Question

A security team must inspect all north-south internet traffic for a fleet of VPCs using a specialized third-party intrusion prevention system (IPS) appliance that the company already licenses. The appliance must be deployed horizontally scalable behind a load balancer, with traffic transparently redirected to it for deep packet inspection before reaching the internet, while preserving the original source and destination IP addresses. Which AWS service should the team use to integrate this third-party appliance into the traffic path?

Accepted Answer

Deploy the appliances behind a Gateway Load Balancer and use GWLB endpoints with route table redirection to send traffic through the appliances using GENEVE encapsulation

Answer

Deploy AWS Network Firewall in a central inspection VPC and configure stateful rule groups to forward matched traffic to the third-party appliance

Answer

Place the appliances behind a Network Load Balancer and use security group references to force all VPC traffic through the appliance ENIs

Answer

Deploy the appliances behind an Application Load Balancer and use AWS WAF to route inspected Layer 7 traffic to the appliance target group