View a markdown version of this page

North/South Outbound Distributed Inspection - Distributed Inspection Architectures with Gateway Load Balancer
North/South outbound distributed inspection architectureFurther readingDiagram history

North/South Outbound Distributed Inspection

Publication date: July 21, 2022 (Diagram history)

This architecture uses Gateway Load Balancer to inspect outbound traffic in a distributed fashion. Multiple VPCs share the same backend security appliances through AWS PrivateLink for traffic destined to the internet.

North/South outbound distributed inspection architecture

Architecture diagram showing distributed outbound inspection with Gateway Load Balancer using shared security appliances for internet-bound traffic.

The following steps describe the data flow in this architecture:

  1. Traffic from an Amazon EC2 instance destined for the internet arrives at NAT Gateway, which translates the source IP of the packets.

  2. NAT Gateway forwards the translated packets to a Gateway Load Balancer endpoint using the public subnet route table.

  3. The Gateway Load Balancer endpoint forwards the traffic to Gateway Load Balancer in the appliances VPC using AWS PrivateLink.

  4. Gateway Load Balancer encapsulates the traffic in GENEVE and sends it to a security appliance for inspection.

  5. The security appliance inspects the traffic and returns it to Gateway Load Balancer.

  6. The traffic returns to the Gateway Load Balancer endpoint in the inspect subnet.

  7. The Gateway Load Balancer endpoint uses the inspect subnet route table to forward the traffic to the internet gateway.

For best practices when deploying Gateway Load Balancer, see Best practices for deploying Gateway Load Balancer.

For more information about implementing a distributed inspection architecture, see Scaling network traffic inspection using AWS Gateway Load Balancer.

Further reading

For additional information, see the following resources:

Diagram history

To be notified about updates to this reference architecture diagram, subscribe to the RSS feed.

ChangeDescriptionDate

Initial publication

Reference architecture diagram first published.

July 21, 2022

Initial publication

Reference architecture diagram first published.

July 21, 2022

Initial publication

Reference architecture diagram first published.

July 21, 2022

Initial publication

Reference architecture diagram first published.

July 21, 2022

Note

To subscribe to RSS updates, you must have an RSS plugin enabled for the browser you are using.