AWS Certified Advanced Networking – Specialty (ANS-C01)Network ImplementationHard
A network architect is designing a highly secure network for a financial services application. All outbound internet traffic from private subnets must be inspected by a third-party firewall appliance running on an EC2 instance before reaching the Internet Gateway. The solution must be highly available and scale automatically. Which AWS service should be used to route traffic through the firewall appliance transparently?
- AVPC Peering with a centralized firewall VPC
- BAWS Transit Gateway with appliance mode
- CNAT Gateway with a custom routing table
- DGateway Load Balancer (GWLB)
Show answer & explanationAnswer & explanation
Correct answer: D. Gateway Load Balancer (GWLB)
Gateway Load Balancer (GWLB) is specifically designed to transparently deploy, scale, and manage virtual network appliances, such as firewalls. It acts as a single entry/exit point for all traffic, forwarding it to a fleet of appliances and then back to the GWLB before reaching its final destination.
Why the other options are wrong
- A. VPC Peering can connect to a firewall VPC, but GWLB provides a more transparent, scalable, and manageable solution for traffic insertion.
- B. Transit Gateway with appliance mode is for ensuring traffic from a specific VPC attachment always uses the same appliance, but GWLB is the service that specifically handles the transparent insertion and scaling of the appliance itself.
- C. NAT Gateway provides outbound internet access but doesn't transparently insert a firewall appliance for inspection.
Gateway Load Balancer (GWLB)
Gateway Load Balancer (GWLB) makes it easier to deploy, scale, and manage virtual network appliances such as firewalls, intrusion detection systems, and deep packet inspection systems.
- Operates at Layer 3 (IP layer)
- Transparently inserts appliances into the network path
- Uses GENEVE encapsulation for traffic forwarding
- Supports auto-scaling of appliance fleets
Memory trick: GWLB is the invisible traffic cop that sends all cars through the inspection station.