QuestionQ214

Network Design

A company’s current AWS environment includes public application servers running on Amazon EC2 instances. The application servers operate in a VPC subnet, and every server has an Elastic IP address.

The company now requires firewall inspection of all internet traffic before that traffic reaches any EC2 instances. A security engineer has deployed and configured a Gateway Load Balancer (GLB) in a standalone VPC containing a fleet of third-party firewalls.

How should a network engineer update the environment so that traffic passes through the firewall fleet?

  • A Deploy a transit gateway. Attach a GLB endpoint to the transit gateway. Attach the application VPC to the transit gateway. Update the application subnet route table's default route destination to be the GLB endpoint. Ensure that the EC2 instances' security group allows traffic from the GLB endpoint.
  • B Update the application subnet route table to have a default route to the GLOn the standalone VPC that contains the firewall fleet, add a route in the route table for the application VPC's CIDR block with the GLB endpoint as the destination. Update the EC2 instances' security group to allow traffic from the GLB.
  • C Provision a GLB endpoint in the application VPC in a new subnet. Create a gateway route table with a route that specifies the application subnet CIDR block as the destination and the GLB endpoint as the target. Associate the gateway route table with the internet gateway in the application VPUpdate the application subnet route table's default route destination to be the GLB endpoint.
  • D Instruct the security engineer to move the GLB into the application VPC. Create a gateway route table. Associate the gateway route table with the application subnet. Add a default route to the gateway route table with the GLB as its destination. Update the route table on the GLB to direct traffic from the internet gateway to the application servers. Ensure that the EC2 instances' security group allows traffic from the GLB.
Explanation

A Gateway Load Balancer endpoint must be placed in a separate subnet in the application VPC. A gateway route table associated with the internet gateway routes traffic destined for the application subnet CIDR to that endpoint, ensuring inbound internet traffic is inspected before delivery to the EC2 instances. The application subnet’s default route must also target the endpoint so return traffic follows the inspection path. AWS documents this ingress-routing pattern for Gateway Load Balancer endpoints.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!