WAF on AWS

Question

Hello 
 In this document - community.sophos.com/.../122742 
 it says - Other than WAF, no other features are supported on Sophos UTM Auto Scaling. 
 May i know which features are not supported ? 
 Thanks, 
 Steve

Karlos · Accepted Answer

Hi Steve, 
 We do not have an official list, but we&rsquo;d generally recommend using the autoscaling deployment for the following features: 
 
 Webserver Protection 
 Web Protection (using the OGW for traffic distribution) 
 Application control 
 Firewalling and IPS 
 DNAT/Server Load Balancing 
 
 Cheers, Karlos

Karlos · Answer

Hi Steve, 
 I forwarded this question to our AWS team, and this is the answer they provided: 
 The auto scaling deployment model for AWS supports all existing UTM features. There are however a few functionalities that are harder / nonsensical to implement on an autoscaling cluster. 
 For example, implementing client VPNs on an autoscaling cluster will work, but you will introduce significant routing issues due to having multiple individual routers (your workers) represent the same subnet (the SSL VPN clients) with none of the nodes being aware of the other&rsquo;s IP address leases (so duplicate IPs are rampant) or the AWS router being able to accurately determine which worker holds the exact client it wants to send the return traffic to. 
 This is why we recommend not using this functionality on autoscaled clusters, but we have no limitation (licensing or otherwise) in place should you still desire to use it. 
 Similarly, your workers are all capable of running the Wireless Protection features and working as wireless controllers. Doing so makes no sense though as there is no significant performance increase to be gained and your wireless controller architecture is now needlessly complex due to the possibility of a controller suddenly ceasing to exist. 
 And your wireless networks are not connected to each other so being on the same SSID doesn&rsquo;t mean you are actually part of the same network anymore. 
 So in summary, you are not limited by us in what you can use, but the platform and deployment model might limit you in which features you would want to use. 
 Hope that helps, 
 Karlos