← all problemsAWS SA ProHard

Two designs, and the firewall that only sees half a conversation

East-west traffic between VPCs is forced through a stateful firewall in a shared inspection VPC. There is an appliance in every zone for availability, the routing is symmetric on paper, and the whole thing passed its security review.

In production it works for some calls and not others, with no pattern anyone can name. The firewall logs show requests arriving and no matching responses. The failing calls are the ones where the caller and the callee happen to be in different zones.

Both designs route everything through the inspection VPC. Choose the one where the appliance that sees the request also sees the reply.

!Roughly half of cross-VPC calls hang and time out. Retrying sometimes works. The firewall reports no denies, and the security team is confident their rules are correct — which they are.A stateful appliance drops a reply it has no session for. What decides which appliance gets the reply is one attachment setting, and the default is not it.

Design AAn appliance in every zone, defaults elsewhere

Callerzone 1

Calleezone 2

Transit gatewaydefault

Appliancezone 1

Appliancezone 2

Design BAppliance mode on the inspection attachment

Callerzone 1

Calleezone 2

Transit gatewaymode on

Appliancezone 1

Appliancezone 2

Two designs, one brief. Read both, then choose the one that meets it.