Inbound Inspection

[wilm25]

Hello,

I have a question regarding inbound inspection in centralised model using Palo Alto Cloud NGFW, which was described here.

I'm focusing on the Figure 11: Cloud NGFW is deployed to protect inbound traffic to a VPC (Single AZ).

In this architecture, the Application Load Balancer was deployed in central Security Account. My assumption is that you can bind multiple domains to the same ALB and route traffic to different internal web-server (i.e. example.com, example2.com), based on the host-header feature provided by the ALB. So far so good. 

But what if I want to provide inspection to services that are not working on HTTP/HTTPs protocols, i.e SFTP, FTP, SSH (and many others)? My first thought was to deploy another subnet in the central Security Account with Network Load Balancer. NLB works on layer 3/4, so it's not understanding host headers. Solution for that would be to create listeners on different ports and bind them to appropriate target groups, i.e:

- 222 NLB -> 22 (internal sftp-server-1)

- 223 NLB -> 22 (internal sftp-server-2).

Is this viable solution or is there any other way to handle multiple services via the same central NLB? 

Regards