Skip to content
AWS NFW Walkthrough

Validate

Progress checklist

Overview

Section titled “Overview”

Joint gate after each hub’s own validate. Two mirrored hubs, no NFW yet.

Each hub's local list must equal the other's remote list. Both directions, or the mesh routes will not line up later. Icons from aws-icons.
The mirror gate after both hubs are up A rail across the top shows the order: validate Sydney, validate Auckland, then this joint hub gate, then dev workloads. Below, the two Regions sit side by side. Sydney lists local spoke CIDRs 10.255.1.0/24 and 10.255.2.0/24 and remote spoke CIDRs 10.254.1.0/24 and 10.254.2.0/24. Auckland lists the same two sets with local and remote swapped. Equals signs join Sydney local to Auckland remote and Sydney remote to Auckland local, which is the mirror assertion. Both Regions still report enable_network_firewall false. validate Sydney validate Auckland mirror gate — here workloads (dev) ap-southeast-2 · Sydney ASN 65001 tgw-04fc7f3ccf224fdf2 enable_network_firewall = false local_spoke_cidrs 10.255.1.0/24 10.255.2.0/24 remote_spoke_cidrs 10.254.1.0/24 10.254.2.0/24 ap-southeast-6 · Auckland ASN 65002 tgw-04db3776f3a795ce7 enable_network_firewall = false remote_spoke_cidrs 10.255.1.0/24 10.255.2.0/24 local_spoke_cidrs 10.254.1.0/24 10.254.2.0/24 = = Both equalities must hold — that is exactly what the SYD_LOCAL = AKL_REMOTE and AKL_LOCAL = SYD_REMOTE test asserts.

Compare

Section titled “Compare”

  1. Dump both output sets:

    Terminal window
    ( cd environment/sandbox/ap-southeast-2/hub && \
      echo "=== Sydney ===" && \
      terraform output -raw region && \
      terraform output -raw transit_gateway_id && \
      terraform output -raw inspection_vpc_cidr && \
      terraform output -raw enable_network_firewall && \
      terraform output local_spoke_cidrs && \
      terraform output remote_spoke_cidrs )
    ( cd environment/sandbox/ap-southeast-6/hub && \
      echo "=== Auckland ===" && \
      terraform output -raw region && \
      terraform output -raw transit_gateway_id && \
      terraform output -raw inspection_vpc_cidr && \
      terraform output -raw enable_network_firewall && \
      terraform output local_spoke_cidrs && \
      terraform output remote_spoke_cidrs )
    === Sydney ===
    ap-southeast-2
    tgw-04fc7f3ccf224fdf2
    10.255.0.0/24
    false
    tolist([
      "10.255.1.0/24",
      "10.255.2.0/24",
    ])
    tolist([
      "10.254.1.0/24",
      "10.254.2.0/24",
    ])
    === Auckland ===
    ap-southeast-6
    tgw-04db3776f3a795ce7
    10.254.0.0/24
    false
    tolist([
      "10.254.1.0/24",
      "10.254.2.0/24",
    ])
    tolist([
      "10.255.1.0/24",
      "10.255.2.0/24",
    ])

  2. Assert spoke CIDR lists mirror:

    Terminal window
    SYD_LOCAL=$(cd environment/sandbox/ap-southeast-2/hub && terraform output -json local_spoke_cidrs)
    SYD_REMOTE=$(cd environment/sandbox/ap-southeast-2/hub && terraform output -json remote_spoke_cidrs)
    AKL_LOCAL=$(cd environment/sandbox/ap-southeast-6/hub && terraform output -json local_spoke_cidrs)
    AKL_REMOTE=$(cd environment/sandbox/ap-southeast-6/hub && terraform output -json remote_spoke_cidrs)
    

    test "$SYD_LOCAL" = "$AKL_REMOTE" && test "$AKL_LOCAL" = "$SYD_REMOTE" \
      && echo "spoke CIDRs mirror OK" \
      || echo "spoke CIDRs do NOT mirror"
    spoke CIDRs mirror OK

  3. Both TGWs available:

    Terminal window
    export AWS_PROFILE=YOUR_HUB_PROFILE
    SYD_TGW=$(cd environment/sandbox/ap-southeast-2/hub && terraform output -raw transit_gateway_id)
    AKL_TGW=$(cd environment/sandbox/ap-southeast-6/hub && terraform output -raw transit_gateway_id)
    

    aws ec2 describe-transit-gateways --region ap-southeast-2 \
      --transit-gateway-ids "$SYD_TGW" \
      --query 'TransitGateways[0].{State:State,Asn:Options.AmazonSideAsn}' \
      --output table
    

    aws ec2 describe-transit-gateways --region ap-southeast-6 \
      --transit-gateway-ids "$AKL_TGW" \
      --query 'TransitGateways[0].{State:State,Asn:Options.AmazonSideAsn}' \
      --output table
    |  Asn   |    State    |
    |  65001 |  available  |
    

    |  Asn   |    State    |
    |  65002 |  available  |

  4. NFW still off on both:

    Terminal window
    terraform -chdir=environment/sandbox/ap-southeast-2/hub output -raw enable_network_firewall
    terraform -chdir=environment/sandbox/ap-southeast-6/hub output -raw enable_network_firewall
    false
    false

Next

Section titled “Next”

Sydney workload (dev)