Traffic Mirroring, IPv6 and Network Firewall

By the end of this lesson you will be able to

• Set up VPC Traffic Mirroring from its four parts (source ENI, target, filter, session), explain the VXLAN copy on UDP 4789, and know its limits: Nitro-based sources, three sessions per ENI, dropped copies under load, inbound packets dropped by a security group never mirrored.
• Tell VPC Flow Logs, Traffic Mirroring and AWS Network Firewall apart when a question says “deep packet inspection”, “IDS” or “IPS”.
• Read, write and shorten IPv6 addresses, and explain why the IPv6 addresses AWS gives a VPC are public and globally unique, and what changed with private IPv6 in 2024.
• Run a dual-stack VPC: the /56 and /64 defaults, the sizes allowed with IPAM, why IPv4 can never be switched off, and the “cannot launch an instance” trap.
• Give private IPv6 instances outbound-only internet access with an egress-only internet gateway, and build IPv6 route tables without the classic mistakes (::/0 to a NAT gateway, ::/0 to the internet gateway in a private subnet).
• Protect a whole VPC with AWS Network Firewall: stateless and stateful rule groups, domain lists, Suricata-compatible IPS rules, firewall subnets and endpoints, ingress routing, centralised inspection with a Transit Gateway, logs and pricing.

#Three last tools for the VPC

The last lessons connected VPCs to each other and to data centres. This one finishes the chapter with three things that live inside a VPC and appear in many exam questions:

• Seeing the real packets. Flow logs (lesson 22.3) tell you who talked to whom and whether it was accepted. A security team hunting an intrusion needs the payload itself. That is VPC Traffic Mirroring.
• IPv6. IPv4 addresses ran out years ago and now cost money on AWS (lesson 3.6). Mobile networks in Bangladesh and abroad hand phones IPv6 addresses. A VPC can run IPv4 and IPv6 side by side, and needs a different “one-way door” for private IPv6 servers: the egress-only internet gateway.
• Firewalling the whole VPC. Security groups and network ACLs (lesson 3.5) only see addresses and ports. Blocking a domain name, or an exploit hidden in a packet, takes AWS Network Firewall.

#VPC Traffic Mirroring

VPC Traffic Mirroring copies the packets that pass through an elastic network interface (ENI) of an EC2 instance, exactly as they are, and sends the copies to a security or monitoring appliance that you run. The instance and its application never notice.

#Flow logs see the envelope, mirroring sees the letter

A flow log is like the courier company's register: sender, receiver, weight, delivered or returned. Traffic Mirroring photocopies every letter before it is delivered. The register cannot tell you that a letter contained a forged cheque; the photocopy can.

#The four parts

1. Source

   The ENI whose traffic you want to copy, usually the primary interface of an EC2 instance. Sources must be on Nitro-based instance types (plus a short list of older non-Nitro families such as C4, M4, R4 and I3). One ENI can be the source of at most three sessions.

2. Target

   Where the copies go: another ENI (one appliance instance), a Network Load Balancer with a UDP listener on port 4789, or a Gateway Load Balancer endpoint (appliances in another VPC, often a security account; lesson 6.3). AWS recommends the NLB or GWLB endpoint for high availability. The target can be in another VPC reached through peering or a Transit Gateway, and in another account.

3. Filter

   Which packets to copy: inbound and outbound rules with accept or reject, matching protocol, source and destination CIDR, and port ranges (up to 10 rules per filter). For example: copy only TCP 80 and 443, or only traffic to the database subnet. Without a matching accept rule, nothing is copied. A filter never changes what happens to the real traffic.

4. Session

   Ties a source, a target and a filter together, with a priority (when several sessions use one source), an optional packet length (copy only the first bytes of each packet, for example just the headers) and a VXLAN network identifier, the VNI, so the tool can tell sessions apart.

