The customer has an Amazon Web Services Elastic Computing Cloud that provides a service to the internet directly and needs to secure that cloud with a VM-Series NGFW. Which component handles address translation?

In an Amazon Web Services (AWS) Virtual Private Cloud (VPC), all resources, including the server EC2 instances and the VM-Series firewall, are assigned private IP addresses from the RFC 1918 address space. To enable internet access, AWS networking infrastructure is used. An Internet Gateway (IGW) is attached to the VPC, and a public IP address (such as an Elastic IP) is associated with the firewall's external network interface. The IGW performs the one-to-one Network Address Translation (NAT) between this public IP and the firewall's private IP. Therefore, it is the AWS cloud infrastructure that handles the fundamental address translation to make the service publicly accessible.

A. This is incorrect because if AWS infrastructure translated the server VM addresses directly, traffic would bypass the VM-Series firewall, defeating the purpose of securing the service with it.
B. While the VM-Series firewall performs Destination NAT (DNAT) to forward traffic to the internal servers, the initial and primary translation from the public internet IP to the firewall's private IP is handled by the AWS infrastructure (Internet Gateway).
D. This is incorrect. Instances within a VPC are natively assigned private IPs. Public IPs are not assigned directly to the instances but are mapped to their private IPs by the AWS networking infrastructure.

1. Palo Alto Networks

VM-Series Deployment Guide for AWS (Version 11.1)

"Reference Architectures for the VM-Series Firewall on AWS

" Section: "Security VPC with an Internet Gateway." The diagrams and traffic flow descriptions in this section illustrate that internet traffic first traverses the AWS Internet Gateway before reaching the VM-Series firewall. The firewall and the application servers reside in subnets with private (RFC 1918) IP addresses.

2. Amazon Web Services (AWS) Documentation

"VPC user guide

" Section: "Internet gateways." The documentation states

"An internet gateway... performs network address translation (NAT) for instances that have been assigned public IPv4 addresses." This confirms that the AWS infrastructure is responsible for the NAT function that maps a public IP to the private IP of an instance

such as the VM-Series firewall.

3. Amazon Web Services (AWS) Documentation

"VPC user guide

" Section: "IP addressing in your VPC." This guide specifies

"When you launch an instance into a default VPC

we assign it a public IPv4 address... When you launch an instance into a nondefault VPC

we do not assign it a public IPv4 address by default... A private IPv4 address is an IP address that's not reachable over the internet." This establishes that instances natively operate with private IPs within the VPC.