East/West Distributed Inspection
Publication date: July 21, 2022 (Diagram history)
This architecture uses Gateway Load Balancer for distributed East/West inspection between VPCs. Traffic between VPCs routes through Gateway Load Balancer endpoints for inspection in both the source and destination VPCs.
East/West distributed inspection architecture
The following steps describe the data flow in this architecture:
-
Traffic from an Amazon EC2 instance in VPC 1 destined for an instance in VPC 2 forwards to a Gateway Load Balancer endpoint.
-
The Gateway Load Balancer endpoint forwards the traffic to Gateway Load Balancer in the appliances VPC using AWS PrivateLink.
-
Gateway Load Balancer encapsulates the traffic in GENEVE and sends it to a security appliance for inspection.
-
The security appliance inspects the traffic and returns it to Gateway Load Balancer.
-
The traffic returns to the Gateway Load Balancer endpoint in the inspect subnet.
-
The Gateway Load Balancer endpoint uses the inspect subnet route table to forward the traffic to the Transit Gateway endpoint in the TGW subnet.
-
The traffic forwards according to the Transit Gateway route table and arrives in VPC 2.
-
In VPC 2, traffic forwards to the Gateway Load Balancer endpoint for re-inspection.
-
The traffic is re-inspected following the same flow through Gateway Load Balancer and the security appliance.
-
The Gateway Load Balancer endpoint forwards the traffic to the destination instance in the app subnet.
Use Transit Gateway appliance mode in the Inspection VPC Transit Gateway attachment to maintain flow symmetry.
Further reading
For additional information, see the following resources:
Diagram history
To be notified about updates to this reference architecture diagram, subscribe to the RSS feed.
| Change | Description | Date |
|---|---|---|
Reference architecture diagram first published. | July 21, 2022 | |
Reference architecture diagram first published. | July 21, 2022 | |
Initial publication | Reference architecture diagram first published. | July 21, 2022 |
Reference architecture diagram first published. | July 21, 2022 |
Note
To subscribe to RSS updates, you must have an RSS plugin enabled for the browser you are using.
