View a markdown version of this page

Next Generation policy settings in Amazon Network Firewall - Amazon Network Firewall
Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China (PDF).

Next Generation policy settings in Amazon Network Firewall

A Next Generation policy in Network Firewall has the following configuration settings, which you define when you create or update the firewall policy. All settings except for the firewall policy name are changeable.

Tip

If you own a firewall that is shared with others using VPC endpoint associations, you should review the settings in your firewall policy to ensure they apply to VPC endpoint associations as needed.

  • Name – The identifier for the firewall policy. You assign a unique name to every firewall policy. You can't change the name of a firewall policy after you create it.

  • Description (Optional) – Additional information about the firewall policy. Fill in any information that might help you remember the purpose of the firewall policy and how you want to use it. The description is included in firewall policy lists in the console and through the APIs.

  • Policy mode – Determines whether the policy's engines enforce their actions or only report them. Select Enforce or Monitor. For more information, see Policy mode: enforce and monitor.

  • Firewall default action – Determines how the firewall engine handles traffic that doesn't match any firewall rule at a hook. Choose Drop, Accept, Alert, or Reject. For more information, see Firewall default action.

  • Stream exception – Determines how the firewall handles traffic when a network connection breaks midstream. A Next Generation policy supports Drop and Reject (default, recommended). The create procedure labels this setting Stream exception setting and the view and update pages label the same control inspection failure behavior; the API represents it with the StreamExceptionPolicy setting. For more information, see Stream exception policy for Next Generation policies.

  • Route 53 Resolved IP validation (Optional) – Verifies that a connection's destination IP address was resolved for a domain through your VPC's Amazon Route 53 Resolver before the firewall allows the traffic. For more information, see Resolved IP validation in Amazon Network Firewall.

  • TCP idle timeout (Optional) – The number of seconds that can pass without any traffic through the firewall before Network Firewall treats the TCP connection as idle. When you change this value, existing connections are treated according to your stream exception setting.

  • Policy variables (Optional) – The HOME_NET variable override for the policy. By default, HOME_NET is the CIDR range of the VPC where the firewall is deployed. You can override HOME_NET at the policy level to add the CIDR ranges of the VPCs that you want to filter. The override applies to all rule groups that don't define their own HOME_NET.

  • Firewall section – The rules that the firewall engine evaluates. You provide these as embedded rules that you author directly in the policy (see Embedded rules in a Next Generation policy) and as references to firewall rule groups. Each entry in the firewall section has a unique priority that defines its evaluation order within the policy. For more information, see The firewall section and the IPS section.

  • IPS section – The rules that the IPS engine evaluates. You provide these as embedded rules that you author directly in the policy (see Embedded rules in a Next Generation policy) and as references to IPS rule groups. For more information, see The firewall section and the IPS section.

  • Active Threat Defense (Optional) – Adds the Amazon managed Active Threat Defense rule group to the policy's IPS section. This rule group uses Amazon threat intelligence to protect against active threats and cloud-specific attack patterns. For more information, see Amazon active threat defense for Amazon Network Firewall.

  • Managed rule groups (Optional) – In addition to the rule groups you create, you can add Amazon managed rule groups to the policy's IPS section as a source of IPS rules. For more information, see Managed rule groups in Amazon Network Firewall.

  • TLS inspection configuration (Optional) – Contains settings to turn on decryption and re-encryption of the SSL/TLS traffic going to your firewall so that the traffic can be inspected. Next Generation policies support session holding only. For important differences in how you author rules for TLS-inspected traffic, see TLS inspection with a Next Generation policy in Amazon Network Firewall.

  • Customer-managed key (Optional) – Network Firewall encrypts and decrypts Network Firewall resources, to protect against unauthorized access. By default, Network Firewall uses Amazon owned keys for this. If you want to use your own keys, you can configure customer managed keys from Amazon Key Management Service and provide them to Network Firewall. Next Generation policies use the same encryption model as Classic Network Firewall policies. For information about this option, see Encryption at rest with Amazon Key Management Service.

  • Tags (Optional) – Zero or more key-value tag pairs. A tag is a label that you assign to an Amazon resource. You can use tags to search and filter your resources and to track your Amazon costs. For more information about tags, see Tagging Amazon Network Firewall resources.