Question

A company runs a fleet of third-party firewall appliances that must inspect all north-south traffic entering and leaving several application VPCs. The security team wants to centralize these appliances in a dedicated inspection VPC, scale them horizontally, and preserve flow symmetry so that both directions of a connection hit the same appliance. Application teams must not manage the appliances directly. Which implementation meets these requirements?

Accepted Answer

Deploy a Gateway Load Balancer in the inspection VPC fronting the appliances, expose it via a GWLB endpoint (Gateway Load Balancer Endpoint) in each application VPC, and route traffic through the endpoint using route tables.

Answer

Deploy a Network Load Balancer in front of the appliances and update application VPC route tables to point the default route at the NLB's private IP addresses.

Answer

Place the appliances behind an Application Load Balancer in the inspection VPC and use VPC peering plus security groups to force application traffic through the ALB.

Answer

Attach the appliances to a Transit Gateway and rely on TGW appliance-mode disabled routing to distribute connections across the appliance ENIs.