Question

A company deploys a fleet of third-party firewall appliances behind a Gateway Load Balancer (GWLB) to inspect north-south traffic for a set of application VPCs. During testing, engineers observe that some TCP sessions inspected by the firewalls are being dropped intermittently, while others pass cleanly. Packet captures on the appliances show that return packets for the affected flows are arriving at a different appliance than the one that processed the initial forward packets. Which GWLB configuration change will resolve the dropped sessions?

Accepted Answer

Enable flow stickiness on the GWLB target group using an appropriate flow-hashing algorithm (5-tuple, 3-tuple, or 2-tuple) so both directions of a flow map to the same appliance.

Answer

Increase the health check interval on the GWLB target group so appliances are not marked unhealthy during inspection spikes.

Answer

Enable cross-zone load balancing on the GWLB so traffic is distributed evenly across appliances in all Availability Zones.

Answer

Switch the GWLB listener from the GENEVE protocol to TCP so the load balancer can track connection state per session.