Skip to main content

Reference Architectures

The DiscrimiNAT Firewall supports three deployment topologies. You are free, however, to deploy it as you see fit and consult our DevSecOps Support as needed.

The key differentiators between the topologies are laid out in the table below:

TopologyRTOMin Instances per AZInter-AZ Data TransferAuto ScalingTerraform Module
GWLB in Cross-Zone10 seconds1yesyeshere
GWLB in Intra-Zone10 seconds2noyeshere
ENI per AZ~120 seconds1 (also max)nonohere

GWLB in Cross-Zone mode

In the cross-zone mode, the Gateway Load Balancer (GWLB) will distribute traffic evenly across all deployed AZs. This reduces the number of DiscrimiNAT Firewall instances you will have to run for high-availability but increases data-transfer costs.

note

Terraform variable high_availability_mode should be set to cross-zone. This is also the default. The Terraform module is here.

caution

Minimum number of allocated Elastic IPs for high-availability (=2) with headroom for auto-scaling (+1) is 3 per region.

GWLB in Intra-Zone mode

In the intra-zone mode, the GWLB will distribute traffic evenly across all DisrimiNAT Firewall instances in the same AZ as the client. For effective high-availability, this mode will need at least two instances per deployed AZ.

note

Terraform variable high_availability_mode should be set to intra-zone. The Terraform module is here.

caution

Traffic will not be balanced to other zones, even in case of failure of all instances in one zone, therefore minimum high-availability numbers (=2) have to be configured per AZ.

caution

Minimum number of allocated Elastic IPs for high-availability (=2) with headroom for auto-scaling (+1) is 3 per AZ; and therefore 6 for two AZs.

ENI per AZ

A single DiscrimiNAT instance, wrapped in an Auto Scaling Group of its own, is deployed per AZ without any load balancers. Routing is directly to the ENI (Network Interface) of this instance. The ENI is statically bound to the Launch Template in the provided CloudFormation & Terraform modules, therefore only one active instance per AZ can exist at a time. Should the built-in health check fail, the instance will be terminated and a new one brought in its place by its Auto Scaling Group. This process takes around ~120 seconds.

The Terraform module for this topology is here.