A company is deploying third-party firewall appliances for traffic inspection and NAT inside its VPC, which has both public and private subnets. The firewalls must be placed behind a load balancer. Which design is the most cost-effective while meeting these requirements?

The correct design uses a Gateway Load Balancer (GWLB) because it is specifically designed for transparent insertion of third-party virtual appliances, like firewalls, into a network path. The GWLB operates at Layer 3 and preserves the source and destination IP addresses, which is crucial for firewall inspection. Configuring each firewall with two network interfaces (one in a private subnet for internal traffic and one in a public subnet for internet-bound traffic) allows the firewall to perform NAT directly, eliminating the need for a separate NAT Gateway. This approach is more cost-effective as it consolidates NAT functionality within the existing firewall infrastructure. Incorrect options: Using a single network interface and a NAT Gateway adds unnecessary cost and complexity, as the firewalls could handle NAT. Deploying a Network Load Balancer (NLB) is incorrect because NLBs operate at Layer 4 and do not preserve the original source and destination IP addresses, making them unsuitable for transparent inspection by firewalls.