Question

A security engineer deploys AWS Network Firewall in a dedicated inspection subnet to centrally filter egress traffic from several spoke VPCs connected via a transit gateway. After deployment, users report that some outbound connections intermittently fail, while others succeed. VPC Flow Logs show that return traffic for the failing flows is bypassing the firewall endpoint and being dropped by the stateful engine as unsolicited. What is the MOST likely root cause and the correct remediation?

Accepted Answer

The route tables create asymmetric routing where forward and return packets do not both traverse the firewall endpoint; fix by ensuring the inspection subnet, transit gateway attachment, and IGW route tables all route symmetrically through the same firewall endpoint in the same Availability Zone.

Answer

The Network Firewall policy is missing a stateless default action; set the stateless default action to 'forward to stateful rules' to allow the return packets.

Answer

The security group on the firewall endpoint is dropping return traffic; add an explicit inbound allow rule for ephemeral ports since Network Firewall endpoints are not stateful.

Answer

The stateful rule group is evaluating in strict order and blocking established connections; change the rule order evaluation to 'default action order' so established flows are permitted.