Question

A company operates a multi-VPC environment connected through an AWS Transit Gateway. Security policy requires that all traffic between VPCs (east-west) and all traffic to the internet (north-south) pass through a centralized AWS Network Firewall for stateful inspection. The security engineer creates a dedicated inspection VPC with AWS Network Firewall endpoints deployed across Availability Zones. Which routing configuration ensures traffic is correctly directed to the firewall endpoints for inspection without asymmetric routing issues?

Accepted Answer

Attach the inspection VPC to the Transit Gateway using a separate route table, configure spoke VPC routes to send traffic to the Transit Gateway, and use appliance mode on the inspection VPC attachment so return traffic uses the same Availability Zone endpoint.

Answer

Deploy the Network Firewall endpoints directly in each spoke VPC subnet and add security group rules referencing the firewall ENIs to force traffic through inspection.

Answer

Configure the Transit Gateway route table to blackhole all inter-VPC traffic and rely on VPC peering with route tables pointing to the firewall endpoints.

Answer

Enable Transit Gateway multicast and point spoke VPC default routes to the internet gateway, allowing the firewall to inspect mirrored traffic via VPC Traffic Mirroring.