View a markdown version of this page

North/South Inbound Distributed Inspection - Distributed Inspection Architectures with Gateway Load Balancer
North/South inbound distributed inspection architectureFurther readingDiagram history

North/South Inbound Distributed Inspection

Publication date: July 21, 2022 (Diagram history)

This architecture uses Gateway Load Balancer to inspect inbound traffic in a distributed fashion. Multiple VPCs share the same backend security appliances in a centralized appliances VPC connected through AWS PrivateLink.

North/South inbound distributed inspection architecture

Architecture diagram showing distributed inbound inspection with Gateway Load Balancer using shared security appliances across multiple VPCs.

The following steps describe the data flow in this architecture:

  1. Traffic from the internet destined for the Application Load Balancer arrives at the internet gateway. The ingress route table forwards it to a Gateway Load Balancer endpoint.

  2. The Gateway Load Balancer endpoint forwards the traffic to Gateway Load Balancer in the appliances VPC using AWS PrivateLink.

  3. Gateway Load Balancer encapsulates the traffic in Generic Network Virtualization Encapsulation (GENEVE) and sends it to a security appliance for inspection.

  4. The security appliance inspects the traffic and returns it to Gateway Load Balancer.

  5. The traffic returns to the Gateway Load Balancer endpoint in the inspect subnet.

  6. The Gateway Load Balancer endpoint uses the inspect subnet route table to forward the traffic to the Application Load Balancer in the public subnet.

  7. The Application Load Balancer forwards the traffic to one of its healthy Amazon EC2 instances.

For best practices when deploying Gateway Load Balancer, see Best practices for deploying Gateway Load Balancer.

For more information about implementing a distributed inspection architecture, see Scaling network traffic inspection using AWS Gateway Load Balancer.

Further reading

For additional information, see the following resources:

Diagram history

To be notified about updates to this reference architecture diagram, subscribe to the RSS feed.

ChangeDescriptionDate

Initial publication

Reference architecture diagram first published.

July 21, 2022

Initial publication

Reference architecture diagram first published.

July 21, 2022

Initial publication

Reference architecture diagram first published.

July 21, 2022

Initial publication

Reference architecture diagram first published.

July 21, 2022

Note

To subscribe to RSS updates, you must have an RSS plugin enabled for the browser you are using.