--- title: AWS Network Firewall description: A stateful service that filters traffic at the perimeter of your VPC. breadcrumbs: Docs > Integrations > AWS Network Firewall --- > For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt). # AWS Network Firewall Integration version1.2.0 {% callout %} # Important note for users on the following Datadog sites: us2.ddog-gov.com {% alert level="info" %} To find out if this integration is available in your organization, see your [Datadog Integrations](https://app.datadoghq.com/integrations) page or ask your organization administrator. To initiate an exception request to enable this integration for your organization, email [support@ddog-gov.com](mailto:support@ddog-gov.com). {% /alert %} {% /callout %} ## Overview{% #overview %} AWS Network Firewall is a stateful, service that allows customers to filter traffic at the perimeter of their VPC. Enable this integration to see all of your AWS Network Firewall metrics in Datadog. ## Setup{% #setup %} ### Installation{% #installation %} If you haven't already, set up the [Amazon Web Services integration first](https://docs.datadoghq.com/integrations/amazon_web_services.md). ### Metric collection{% #metric-collection %} 1. In the [AWS integration page](https://app.datadoghq.com/integrations/amazon-web-services), ensure that `Network Firewall` is enabled under the `Metric Collection` tab. 1. Install the [Datadog - AWS Network Firewall integration](https://app.datadoghq.com/integrations/amazon-network-firewall). ### Log collection{% #log-collection %} #### Enable logging{% #enable-logging %} Configure AWS Network Firewall to send logs either to a S3 bucket or to CloudWatch. **Note**: If you log to a S3 bucket, make sure that `amazon_network_firewall` is set as *Target prefix*. #### Send logs to Datadog{% #send-logs-to-datadog %} 1. If you haven't already, set up the [Datadog Forwarder Lambda function](https://docs.datadoghq.com/logs/guide/forwarder.md). 1. Once the Lambda function is installed, manually add a trigger on the S3 bucket or CloudWatch log group that contains your AWS Network Firewall logs in the AWS console: - [Add a manual trigger on the S3 bucket](https://docs.datadoghq.com/logs/guide/send-aws-services-logs-with-the-datadog-lambda-function.md#collecting-logs-from-s3-buckets) - [Add a manual trigger on the CloudWatch Log Group](https://docs.datadoghq.com/logs/guide/send-aws-services-logs-with-the-datadog-lambda-function.md#collecting-logs-from-cloudwatch-log-group) ## Data Collected{% #data-collected %} ### Metrics{% #metrics %} | | | | | **aws.networkfirewall.dns_az_unavailable_flows**(count) | The number of flows that resolved IP validation cannot evaluate because the Availability Zone does not support the feature. | | **aws.networkfirewall.dns_resolution_error_flows**(count) | The number of flows for which resolved IP validation did not complete because of an error. | | **aws.networkfirewall.dns_resolved_flows**(count) | The number of flows for which resolved IP validation confirmed that the destination IP address was one that the Amazon Route 53 Resolver resolved for a domain. | | **aws.networkfirewall.dns_unresolved_flows**(count) | The number of flows for which resolved IP validation ran but the destination IP address was not one that the Amazon Route 53 Resolver resolved for a domain. | | **aws.networkfirewall.dropped_packets**(count) | The number of packets dropped by a firewall rule.*Shown as packet* | | **aws.networkfirewall.invalid_dropped_packets**(count) | The number of packets dropped for failing packet validation due to issues with the packet.*Shown as packet* | | **aws.networkfirewall.other_dropped_packets**(count) | The number of packets dropped for reasons other than firewall rules or packet issues. This includes packets throttled due to bursting traffic.*Shown as packet* | | **aws.networkfirewall.packets**(count) | The number of packets inspected for a firewall policy or stateless rulegroup for which a custom action is defined.*Shown as packet* | | **aws.networkfirewall.passed_packets**(count) | The number of packets forwarded on by the firewall.*Shown as packet* | | **aws.networkfirewall.received_bytes**(count) | The number of bytes received by the firewall.*Shown as byte* | | **aws.networkfirewall.received_packets**(count) | The number of packets received by the firewall.*Shown as packet* | | **aws.networkfirewall.rejected_packets**(count) | The number of packets rejected due to Reject stateful rule actions.*Shown as packet* | | **aws.networkfirewall.stream_exception_policy_packets**(count) | The number of packets matching the firewall policy's stream exception policy.*Shown as packet* | | **aws.networkfirewall.tlsdropped_packets**(count) | The number of packets dropped by the firewall while inspecting SSL or TLS packets.*Shown as packet* | | **aws.networkfirewall.tlserrors**(count) | The number of errors observed by the firewall while inspecting SSL or TLS packets.*Shown as packet* | | **aws.networkfirewall.tlspassed_packets**(count) | The number of packets forwarded on by the firewall while inspecting SSL or TLS packets.*Shown as packet* | | **aws.networkfirewall.tlsreceived_packets**(count) | The number of SSL or TLS packets received by the firewall.*Shown as packet* | | **aws.networkfirewall.tlsrejected_packets**(count) | The number of packets rejected by the firewall while inspecting SSL or TLS packets.*Shown as packet* | | **aws.networkfirewall.tlsrevocation_status_okconnections**(count) | The number of SSL or TLS connections to TLS servers whose certificates have been confirmed as not revoked.*Shown as connection* | | **aws.networkfirewall.tlsrevocation_status_revoked_connections**(count) | The number of SSL or TLS connections to TLS servers whose certificates have been confirmed as revoked.*Shown as connection* | | **aws.networkfirewall.tlsrevocation_status_unknown_connections**(count) | The number of SSL or TLS connections to TLS servers whose certificates' revocation status could not be confirmed.*Shown as connection* | | **aws.networkfirewall.tlstimed_out_connections**(count) | The number of SSL or TLS connections that timed out during SSL or TLS inspection by the firewall.*Shown as connection* | Each of the metrics retrieved from AWS are assigned the same tags that appear in the AWS console, including but not limited to host name, security-groups, and more. ### Events{% #events %} The AWS Network Firewall integration does not include any events. ### Service Checks{% #service-checks %} The AWS Network Firewall integration does not include any service checks. ## Troubleshooting{% #troubleshooting %} Need help? Contact [Datadog support](https://docs.datadoghq.com/help/).