AWS Network Firewall Updates Stateful Drop Action to Prevent Silent TCP Connection Outages

AWS has implemented a significant refinement to the default evaluation logic in AWS Network Firewall across all commercial regions. Newly provisioned firewall policies now default to 'Application drop established (server-directed only)', replacing the legacy 'Application drop established (bidirectional)' mechanism. Under this new default, stateful rule processing drops non-compliant client-to-server application traffic while allowing vital transport-layer return packets—such as TCP window updates, keep-alives, and connection resets—to pass safely back to clients. For DevOps practitioners and cloud networking engineers, bidirectional packet dropping inside deep packet inspection engines has long been a notorious cause of intermittent connection failures and phantom outages. Under previous defaults, when stateful policies dropped traffic bidirectionally, critical server-to-client control packets were stripped from the stream. This behavior resulted in half-open sockets, client retry storms, and subtle connection stalls that defied standard application logs. By scoping application-level drop actions strictly to the server-bound flow, AWS eliminates these elusive transport anomalies while preserving robust perimeter filtering across Amazon VPCs. This update highlights a broader evolutionary trend in cloud network security: reconciling deep application inspection with modern transport complexity. As enterprises shift from standalone virtual appliances to managed, cloud-native firewall fabrics deployed across AWS Transit Gateway architectures, inspection layers must maintain protocol fidelity at scale. Moreover, modern cryptographic transitions—specifically the rollout of post-quantum cryptography (PQC) suites featuring larger key exchanges and multi-packet TLS handshakes—require firewalls to navigate fragmented, multi-stage sessions without prematurely severing valid flow state. In practice, newly created firewall policies automatically inherit the server-directed drop behavior with zero operational friction. For existing policies, however, AWS retains the prior configuration to avoid breaking changes, meaning administrators must proactively plan updates. Network and security operations teams should review their Suricata-compatible rule sets, assess whether current workloads experience unexplained TCP connection resets, and transition existing policies to the server-directed model. Teams utilizing specialized bidirectional rules for fragmented cryptographic handshakes should ensure appropriate directional flags, such as 'to_server', are explicitly configured to prevent unintended packet drops.