On-Premises Office Network Security Appliances#
A walkthrough of the security appliances found in a typical corporate office, ordered from the outermost to innermost layer.
[Internet]
↓
[① Firewall] ← External/internal boundary, L3/L4 filtering
↓
[② IDS/IPS] ← Intrusion detection/prevention
↓
[③ VPN Gateway] ← Encrypted tunnel for remote access
↓
[④ WAF] ← Web Application Firewall (L7)
↓
[⑤ NAC] ← Network Access Control (endpoint authentication)
↓
[Internal Network / Servers]
① Firewall#
| Item | Description |
|---|
| Role | Filter inbound/outbound traffic, allow/deny by IP/port |
| Position | Boundary between internet and internal network |
| Examples | Fortinet FortiGate, Palo Alto, Cisco ASA, Juniper SRX |
| Cloud equivalent | Security Group + NACL |
Next-generation firewalls (NGFW) inspect up to L7, including application identification, user identification, and SSL decryption.
② IDS/IPS (Intrusion Detection/Prevention System)#
| Item | Description |
|---|
| IDS | Intrusion detection — alerts on anomalous traffic (monitoring) |
| IPS | Intrusion prevention — automatically blocks anomalous traffic (inline) |
| Examples | Snort, Suricata (open source), Palo Alto Threat Prevention |
| Cloud equivalent | AWS GuardDuty (detection), AWS WAF + Shield (blocking) |
IDS uses mirroring (passive monitoring); IPS is inline (active blocking). Modern NGFWs increasingly integrate IPS functionality.
③ VPN Gateway#
| Item | Description |
|---|
| Role | Encrypted tunnel access from external into the internal network |
| Types | Site-to-Site (office ↔ cloud), Client VPN (remote → office) |
| Examples | OpenVPN, WireGuard, Cisco AnyConnect, FortiClient |
| Cloud equivalent | AWS Site-to-Site VPN, AWS Client VPN, Tailscale |
④ WAF (Web Application Firewall)#
| Item | Description |
|---|
| Role | Inspect HTTP requests — block L7 attacks such as SQLi, XSS, CSRF |
| Position | In front of web servers |
| Examples | ModSecurity (open source), F5 BIG-IP, Imperva |
| Cloud equivalent | AWS WAF, CloudFront + WAF, Istio EnvoyFilter WAF |
⑤ NAC (Network Access Control)#
| Item | Description |
|---|
| Role | Authenticate and verify endpoints before network access (antivirus, OS patch status, etc.) |
| Examples | Cisco ISE, Genian NAC, ForeScout |
| Cloud equivalent | IAM Identity Center (SSO), conditional access policies |
On-Prem vs Cloud Security Comparison#
| Function | On-Prem Appliance | AWS Cloud |
|---|
| Network firewall | FortiGate, Palo Alto | Security Group + NACL |
| IDS/IPS | Snort, Suricata | GuardDuty + Shield |
| VPN | OpenVPN, WireGuard | Site-to-Site VPN, Client VPN |
| WAF | ModSecurity, F5 | AWS WAF |
| NAC | Cisco ISE, Genian | IAM Identity Center |
| DDoS protection | Dedicated appliance (Arbor etc.) | Shield Standard/Advanced |
| SSL certificates | Manual purchase/renewal | ACM (free, auto-renewal) |
| Logging/audit | SIEM (Splunk, ELK) | CloudTrail + CloudWatch |
| Access control | LDAP/AD + RADIUS | IAM + SSO |
On-Premises → Cloud Connectivity Options#
1. Site-to-Site VPN#
Connect the office firewall to an AWS VPC via an IPSec tunnel.
[Office] [AWS]
FortiGate ─── IPSec tunnel ──── AWS VPN Gateway
10.10.0.0/16 10.0.0.0/16
↓ ↓
Internal servers/PCs EKS, RDS, etc.
| Item | Description |
|---|
| Bandwidth | Up to 1.25 Gbps per tunnel |
| Encryption | IPSec (IKEv2) |
| Cost | ~$36/month per VPN connection |
| Redundancy | 2 tunnels (Active/Standby) |
| Best for | Small to mid-size, fast setup |
2. AWS Direct Connect#
A dedicated physical connection. More stable and faster than VPN.
[Office] ── Dedicated line ── [Direct Connect Location] ── [AWS VPC]
| Item | Description |
|---|
| Bandwidth | 1 Gbps ~ 100 Gbps |
| Latency | Lower and more consistent than VPN |
| Cost | Port fee + data transfer fee (expensive) |
| Best for | Large-scale, latency-sensitive or stability-critical workloads |
3. Client VPN (Individual Access)#
Developers connecting to AWS VPC resources from home or remote locations.
[Developer PC] ── OpenVPN/WireGuard ── [AWS Client VPN Endpoint] ── [VPC internal]
In the PlayBall project, Tailscale/WireGuard was used to connect to the home server (Dev cluster).
Hybrid Architecture Security Checklist#
Network#
Access Control#
Monitoring#
Data Protection#