AWS 网络防火墙 - 如何记录被阻止的连接

Question

Question

Is there a way to log the connections blocked by the AWS Network Firewall, or filter the logs of blocked connections?

Background

Currently having setup the rules, and would like to know which IP or domains have been blocked.

Looking at Logging.network traffic from AWS Network Firewall but not clear if it is possible.

You can record flow logs and alert logs from your Network Firewall stateful engine.
Flow logs are standard.network traffic flow logs. Each flow log record captures the.network flow for a specific 5-tuple.

Alert logs report traffic that matches your stateful rules that have an action that sends an alert. A stateful rule sends alerts for the rule actions DROP and ALERT.

From the flow logs, it is not clear if it is passed or blocked.

{
    "firewall_name": "network-firewall-sagemaker-studio-anfw",
    "availability_zone": "us-east-1a",
    "event_timestamp": "1628236046",
    "event": {
        "timestamp": "2021-08-06T07:47:26.000068+0000",
        "flow_id": 1108238612337889,
        "event_type": "netflow",
        "src_ip": "51.222.5.114",
        "src_port": 57528,
        "dest_ip": "10.2.2.60",
        "dest_port": 8088,
        "proto": "TCP",
        "netflow": {
            "pkts": 1,
            "bytes": 40,
            "start": "2021-08-06T07:46:24.365793+0000",
            "end": "2021-08-06T07:46:24.365793+0000",
            "age": 0,
            "min_ttl": 239,
            "max_ttl": 239
        },
        "tcp": {
            "tcp_flags": "02",
            "syn": true
        }
    }
}

Answer 1

Yes, you can get.network logs.

AWS Network Firewall is a managed service that you can use to deploy essential.network protections for your Amazon Virtual Private Cloud instances. AWS Network Firewall works together with AWS Firewall Manager so you can build policies based on AWS Network Firewall rules and then centrally apply those policies across your VPCs and accounts. https://docs.aws.amazon.com/athena/latest/ug/querying.network-firewall-logs.html

How to create amazon cloudwatch logs https://docs.aws.amazon.com.network-firewall/latest/developerguide/logging-cw-logs.html

AWS Network Firewall logging destinations https://docs.aws.amazon.com.network-firewall/latest/developerguide/firewall-logging-destinations.html

Answer 2

In your firewall, Log configuration. Please enable logs for Alerts , you can then choose where the Alert ( Logs from blocked requests) should be shipped. You will have options like s3 or cloudwatch log group. Good luck.