Question

A company routes all outbound internet traffic from a production VPC through AWS Network Firewall for stateful inspection. The VPC spans three Availability Zones with workloads in private subnets in each AZ. During a recent AZ impairment, all outbound traffic from the two healthy AZs also failed, causing a full application outage. The security team confirms the firewall policy and rules were correct. What is the MOST likely cause and the correct design to prevent recurrence?

Accepted Answer

A single firewall endpoint was deployed in one AZ and all private subnet route tables pointed to it; deploy a firewall endpoint subnet in each AZ and point each AZ's route table to its local endpoint

Answer

Network Firewall does not support multi-AZ deployments; replace it with a fleet of self-managed inspection appliances behind a Gateway Load Balancer

Answer

The stateful engine lost session state during the impairment; enable strict rule ordering and increase the flow timeout to preserve sessions across AZs

Answer

The firewall policy was attached to only one subnet's NACL; attach the same NACL to all subnets in every AZ