#How the copy travels

The copy is made by the Nitro card that runs the ENI, not by the operating system: there is no agent to install and the application's CPU and memory do no extra work. Each copy is wrapped in VXLAN (UDP port 4789) and routed through the VPC to the target like any other packet, so:

• the target's security group must allow UDP 4789 from the source, and the VPC route tables must reach the target;
• the monitoring software must understand VXLAN (Suricata, Zeek, Wireshark and most commercial tools do);
• the copy is out of band: nothing waits for it, so the monitoring tool can alert but can never block.

#Limits worth knowing

• It is not free for the instance. Mirrored packets count toward the source instance's network bandwidth: mirroring 1 Gbps in and 1 Gbps out means 4 Gbps through its network card. When the instance hits its bandwidth or packets-per-second limit, AWS drops the mirrored packets first, so production traffic keeps priority. The notes' “no performance impact” is right about CPU and latency; size the instance for the copies.
• Dropped inbound traffic is not mirrored. A packet that the source's inbound security group or network ACL rejects never becomes a copy. Outbound copies are not subject to the outbound security group rules.
• Not everything is copied. ARP, DHCP, the instance metadata service, NTP and Windows activation traffic are never mirrored, and flow logs do not record the mirrored copies themselves.
• Big packets are truncated when the target is a single instance and the copy plus the 54-byte VXLAN overhead (74 bytes over IPv6) exceeds the target's MTU. Not supported in IPv6-only subnets.
• Cost: an hourly charge per source ENI with an active session (about 0.015 USD in us-east-1), plus normal data transfer for the copies, for example cross-AZ to the target.
• Encryption: most traffic today is TLS. The IDS needs the server's keys, or you mirror traffic that is still clear inside the VPC (after a load balancer terminates TLS), or you settle for headers and TLS metadata.

#Flow logs, mirroring or Network Firewall?

The notes give “deep packet inspection” as the keyword for Traffic Mirroring, and later for Network Firewall too. Both are right, because they inspect in different places:

Read the verb in the question: monitor, analyse, detect, capture points to mirroring; block, prevent, filter, allow only points to Network Firewall.

#IPv6 in one page

#Why IPv6

IPv4 addresses are 32 bits long: about 4.3 billion, and the regional registries handed out their last free blocks years ago. IPv6 addresses are 128 bits, about 3.4 × 10^38 addresses, enough to give one to every grain of sand on Earth many times over, as the notes put it.

#Writing an address

An IPv6 address is written as eight groups of four hexadecimal digits, separated by colons, each group 16 bits (0000 to ffff):

2001:0db8:85a3:0000:0000:8a2e:0370:7334

Two rules shorten it:

1. Leading zeros in a group can be dropped: 0db8 → db8, 0370 → 370, 0000 → 0.
2. One run of consecutive all-zero groups can be replaced by ::, only once per address (otherwise you could not tell how many groups each :: hides).

So the example becomes 2001:db8:85a3::8a2e:370:7334. More examples:

2001:db8::/32 is reserved for documentation, so every made-up address in this course comes from it. Prefixes work like IPv4 CIDR (lesson 3.1): a /56 fixes the first 56 bits and leaves 72 bits to the network.

#Why IPv6 in AWS is “public”

IPv4 has the RFC 1918 private ranges (10.x, 172.16.x, 192.168.x) and NAT to share public addresses. IPv6 was designed so that every device can have a globally unique address and NAT is not needed. The IPv6 blocks that Amazon gives a VPC are ordinary global unicast addresses (GUA), advertised to the internet: every Amazon-provided IPv6 address is public and internet-routable. That is why protecting IPv6 instances is a question of routing and filtering, not of hiding them behind NAT.

Because those blocks are allocated by Amazon from its own pool, they never overlap another VPC's or your data centre's: the exam's answer to “a globally unique address that will never overlap another network” is IPv6.

#IPv6 in a VPC: dual stack

A VPC can run dual stack: IPv4 and IPv6 in the same VPC and the same subnets. You associate an IPv6 block with the VPC, give each subnet a piece of it, and instances get an IPv6 address next to their private IPv4 one.

