AWS Network Firewall vs Gateway Load Balancer

AWS Network Firewall

AWS Network Firewall is a stateful, fully managed, network firewall and intrusion detection and prevention service (IDS/IPS) for VPCs.
Network Firewall scales automatically with the network traffic, without the need for deploying and managing any infrastructure.

AWS Network Firewall cost covers
- an hourly rate for each firewall endpoint,
- the amount of traffic and data processing charges, billed by the gigabyte, processed by the firewall endpoint,
- standard AWS data transfer charges for all data transferred via the AWS Network Firewall.

AWS Gateway Load Balancer

Gateway Load Balancer helps deploy, scale, and manage virtual appliances, such as firewalls, intrusion detection and prevention systems (IDS/IPS), and deep packet inspection systems.
is architected to handle millions of requests/second, volatile traffic patterns, and introduces extremely low latency.

AWS Gateway Load Balancer cost covers
- charges for each hour or partial hour that a GWLB is running,
- the number of Gateway Load Balancer Capacity Units (GLCU) used by Gateway Load Balancer per hour.
- GWLB uses Gateway Load Balancer Endpoint (GWLBE) to simplify how applications can securely exchange traffic with GWLB across VPC boundaries. GWLBE is priced and billed separately.

AWS Certification Exam Practice Questions

Questions are collected from Internet and the answers are marked as per my knowledge and understanding (which might differ with yours).

AWS services are updated everyday and both the answers and questions might be outdated soon, so research accordingly.

AWS exam questions are not updated to keep up the pace with AWS updates, so even if the underlying feature has changed the question might not be updated

Open to further feedback, discussion and correction.

References

Key Considerations for using AWS Network Firewall and Gateway Load Balancer

AWS Gateway Load Balancer – GWLB

Gateway Load Balancer helps deploy, scale, and manage virtual appliances, such as firewalls, intrusion detection and prevention systems (IDS/IPS), and deep packet inspection systems.

GWLB and its registered virtual appliance instances exchange application traffic using the GENEVE (Generic Network Virtualization Encapsulation) protocol on port 6081.
operates at Layer 3 of the OSI model, the network layer.

transparently passes all Layer 3 traffic through third-party virtual appliances, and is invisible to the source and destination of the traffic.
combines a transparent network gateway (that is, a single entry and exit point for all traffic) and distributes traffic while scaling the virtual appliances with the demand.
listens for all IP packets across all ports and forwards traffic to the target group that’s specified in the listener rule.

runs within one AZ and is recommended to be deployed in multiple AZs for greater availability. If all appliances fail in one AZ, scripts can be used to either add new appliances or direct traffic to a GWLB in a different AZ.
cannot add or remove availability zones after the GWLB is created.
is architected to handle millions of requests/second, volatile traffic patterns, and introduces extremely low latency.

does not perform TLS termination and does not maintain any application state. These functions are performed by the third-party virtual appliances it directs traffic to and receives traffic from.
maintains stickiness of flows to a specific target appliance using 5-tuple (TCP/UDP flows) or 3-tuple (for non-TCP/UDP flows).
supports a maximum transmission unit (MTU) size of 8500 bytes.

supports cross-zone load balancing, which is disabled by default. You pay charges for inter-AZ data transfer if enabled.

Gateway Load Balancer Endpoint – GWLBE

GWLB uses Gateway Load Balancer endpoints – GWLBE to exchange traffic across VPC boundaries securely.
A Gateway Load Balancer endpoint is a VPC endpoint that provides private connectivity between virtual appliances in the service provider VPC and application servers in the service consumer VPC.

One GWLB can be connected to many GWLBEs.
GWLB is deployed in the same VPC as the virtual appliances.
Virtual appliances are registered with a target group for the GWLB.

Traffic to and from a GWLBE is configured using route tables.
Traffic flows from the service consumer VPC over the GWLBE to the GWLB in the service provider VPC, and then returns to the service consumer VPC
GWLBE and the application servers must be created in different subnets. This enables you to configure the GWLBE as the next hop in the route table for the application subnet.

Gateway Load Balancer Flow

Traffic from the internet to the application (blue arrows)

Traffic enters the service consumer VPC through the internet gateway.
Traffic is sent to the GWLBE, as a result of VPC ingress routing.

Traffic is sent to the GWLB for inspection through the security appliance.
Traffic is sent back to the GWLBE after inspection.
Traffic is sent to the application servers (destination subnet).

Traffic from the application to the internet (orange arrows):

Traffic is sent to the Gateway Load Balancer endpoint due to the default route configured on the application server subnet.
Traffic is sent to the GWLB for inspection through the security appliance.
Traffic is sent back to the GWLBE after inspection.

Traffic is sent to the internet gateway based on the route table configuration.
Traffic is routed back to the internet.

Gateway Load Balancer High Availability

AWS Gateway Load Balancer vs Network Firewall

AWS Certification Exam Practice Questions

Questions are collected from Internet and the answers are marked as per my knowledge and understanding (which might differ with yours).

AWS services are updated everyday and both the answers and questions might be outdated soon, so research accordingly.

AWS exam questions are not updated to keep up the pace with AWS updates, so even if the underlying feature has changed the question might not be updated

Open to further feedback, discussion and correction.

References

AWS_Gateway_Load_Balancer