AWS Network Firewall updates default drop action for improved connection reliability

AWS Network Firewall Updates

AWS Network Firewall now uses "Application drop established (server-directed only)" as the default stateful action for all newly created firewall policies, replacing the previous default of "Application drop established (bidirectional)". This change avoids silently dropping legitimate server-to-client TCP packets, such as window updates, keep-alives, and resets, which could cause intermittent connection failures.

No action is required to benefit from this change when creating new policies. However, if your existing environment requires "Application drop established (bidirectional)" to support post-quantum cryptography (PQC) fragmented TLS handshakes, refer to the documentation for guidance on switching to "Application drop established (server-directed only)" or adding the “to_server” flag to your TCP drop rules.

What to do

• Create new policies to benefit from the safer default.
• Review existing policies if you require "Application drop established (bidirectional)" for PQC fragmented TLS handshakes.
• Follow the documentation for guidance on switching to "Application drop established (server-directed only)" or adding the “to_server” flag.

Source: AWS release notes

If you need further guidance on AWS, our experts are available at AWS@westloop.io. You may also reach us by submitting the Contact Us form.