#Sizes

A /56 holds 256 subnets of /64, and each /64 holds 2^64, about 18 quintillion, addresses. AWS reserves five addresses in each IPv6 subnet, as in IPv4 (lesson 3.2). The notes' “/56, cannot be customised” and “each subnet must be /64” describe the Amazon-provided defaults, which is what the exam means.

#IPv4 cannot be switched off

• Every VPC must have an IPv4 CIDR; IPv6 is an addition. You cannot create an IPv6-only VPC.
• In a dual-stack subnet every instance still gets a private IPv4 address. The instance can then talk to the internet over either protocol through the same internet gateway, which handles both.

This gives the exam's troubleshooting question (slide p765): an instance cannot be launched in a dual-stack subnet. It is never because IPv6 ran out; a /64 is effectively endless. It is because the subnet has no free IPv4 addresses. The fix is more IPv4 space: add a secondary IPv4 CIDR to the VPC and create a new subnet from it (a subnet's own IPv4 range cannot be resized).

#Egress-only internet gateway

In IPv4, a private server reaches the internet through a NAT gateway (lesson 3.4): it has only a private address, and the NAT gateway translates it, so nobody outside can start a connection to it. In IPv6 the server's address is already public, and there is no NAT. How do you let it download patches without exposing it?

The egress-only internet gateway (EIGW) is the answer:

• It works for IPv6 only.
• It lets instances start connections to the internet over IPv6, and lets the replies back in: it is stateful, it remembers the connections that went out.
• It drops every connection the internet tries to start.
• It translates nothing: packets keep the instance's own IPv6 address.
• It is attached to the VPC and used through a route: ::/0 → eigw-… in the private subnet's route table.
• It has no hourly charge; you pay only normal data transfer. It has no security group; the instances' security groups and the subnet's network ACL still apply.

#IPv6 routing

IPv6 routing works like IPv4 routing (lesson 3.3), with the IPv6 default route written ::/0 (two colons and a zero) instead of 0.0.0.0/0. A dual-stack VPC has one local route per CIDR and one default route per protocol:

The trap in screenshot questions: a NAT gateway is never the target of ::/0. If the target is a NAT gateway, the destination must be an IPv4 range (normally 0.0.0.0/0). The other trap is quieter: ::/0 → igw-… in a “private” subnet works for downloads, so nobody notices that the servers are now reachable from the internet over IPv6. Remember also that security groups and network ACLs need separate IPv6 rules: a rule for 0.0.0.0/0 does not cover ::/0.

#Protecting a whole VPC

The protections seen so far each guard one layer or one resource:

None of them can say “these servers may reach *.ubuntu.com and nothing else”, or “drop any packet carrying this exploit, whatever port it uses”, for all traffic entering and leaving a VPC: to and from the internet, other VPCs, Direct Connect and Site-to-Site VPN. That is the gap AWS Network Firewall fills.

#AWS Network Firewall

AWS Network Firewall is a managed, stateful network firewall and intrusion prevention system (IPS) for VPCs, inspecting from layer 3 to layer 7. AWS runs and scales it; you write the rules and steer traffic through it with route tables. It can inspect traffic in any direction: VPC to VPC, outbound to the internet, inbound from the internet, and to or from Direct Connect and Site-to-Site VPN.

Under the hood each firewall endpoint is a Gateway Load Balancer endpoint in front of an AWS-managed fleet (lesson 6.3), so capacity and high availability are AWS's problem, not yours. Think of it as “GWLB with appliances, but AWS provides and manages the appliances”.

