Work / Landing zone
Landing zone, January 2025
Central security across three clouds
A global enterprise ran separate firewalls in every region and every cloud. We built a multi-account AWS landing zone with one security VPC, Palo Alto Panorama and Cisco Meraki. Network and firewall cost fell by 40 %.
The situation
The client is a global enterprise with workloads on several cloud providers and in on-premises data centres. Its estate had more than 20 AWS accounts. We found four problems.
Separate firewalls
Each region and each cloud had its own firewall. Policies differed between them, and the licence cost was high.
Network complexity
Several VPN, Direct Connect and peering connections existed, with no central view of any of them.
Duplicate resources
NAT gateways, VPC endpoints and security appliances were repeated in more than 20 AWS accounts.
No central inspection
Traffic between VPCs and traffic from on-premises sites was not inspected.
The AWS organization
We designed a multi-account AWS Organization with one organizational unit per purpose and all networking in one place. New accounts are created through Control Tower in one day.
Organization rootSecurity OU
- log-archive
- security
- audit
Infrastructure OU
- network
- shared-svc
- dns
Workload OU
- prod-apps
- stg-apps
- dev-apps
Deployment OU
- cicd
- artifacts
Exception OU
- data-prod
- legacy
Central logging, GuardDuty, Security Hub and CloudTrail.
Shared networking, Transit Gateway, DNS and VPC endpoints.
Application accounts, separated by environment and business unit.
The Deployment OU holds the pipelines and the build artifacts. The Exception OU holds the accounts that do not yet fit the standard structure.
The network across three clouds
The network spans three AWS regions, a second cloud provider and three on-premises data centres. One Transit Gateway hub connects the AWS regions. Direct Connect links the hub to the on-premises data centres. Each AWS region runs a Palo Alto VM-Series firewall and a Cisco Meraki vMX appliance. The on-premises data centres run Palo Alto firewalls, and the second cloud provider runs Cisco Meraki.
Transit Gateway hub Panorama central management| Site | Firewall | Connection to the hub |
|---|---|---|
| AWS regions 1 to 3 | Palo Alto VM-Series and Cisco Meraki vMX | Transit Gateway attachment |
| On-premises data centre 1 | Palo Alto | Direct Connect |
| On-premises data centre 2 | Palo Alto | Direct Connect |
| On-premises data centre 3 | Palo Alto | Direct Connect |
| Second cloud provider | Cisco Meraki | Meraki SD-WAN |
Network components
AWS Transit Gateway
The central hub that connects every VPC and every on-premises network.
Direct Connect gateway
Dedicated connections to the on-premises data centres.
Palo Alto Panorama
One console that manages every firewall in every location.
Cisco Meraki SD-WAN
Branch connectivity, managed from the cloud.
One security VPC for all traffic
All traffic passes through one security VPC. The VPC inspects traffic in four directions: from the Internet, to the Internet, between VPCs, and from on-premises sites.
AWS WAF and DDoS protection
Firewall rule processing
Stateless rules filter each packet first. Stateful inspection then examines the packet content and the application protocol, and the firewall allows or denies the traffic under the policy from Panorama.
The figures
Moving the shared network resources into the landing zone removed most of the duplicate NAT gateways, VPC endpoints and firewall clusters. Before the change, each of the 20 accounts had 2 NAT gateways, one per Availability Zone, and 10 VPC endpoints. Each VPC had its own Direct Connect virtual interface. After the change, one VPC holds 2 NAT gateways and 10 shared endpoints, and one Direct Connect gateway serves every VPC. The cost per month fell from 45,000 USD to 27,000 USD.
| Resource | Before | After | Saving, % |
|---|---|---|---|
| NAT gateways | 20 accounts × 2 AZs = 40 | 1 × 2 AZs = 2 | 95 |
| VPC endpoints | 20 accounts × 10 = 200 | 10, shared | 95 |
| Firewall clusters under licence | 6 clusters | 1 HA cluster | 60 |
| Direct Connect | 1 virtual interface per VPC | 1 gateway | 50 |
| Cost per month, USD | 45,000 | 27,000 | 40 |
Security after the change
One policy
A single Panorama instance manages every firewall in every region and on-premises site.
All traffic inspected
Every flow passes through the central inspection point. No path is left without inspection.
Explicit allow rules
Traffic between VPCs is segmented and allowed only by explicit rules.
Central logging
CloudTrail and VPC Flow Logs from every account are written to the log-archive account.
Compliance enforced
AWS Config rules and Security Hub standards are enforced through service control policies.
Incident response
A compromised account is moved to a quarantine OU and isolated at once.
How the work ran
Assessment and design
Foundation
Migration and integration
Optimization and handover
What the client received
- A multi-account AWS Organization under Control Tower, with five organizational units and new accounts in one day.
- One Transit Gateway hub, one Direct Connect gateway and one security VPC that inspects all traffic.
- One Panorama console for every Palo Alto firewall, and Meraki SD-WAN for branch and second-cloud connectivity.
- Central logging, Config rules and Security Hub standards in every account.
- Runbooks, monitoring and the verified cost figures: 27,000 USD per month, from 45,000 USD.
A landing zone for your estate
We assess your accounts and your network first, then agree the target architecture with your team, then apply the changes one environment at a time. You receive the Terraform code and the documentation.
Talk to an engineer