📖 What is AWS Gateway Load Balancer (GWLB)?
AWS Gateway Load Balancer (GWLB) is a service that simplifies the deployment and scaling of third-party virtual appliances, such as firewalls or intrusion detection systems. It acts as a single entry and exit point for all traffic, ensuring consistent inspection across multiple availability zones.
"Focus on the "third-party appliance" keyword; GWLB is specifically designed to insert security appliances into the network path without complex routing."
📚 Certification: AWS Certified Solutions Architect - Associate (SAA-C03)
🔑 What are the Key Concepts of AWS Gateway Load Balancer (GWLB)?
- ▸ Utilizes the GENEVE protocol to encapsulate original IP packets, allowing security appliances to see original source and destination headers for accurate inspection.
- ▸ Acts as a transparent 'bump-in-the-wire,' enabling the insertion of third-party virtual appliances without requiring them to act as the default gateway.
- ▸ Leverages Gateway Load Balancer Endpoints (GWLBe) to route traffic from source VPCs to a centralized fleet of security appliances across multiple AZs.
- ▸ Provides automatic scaling and health monitoring for virtual appliances, ensuring that traffic is only routed to healthy instances to prevent security gaps.
🎯 How does AWS Gateway Load Balancer (GWLB) appear on the SAA-C03 Exam?
You may be asked to design a centralized security architecture where all traffic entering a set of spoke VPCs must be inspected by a third-party firewall. You should identify GWLB as the solution to avoid managing complex routing for each appliance.
A scenario might describe a requirement to deploy a fleet of Intrusion Detection Systems (IDS) that must scale automatically and maintain original packet headers. Expect to choose GWLB over NLB to support the GENEVE protocol.
❓ Frequently Asked Questions
How does GWLB differ from a standard Network Load Balancer (NLB)?
While NLB distributes traffic to application targets, GWLB is specialized for security appliances. It uses the GENEVE protocol to encapsulate traffic, ensuring the appliance receives the original packet headers rather than the load balancer's IP.
Do I need to change the default gateway of my instances to use GWLB?
No. By using Gateway Load Balancer Endpoints (GWLBe) and updating the VPC route tables, traffic is transparently redirected to the appliances without requiring any configuration changes on the source instances themselves.