How to get Autoscale VMs to only receive traffic from VNF?

[btzq]

Hi Community,

Our company widely uses Autoscale Feature for our VMs. However, most of our customers prioritise security and we have identified that there is a need to put a VNF (eg. PFsense Firewall) infront of our Autoscale Groups to filter malicious traffic before hitting the VMs.

I previously raise this ticket discussion but it seems that more discussion is needed and it will take more time to come to a conclusion. We have a need for a more immediate solution: #9158

So what we are thinking, is to have a VPC (will multiple networks), have a VNF Pfsense Firewall there, and somehow get our Autoscale VMs in the 'Internet Network Tier' to only receive incoming traffic from the VNF PFsense Firewall.

Illustration below:

But, we arent sure how we can get the Autoscale VMs to do just that. Any ideas? Thank you.

[DaanHoogland]

@btzq did you find an answer to this somehow? (it seems not supported to me, but there might be workarounds)

[btzq]

@DaanHoogland no unfortunately. But if there 'User Defined Static Routes' feature is built, then we can achieve a workaround for this...

[DaanHoogland]

So you would want to add a static route to the VR to point to your VNF appliance?

cc @weizhouapache , given the static routes feature for VPNs/Private Gateways; Do you think this is far fetched/hard to design/implement?
cc @alexandremattioli

[weizhouapache]

@DaanHoogland
the code for static routes is done as part of new network plugin

what's the feasible ACS version of the new plugin ?
cc @nvazquez @Pearl1594 @alexandremattioli