Gateway Load Balancer Centralized Egress Inspection

Internet traffic from the Amazon Elastic Compute Cloud instance in the Application VPC routes through AWS Transit Gateway through the VPC-TGW spoke attachment. The TGW spoke route table routes traffic to the Inspection VPC.

Traffic enters the Inspection VPC on the Transit Gateway attachment subnet.

The TGW attachment subnet route table routes the traffic to the Gateway Load Balancer endpoint in the same Availability Zone.

The Gateway Load Balancer endpoint forwards the traffic to Gateway Load Balancer. Gateway Load Balancer encapsulates the traffic in Generic Network Virtualization Encapsulation (GENEVE).

GENEVE-encapsulated traffic routes to the security appliance for inspection.

After inspection completes, the traffic returns to Gateway Load Balancer and then to the Gateway Load Balancer endpoint.

Gateway Load Balancer routes the inspected traffic to the NAT Gateway in the same Availability Zone. The source IP changes to the NAT Gateway IP.

The NAT Gateway routes internet traffic to the internet gateway. Traffic leaves for the internet through the internet gateway.

Return traffic from the internet routes to the NAT Gateway by the internet gateway.

The NAT Gateway sends return traffic to the Gateway Load Balancer endpoint in accordance with the NAT Gateway route table.

The Gateway Load Balancer endpoint sends the return traffic to Gateway Load Balancer, which encapsulates traffic in GENEVE.

GENEVE-encapsulated return traffic routes to the security appliance for inspection.

After the return traffic inspection completes, it returns to Gateway Load Balancer and then to the Gateway Load Balancer endpoint.

Return traffic routes to the Transit Gateway attachment following the Security Appliance route table.

Return traffic routes back to App VPC 1 through the TGW inspection route table.

Return traffic arrives in App VPC 1 from AWS Transit Gateway and routes locally to the source Amazon EC2 instance.