#The pieces

• A firewall is placed in a VPC, with one firewall endpoint per Availability Zone, each in a small dedicated firewall subnet (a /28 is enough). Do not put your workloads in those subnets.
• A firewall policy says which rule groups run, in which order, and what to do with traffic no rule matched.
• Rule groups come in two kinds:
  • Stateless rule groups look at each packet alone, by 5-tuple (and TCP flags), in priority order. Actions: pass, drop, or forward to the stateful engine. Use them for fast, coarse filtering; the usual default is “forward everything to stateful”.
  • Stateful rule groups track connections, so replies are handled correctly. Three ways to write them: 5-tuple rules (like a security group, but with deny and logging), domain lists (allow or deny *.ubuntu.com, .facebook.com…, matched on the TLS SNI or the HTTP Host header, without decrypting), and Suricata-compatible rules (the open-source IPS rule language: patterns in payloads, protocols such as blocking SMB outbound, regular expressions). Actions: pass, drop, reject (drop and send a TCP reset), alert.
• AWS managed rule groups: domain and IP lists of known malware and botnet hosts, and threat signature groups (exploits, malware, scanners) kept current by AWS, which you add like your own.
• Logs: alert logs (what matched a rule), flow logs (every flow the firewall saw) and TLS logs, sent to S3, CloudWatch Logs or Amazon Data Firehose (the slides use the old name, Kinesis Data Firehose).

#Steering traffic through the endpoints

Network Firewall only inspects what routing sends to it. In a single VPC with internet access, three route tables do the work:

The third one is ingress routing: a route table associated with the internet gateway, so even traffic arriving from the internet must pass the firewall. Use one firewall endpoint per AZ and keep each AZ's routes pointing to its own endpoint: both directions of a flow must cross the same endpoint, or the stateful engine drops the half it does not recognise (asymmetric routing). Network Firewall does not translate addresses; when private instances need the internet, the NAT gateway sits after the firewall, and the protected subnet's 0.0.0.0/0 still points at the firewall.

#Managing and paying for it

• Firewall Manager creates Network Firewall policies and endpoints across all accounts and VPCs of an Organization, as the notes say (lesson 21.6 covers how).
• Price, for orientation in us-east-1: about 0.395 USD per firewall endpoint per hour (per AZ) plus 0.065 USD per GB processed. When a NAT gateway is chained behind the firewall, its hourly and per-GB charges are waived for the matching endpoint hours. Two AZs running all month cost roughly 575 USD before traffic, so one shared, central firewall is common.

#Centralised inspection with a Transit Gateway

With many VPCs, a firewall in each one is expensive and hard to keep consistent. The common pattern is an inspection VPC: every spoke VPC, the Site-to-Site VPN and Direct Connect attach to a Transit Gateway (lesson 22.6); the spoke route table sends everything to the inspection VPC attachment; the firewall inspects east-west (VPC to VPC) and north-south (to the internet) traffic, and a central NAT gateway gives the whole company one set of outbound addresses. The inspection VPC's Transit Gateway attachment uses appliance mode, so both directions of a flow stay on the same AZ's endpoint.

#Which tool?

#What goes wrong

• The IDS receives nothing: the NLB has no UDP 4789 listener, the target's security group blocks UDP 4789, the source subnet's route table cannot reach the target, or the filter has no accept rule. Mirroring fails silently.
• Mirror session cannot be created: the source instance type is not supported (not Nitro-based and not on the short non-Nitro list), or the ENI already has three sessions.
• The IDS misses attacks during busy hours: the source instance is at its bandwidth limit and mirrored packets are dropped first. Use a bigger instance or filter more tightly.
• The IDS sees only gibberish: the traffic is TLS. Mirror behind the TLS termination point, or give the tool the keys.
• “Cannot launch an instance” in a dual-stack subnet: the subnet ran out of IPv4 addresses, not IPv6. Add an IPv4 CIDR to the VPC and a new subnet.
• IPv6 clients time out while IPv4 works: the security group or network ACL allows 0.0.0.0/0 but has no ::/0 rule, or the subnet has no ::/0 route, or DNS has no AAAA record.
• ::/0 → nat-… is rejected: NAT gateways are IPv4 only. Use an egress-only internet gateway (or 64:ff9b::/96 for NAT64).
• “Private” IPv6 servers are reachable from the internet: their subnet has ::/0 → igw-…. Point it at the egress-only gateway.
• Peering refused although IPv6 ranges differ: the IPv4 CIDRs overlap; IPv6 does not rescue peering.
• Network Firewall rules have no effect: no route sends traffic to the firewall endpoint, or the workloads sit in the firewall subnet itself.
• Connections hang after a routing change: asymmetric routing; one direction bypasses the firewall or crosses another AZ's endpoint. Fix the routes; turn on appliance mode on the Transit Gateway attachment.
• Inbound traffic is not inspected: the internet gateway has no edge-associated route table sending the subnet's CIDR to the firewall endpoint.

