWS Network Firewall
26mPolicy as Code for Network as Code
33mNetwork ACLs Made Easy: Establishing Zero Trust Network Policies in a Few C...
18mEnhance application security at the edge with AWS
51mNetwork inspection design patterns that scale
17mManage Network Filtering at Scale
47mNetwork operations management and governance
50mAWS Well-Architected for network security