Overlay Routing Best Practice for Outbound-Only Traffic with Palo Alto VM + GWLB (100+ VPCs)

For your centralized outbound-only traffic inspection setup with Palo Alto VM-Series firewalls behind Gateway Load Balancer (GWLB), here's guidance on overlay routing and interface configuration:

1. Regarding overlay routing for outbound-only inspection:

Overlay routing is supported with Palo Alto firewalls and GWLB/GENEVE, and can be beneficial for outbound-only traffic inspection. It allows you to perform NAT directly on the Palo Alto appliances instead of using separate NAT Gateways, which could lead to cost savings at your scale of 100+ VPCs.

For centralized egress inspection where you're only handling outbound traffic (not ingress), overlay routing is a good option as it simplifies the traffic flow. The traffic can be source NATed (SNATed) to the interface IP of the Palo Alto appliance and sent directly to the internet.

2. Regarding single interface usage:

Using a single interface for both ingress and egress traffic in your Palo Alto firewalls can work for outbound-only inspection scenarios. However, there are considerations:

• If you later decide to add ingress traffic inspection with endpoints distributed into workload VPCs, using overlay routing with a single interface could create routing problems. This is because ingress traffic would need to return to the source GWLB endpoint and then be forwarded out of the IGW local to the workload, but overlay routing would send packets directly to the internet via the Palo Alto firewall, creating asymmetric flows.

• For your current outbound-only use case, a single interface configuration can be sufficient if properly configured.

Best practices for your centralized egress setup at scale:

• Enable appliance mode on Transit Gateway to maintain flow symmetry through your Palo Alto firewalls. This ensures bidirectional traffic is routed through the same appliance and Availability Zone for the life of the flow, which is important for stateful inspection.

• Consider using auto scaling groups as targets for your GWLB to help manage the availability and scalability of your Palo Alto firewall fleet automatically, especially given your large scale of 100+ VPCs.

• Be mindful of GWLB idle timeout settings to avoid potential connection timeouts on clients. You may need to tune timeouts on various components in your architecture.

• If you're only doing outbound inspection and have no plans for ingress inspection, overlay routing with direct NAT on the Palo Alto appliances can be an efficient approach.
  Sources
  NAT on Palo FW appliance with Gateway Load Balancer instead of using NAT Gateway | AWS re:Post
  Using the NAT gateway and Gateway Load Balancer with Amazon EC2 instances for centralized IPv4 egress - Building a Scalable and Secure Multi-VPC AWS Network Infrastructure
  Design and build IPv6 internet inspection architectures on AWS | Networking & Content Delivery