#In system design

Patterns to remember:

• Egress filtering: workload subnets → Network Firewall (domain allow list) → NAT gateway → internet gateway. Stops data being sent to unknown sites and malware calling home.
• Ingress inspection: IGW edge route table → firewall endpoint → public subnet (or an ALB with WAF for HTTP).
• Hub-and-spoke inspection: spokes → Transit Gateway → inspection VPC (appliance mode) → back, or out through a central NAT gateway.
• Out-of-band monitoring: Traffic Mirroring → NLB or GWLB endpoint → IDS fleet in a security account; flow logs for the cheap, permanent record.
• IPv6 adoption: dual stack first (IPv4 stays), Amazon /56 per VPC, /64 per subnet, ::/0 → eigw for private subnets, separate IPv6 rules in security groups and network ACLs; IPv6-only subnets with DNS64 and NAT64 where IPv4 is scarce.

#Try it yourself

These commands use the AWS CLI v2 in ap-south-1. Traffic Mirroring, NAT gateways and Network Firewall endpoints are billed per hour: delete what you create.

# 1. Traffic Mirroring: target (an NLB with a UDP 4789 listener), filter, rule, session
aws ec2 create-traffic-mirror-target \
  --network-load-balancer-arn arn:aws:elasticloadbalancing:ap-south-1:111122223333:loadbalancer/net/ids-nlb/0a1b2c3d4e5f6789 \
  --description "IDS fleet"
# { "TrafficMirrorTarget": { "TrafficMirrorTargetId": "tmt-0a1b2c3d4e5f67890", "Type": "network-load-balancer", ... } }

aws ec2 create-traffic-mirror-filter --description "HTTPS only"
# { "TrafficMirrorFilter": { "TrafficMirrorFilterId": "tmf-0b1c2d3e4f5a67890", ... } }

aws ec2 create-traffic-mirror-filter-rule --traffic-mirror-filter-id tmf-0b1c2d3e4f5a67890 \
  --traffic-direction ingress --rule-number 100 --rule-action accept --protocol 6 \
  --destination-port-range FromPort=443,ToPort=443 \
  --source-cidr-block 0.0.0.0/0 --destination-cidr-block 0.0.0.0/0
aws ec2 create-traffic-mirror-filter-rule --traffic-mirror-filter-id tmf-0b1c2d3e4f5a67890 \
  --traffic-direction egress --rule-number 100 --rule-action accept --protocol 6 \
  --source-port-range FromPort=443,ToPort=443 \
  --source-cidr-block 0.0.0.0/0 --destination-cidr-block 0.0.0.0/0

aws ec2 create-traffic-mirror-session --network-interface-id eni-0c1d2e3f4a5b67890 \
  --traffic-mirror-target-id tmt-0a1b2c3d4e5f67890 --traffic-mirror-filter-id tmf-0b1c2d3e4f5a67890 \
  --session-number 1 --virtual-network-id 101
# { "TrafficMirrorSession": { "TrafficMirrorSessionId": "tms-0d1e2f3a4b5c67890", "VirtualNetworkId": 101, ... } }

# On an IDS instance: the copies arrive as VXLAN on UDP 4789
sudo tcpdump -ni eth0 -c 2 udp port 4789
# 10:42:07.112 IP 10.20.1.15.61253 > 10.20.3.40.4789: VXLAN, flags [I] (0x08), vni 101
# IP 198.51.100.20.53122 > 10.20.1.15.443: Flags [S], seq 2087316431, win 64240, length 0

