What configuration on AWS is required in order for VM-Series to forward traffic between its network interfaces?

Question

Options

• ABoth Source and Destination Checks are disabled
• BBoth Source and Destination Checks are enabled
• CSource Check is disabled and Destination Check is enabled
• DSource Check is enabled and Destination Check is disabled

• A
  89% (17)
• B
  5% (1)
• D
  5% (1)

Explanation

Disabling both Source and Destination Checks (option A) is required because the VM-Series firewall acts as a middleman - it forwards traffic where it is neither the original source nor the final destination. AWS's Source/Destination Check is a hypervisor-level guard that silently drops packets not addressed to or sent from that specific instance; leaving either check enabled (options B, C, or D) causes AWS to discard forwarded traffic, breaking the firewall's core routing function. Options C and D are wrong for the same fundamental reason - any check remaining enabled will still cause packet drops for transit traffic. Options B is the worst case, fully blocking all forwarding.

Memory tip: Think "firewall = traffic cop, not a participant." A cop directs others' traffic - AWS needs to stop checking if the cop owns every car passing through, so both checks must go off.

No community discussion yet for this question.