question regarding aws gwlb geneve

In a Gateway Load Balancer (GWLB) architecture, the standard traffic flow does indeed follow the first pattern you described, where traffic is encapsulated with GENEVE both to and from the firewall appliance.

The second pattern you described, where the firewall performs GENEVE decapsulation but no re-encapsulation, is not a standard GWLB traffic flow. This approach is known as "overlay routing" and is supported by some third-party firewall appliances, particularly in scenarios involving internet-bound traffic.

With overlay routing, the firewall can decapsulate the GENEVE traffic, inspect it, and then route it directly to its destination without re-encapsulating it and sending it back through the GWLB. This is typically used when the firewall is performing NAT for internet-bound traffic, essentially replacing the need for a separate NAT Gateway.

However, this approach comes with important considerations:

1. It can create asymmetric routing issues, especially if you're also using the same firewalls to inspect ingress traffic with endpoints distributed into workload VPCs.

2. It may disrupt the expected traffic flow patterns in your VPC architecture, as return traffic might not follow the same path.

3. It requires specific configuration on the firewall appliance to support this mode of operation.

For most centralized inspection architectures using GWLB, the standard pattern with both decapsulation and re-encapsulation is recommended to maintain consistent traffic flows and ensure proper security inspection of both directions of traffic.
Sources
NAT on Palo FW appliance with Gateway Load Balancer instead of using NAT Gateway | AWS re:Post