# 2. Dual stack: an Amazon-provided /56 for the VPC, a /64 for a subnet
aws ec2 associate-vpc-cidr-block --vpc-id vpc-0a1b2c3d4e5f67890 --amazon-provided-ipv6-cidr-block
# { "Ipv6CidrBlockAssociation": { "Ipv6CidrBlock": "", "Ipv6CidrBlockState": { "State": "associating" } }, ... }
aws ec2 describe-vpcs --vpc-ids vpc-0a1b2c3d4e5f67890 \
  --query 'Vpcs[0].Ipv6CidrBlockAssociationSet[0].Ipv6CidrBlock' --output text
# 2001:db8:1234:1a00::/56
aws ec2 associate-subnet-cidr-block --subnet-id subnet-0b1c2d3e4f5a67890 \
  --ipv6-cidr-block 2001:db8:1234:1a02::/64
aws ec2 modify-subnet-attribute --subnet-id subnet-0b1c2d3e4f5a67890 --assign-ipv6-address-on-creation

# 3. Egress-only internet gateway and the private subnet's IPv6 default route
aws ec2 create-egress-only-internet-gateway --vpc-id vpc-0a1b2c3d4e5f67890
# { "EgressOnlyInternetGateway": { "EgressOnlyInternetGatewayId": "eigw-0a9b8c7d6e5f43210", ... } }
aws ec2 create-route --route-table-id rtb-0c1d2e3f4a5b67890 \
  --destination-ipv6-cidr-block ::/0 --egress-only-internet-gateway-id eigw-0a9b8c7d6e5f43210

# The classic mistake, refused by the API
aws ec2 create-route --route-table-id rtb-0c1d2e3f4a5b67890 \
  --destination-ipv6-cidr-block ::/0 --nat-gateway-id nat-0f1e2d3c4b5a69780
# An error occurred (InvalidParameterValue) ... (a NAT gateway takes only IPv4 routes, or 64:ff9b::/96 for NAT64)

# From the private instance
curl -6 -s -o /dev/null -w "%{http_code}\n" https://archive.ubuntu.com/
# 200
ping -6 -c 2 2001:db8:1234:1a02::456      # from a laptop on the internet
# 2 packets transmitted, 0 received, 100% packet loss

Save as domains.json (a stateful domain allow list):

{
  "RulesSource": {
    "RulesSourceList": {
      "Targets": [".ubuntu.com", ".microsoft.com", "rajshahi-college.example"],
      "TargetTypes": ["TLS_SNI", "HTTP_HOST"],
      "GeneratedRulesType": "ALLOWLIST"
    }
  }
}

# 4. Network Firewall: rule group, policy, firewall with one endpoint per AZ
aws network-firewall create-rule-group --rule-group-name lab-allowed-domains --type STATEFUL \
  --capacity 100 --rule-group file://domains.json
aws network-firewall create-firewall-policy --firewall-policy-name lab-policy --firewall-policy '{
  "StatelessDefaultActions": ["aws:forward_to_sfe"],
  "StatelessFragmentDefaultActions": ["aws:forward_to_sfe"],
  "StatefulRuleGroupReferences": [
    { "ResourceArn": "arn:aws:network-firewall:ap-south-1:111122223333:stateful-rulegroup/lab-allowed-domains" },
    { "ResourceArn": "arn:aws:network-firewall:ap-south-1:aws-managed:stateful-rulegroup/ThreatSignaturesExploitsStrictOrder" } ],
  "StatefulEngineOptions": { "RuleOrder": "STRICT_ORDER" },
  "StatefulDefaultActions": ["aws:drop_established", "aws:alert_established"] }'
aws network-firewall create-firewall --firewall-name lab-fw --vpc-id vpc-0a1b2c3d4e5f67890 \
  --firewall-policy-arn arn:aws:network-firewall:ap-south-1:111122223333:firewall-policy/lab-policy \
  --subnet-mappings SubnetId=subnet-0f1a2b3c4d5e67890 SubnetId=subnet-0e1f2a3b4c5d67890
aws network-firewall describe-firewall --firewall-name lab-fw \
  --query 'FirewallStatus.SyncStates.*.Attachment.EndpointId'
# [ "vpce-0123456789abcdef0", "vpce-0fedcba9876543210" ]

