Question

A financial services company must inspect all north-south traffic leaving its production VPC with a fleet of third-party stateful firewall appliances. Security requires that the appliances see the true 5-tuple of every flow and that traffic is transparently forwarded without the appliances needing to perform source NAT. The networking team wants a solution that scales horizontally, preserves flow symmetry, and integrates with Auto Scaling for the appliance fleet. Which approach meets these requirements with the least operational overhead?

Accepted Answer

Deploy the appliances behind a Gateway Load Balancer, and route VPC egress traffic through Gateway Load Balancer endpoints; the GENEVE encapsulation preserves the original packet for transparent inspection.

Answer

Deploy the appliances behind a Network Load Balancer with TLS passthrough, and use NLB target groups to distribute flows across the appliance fleet.

Answer

Deploy the appliances behind an Application Load Balancer using IP target groups, relying on the X-Forwarded-For header to preserve the client source IP for the appliances.

Answer

Configure each appliance as a next hop in the VPC route table using individual static routes, and use a Lambda function to rewrite routes when Auto Scaling adds or removes an instance.