Traffic Direction through GWLB Endpoint:

The ingress route table directs inbound traffic to the GWLB through a GWLB endpoint (GWLBe). This

endpoint is responsible for directing traffic to the Gateway Load Balancer for further processing

(Option B).

GENEVE Encapsulation:

The GWLB encapsulates the inbound traffic using the GENEVE protocol. This encapsulated traffic is

then sent to FortiGate instances for security inspection. The use of GENEVE ensures that the original

traffic context is preserved and can be analyzed by FortiGate (Option D).

Other Options Analysis:

Option A is incorrect because GWLB does not forward traffic without encapsulation in its dedicated

subnet.

Option C is incorrect as the inbound traffic is directed to the GWLB endpoint first, not directly to the

application subnet.

Reference:

AWS Gateway Load Balancer Documentation: AWS GWLB

GENEVE Protocol Overview: GENEVE Protocol