# 5. Steer traffic: protected subnet → firewall, IGW edge route back through the firewall
aws ec2 create-route --route-table-id rtb-0aaa1111bbbb22223 \
  --destination-cidr-block 0.0.0.0/0 --vpc-endpoint-id vpce-0123456789abcdef0
aws ec2 associate-route-table --route-table-id rtb-0ccc3333dddd44445 --gateway-id igw-0a1b2c3d4e5f67890
aws ec2 create-route --route-table-id rtb-0ccc3333dddd44445 \
  --destination-cidr-block 10.0.1.0/24 --vpc-endpoint-id vpce-0123456789abcdef0

# 6. Test from a lab server
curl -s -o /dev/null -w "%{http_code}\n" https://archive.ubuntu.com/
# 200
curl -s -m 5 https://bet.example/ || echo "blocked"
# blocked

Also try in the console: open the firewall's Monitoring tab after step 6, then send alert logs to a CloudWatch Logs group and query it with Logs Insights (lesson 19.4). Clean up with delete-traffic-mirror-session, delete-firewall (after removing the routes to its endpoints), and delete-egress-only-internet-gateway.

#Summary

Key takeaways

• Traffic Mirroring copies whole packets (payload included) from a source ENI (Nitro-based instances) to a target (ENI, NLB with UDP 4789, or GWLB endpoint), chosen by a filter, in a session (priority, packet length, VNI). Copies travel in VXLAN, UDP 4789, made by the Nitro card: no agent, no CPU cost, out of band (it can alert, never block). Limits: 3 sessions per ENI, copies count toward instance bandwidth and are dropped first, inbound packets dropped by the SG or NACL are not mirrored.
• Flow logs = metadata, Traffic Mirroring = passive copy, Network Firewall = inline, can block. “DPI” fits mirroring (detect) and Network Firewall (prevent).
• IPv6: 128 bits, eight hex groups; drop leading zeros, one :: per address; ::/0 is the default route; 2001:db8::/32 is for examples. Amazon-provided IPv6 is public and globally unique (exam answer); private IPv6 (ULA, non-advertised GUA) exists through IPAM since 2024.
• Dual stack: VPC /56, subnet /64 by default (/44–/60 and /44–/64 with IPAM or BYOIP). IPv4 cannot be disabled: a failed launch in a dual-stack subnet means no free IPv4, so add an IPv4 CIDR. Peering still needs non-overlapping IPv4. IPv6-only subnets exist (side note).
• Egress-only internet gateway: IPv6 only, stateful, outbound connections and their replies allowed, inbound connections dropped, no translation, no hourly fee. IPv4 → NAT gateway, IPv6 → EIGW.
• Routes: public ::/0 → igw, private ::/0 → eigw; a NAT gateway never takes ::/0 (only 0.0.0.0/0, or 64:ff9b::/96 for NAT64 with DNS64). Security groups and NACLs need their own ::/0 rules.
• AWS Network Firewall: managed, stateful, layer 3–7 firewall + IPS; stateless and stateful rule groups (5-tuple, domain lists on SNI/Host, Suricata rules), AWS managed threat signatures, TLS inspection; firewall endpoints in dedicated subnets per AZ, route tables (incl. IGW edge ingress routing) steer traffic, symmetric routing required; built on GWLB; logs to S3, CloudWatch Logs, Firehose; central inspection VPC with Transit Gateway (appliance mode; native attachment since 2025); managed across accounts by Firewall Manager; ~0.395 USD per endpoint-hour + 0.065 USD per GB.

Self-check: Traffic Mirroring, IPv6 and Network Firewall30 questions