06-16-2022 01:36 AM
Hi @securehops ,
Unfortunately this is not the way that GWLB works...When you enable GWLB inspection on the firewall it will always use the GENEVE protocol information to send the traffic back to the GWLBe it received the traffic and will never make route lookup to route traffic to different interface.
In addition the sub interfaces are not even used for routing, they are only used for zone mapping.
So if you associate VPCs with different GWLBe and have those mapped with different zones, traffic will still be intra-zone from firewall point of view. Because with GENEVE encapsulation inspection firewall will always return the packet to the GWLBe it received it.
I also don't think that in this case you will have inter-vpc traffic working... Because the return traffic will go to the second GWLBe, which is associated with different zone and probably FW will not match this traffic as return traffic for the original request.
